In the first episode of the first season of Mr.Robot, Elliot is able to monitor Rohit's traffic even though he was using Tor and .onion sites. How did Elliot do that? Would it be possible to do that in real life? Can it be prevented?
1 Answer
If Rohit is connected to an onion site the traffic is encrypted point to point. Nothing on the wire can give him away. If he is connected to a conventional site over Tor there are some attack vectors available. Assuming that Rohit is connected to an onion, the only way Elliot can gain any info is to compromise Rohit's laptop, or the server serving the data. Both have access to the packets on the other side of the encryption.
If your laptop gets hacked, there is no measure of security that will protect you. Most all network security protocols work on preventing people who tap your connection from seeing information. Once someone owns your laptop, they can just stream your desktop and read your browser data off your screen.
The way to prevent this is to keep your OS from getting hacked or use a "stateless" OS like tails. There are lower level hacks like installing a FW trojan to compromise any RNG that even tails couldn't prevent. If an attacker installs hardware or firmware level intrusions, you would need to counter act those at that level.
To prevent (or complicate) FW hacks, you should use something like UEFI secure boot. Secure Boot is supposed to sign key FW components to detect any malicious FW, but very few vendors get it right. A proper implementation would need to sign, verify and checksum each FW component involved with IO or Networking.
Even with Tails and a perfect UEFI Secure Boot implementation you are still exposed to hardware implanted devices, acoustic cryptanalysis, and other side-band attacks like Meltdown and Spectre. With these HW and sideband attacks, there really is no counter measure. Some have since been patched, but assuming Elliot knows of zero-day sideband attacks, there is little hope for Rohit's.
Stepping out of the make believe and world of crypto research, most users simply want to know what is exposed on a typical TLS or Tor connection. Here's a great visual to give you and understanding of what communication data is vulnerable and when. In the real world, you'll be fine. Generally if you only connect to onions or TLS (https://) sites over Tor you are safe. If you connect to "http://" sites there is an attack vector if someone playing the part of the NSA could correlate your traffic... even on Tor.
