Instead of looking at a portion of the network, find out the guard of a targeted user, then find which middle node that guard connects to, then which exit is connected to that middle node, then take the logs of that exit and match them to that IP of that middle node. In other words, if one finds the total circuit, they can easily de-anonymize people. I'm sure it's not this easy, so what am I missing?
2 Answers
No, this approach will not work that simply.
First of all, you've got your targeted user(s). Bob and Alice. You assume the role of Eve (a passive adversary, who can only observe). You know Bob is talking to someone over Tor and you want to discover who. So you hoodwink a confused deputy (this is a polite way of saying "lie to a judge") to get Bob's internet connection records.
Upon inspection of Bob's internet connection records you see he's connected to a Tor guard relay. Now, you need to hope that you have jurisdiction in the region of the guard to get details of it's internet connection records. Lets imagine that your judge was incredibly pliant and had legal authority to let you retrieve them too.
When you inspected the guards internet connection you'd see that actually lots of users are using this guard, not only that but the connections are opaque, not all of the connections are from clients, some of them are outbound traffic too! You have no way of knowing which of the users coming into the guard goes out to which middle relay, the average relay will hold thousands of connections open at any one time.
Now you'd need to apply some statistical analysis, which would require detailed packet capture information for the guard. You'd better hope that someone has them and you have the legal authority to get them! Now you can say with some value of certainty which circuits are Bob's. You've no idea which relate to Bob's communications with the other party you wish to discover and which are just Bob updating the consensus or which are just opportunistically built in case they're needed later.
You'd need to now try to get the internet connection records of all the other relays involved in Bob's circuits. Many of these will exist in multiple legal jurisdictions, some even with countries that you don't have friendly relations with or that have laws that mean ISPs don't need to keep records and so they may not be available and even if you could get them you'd end up having to making a multiple requests for each of the circuit you discovered to be Bob's from the set of middle relays. If this was an onion circuit that would be 6 hops worth of this process and would probably require the records of all the Tor network. This process is expensive and would require extraordinary abuse of power across a varied geopolitical landscape. You'll notice that it only gives you some percentage of certainty that any circuit is really Bob's.
The cost for most adversaries to carry out an attack like that is prohibitive, impractical and realistically entirely impossible. There are better approaches, you can perform the same kind of statistical analysis if you can just see Bob/Bob's Guard and Alice/Alice's Guard. See the Tor Project FAQ for more details.
You're missing the middle guard detection difficulty - that's the reason why the minimal and default circuit length is 3 hops, actually. Unless you're running tons of middle nodes and guards - which is quite an expensive task - you can't see the middle node that easy.
answered Dec 21, 2016 at 20:19
