the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys
That’s what really makes my hair stand on end. Is there some vulnerability in ssh they exploited to gain full access, unauthorized?
That’s what really makes my hair stand on end. Is there some vulnerability in ssh they exploited to gain full access, unauthorized?
4?
No, different kind of certificate. And even if it was signed, it still shouldn’t be accepted for auth.
It’s possible to remove a line from the authorized_keys file at any point