Is this a security flaw?

Question

Now, this seems almost too obvious, so I assume I must be missing something, but I figure I should run it by the experts first to see.

Hypothetical scenario: At 5:18pm, a user using the Tor network logs on and posts something on WikiLeaks (or some other site wherein anonymity would best be maintained in the interest of self preservation).

Lets say the data leaves country x, bounces off county a to country b to country c, finally arriving at server y in country y.

If regime x really wanted to seek prosecution of whomever contacted server y, wouldn't be as simple as contacting country y and using diplomatic connections to find out the ip of the server in country c which contacted the server y at exactly 5:18pm, contact country c to find out who contacted server c in country b, contact country b and find out who contacted server b in country a, then finally contacting country a to find out who contacted server a in country x? This of course would give them little trouble hunting down server x (you).

x => a => b => c => y

1. get ip of c by looking in y's logs at precisely 5:18 and some milliseconds
2. get ip of b by looking in c's logs at precisely 5:18 and some milliseconds
3. get ip of a by looking in b's logs
4. kick in your door once they realized your ip contacted server a at exactly 5:18

It should be mentioned, that county x would begin the investigation if the data sent to server y directly involved it. but if the data did hurt country x, then it's not a far cry to assume that they would begin an investigation

Of course this whole thought experiment relies on the idea that countries y,c,b, and a would all be diplomatically friendly with country x, but if its a life and death scenario should we really be relying on one countries inability to communicate with another???

Please tell me I'm missing something!?!?!?!

Answer 1

What you're describing is a timing attack and yes this is possible. One attempt to mitigate this is to pump a constant stream of data through Tor at all times so it's difficult to differentiate between your upload and benign information. This was discussed here

Answer 2

Well kinda, but that is inherent of how it works. That is quite difficult because you would have to subpoena each of the nodes which are likely from different countries which is rather hard. Additionally, people don't usually keep logs and TOR doesn't keep any by default. However, time-based attacks are a thing, they work like this

x => a => b => c => y 1)Packets left x at lets say 5:18:12 (5:18 and 12 seconds)

2)Packets arrive at y at 5:18:45 (5:18 and 45 seconds)

3)You send lots of packets and they can find what the time delay and the offset is then they can see where you are sending packets.

Please note that This is usually only used in targeted attacks and is not used in a dragnet format.

Additionally, note that this requires access to your isp (or at your first hop) and the exit nodes ISP.

source:

Grugq, The. "The Grugq - OPSEC: Because Jail Is for Wuftpd." YouTube. YouTube, 26 Nov. 2012. Web. 21 June 2015. https://www.youtube.com/watch?v=9XaYdCdwiWU.

Answer 3

Please tell me I'm missing something!?!?!?!

Well, yes, you might.

1. The Onion Routers which relay your traffic (a, b, and c) are often interconnected anyways, relaying not just your traffic, but much other traffic as well.

2. They should not keep connection logs:

In most instances, properly configured Tor relays will have no useful data for inquiring parties, and you should feel free to educate them on this point.

3. Wikileaks has a hidden service, which increases the trouble of someone trying to find out who connected by increasing the number of hops to six, f.ex.

If someone can observe all of those relays which forward the data, you might indeed have a timing attack problem, as @Nick answered.