Is it possible to find hidden service IPs by compromising an end node of a client connecting to it?

Question

So the TOR works basically by sending a encrypted packet across multiple computers. The packet is encrypted such that only the first computer on the relay knows the user's IP, and the last computer knows the destination IP (i.e the requested website).

Would it be possible to find the IP of .onion websites by intercepting the packets at the end node?( Its possible to see the first destination from the packets being sent out by the computer) And since the TOR Browser is F.O.S.S, could it be possible to configure TOR to use 3 local servers to act as relay nodes, and intercept the packets sent to the last one, thus exposing the destination IP?

Answer 1

The details of how exactly hidden services work are a bit complicated, but the important part for this question is that both the client and the server build their own 3-node circuit to a meeting point in the middle. Thus, even if you altered your client code to connect to a known compromised exit node, the only thing that node knows is the "exit node" of the server's connection. Under the same principles that normally protect websites from reversing the circuit to know who you are, you similarly cannot reverse that circuit to know who the hidden service is.

The most dangerous node for a hidden service is its guard node, which is why the tor project made it harder to become one after the CMU attack was made public.

Answer 2

There is an attack called end-to-end confirmation attack. The idea is very simple. An attack tries to get into the both ends of the communication channel. There the attacker tries to find a pattern on outgoing and incoming traffic. Amount of data generated and the timings between them are observed for this purpose.

Tor website explains it this way:

Suppose the attacker controls, or can observe, C relays. Suppose there is N relays total. If you select new entry and exit relays each time you use the network, the attacker will be able to correlate all traffic you send with probability around (c/n)².

If your entry guard node is an attacker and he controls or watches the website you visit; in that case, you can easily implement this attack.
Link to a very good blog on this topic.