Question: What are plausible circumstances in which one could hack an individual Onion Router to discover the location of the previous router?
Reason: I’m an aspiring writer, working on a spy-thriller novel. My plan is that the good guy will find the bad guy by backtracking through the bad guy’s Tor circuit, hacking each router, one-by-one, until he reaches the bad guy’s computer. It is essentially a treasure hunt with Onion Routers as clues.
Moreover, I want the protagonist to physically travel to each router to hack it. That way I can fit in cool locations. For instance, the exit router could be in the mansion of a Russian mobster. So the protagonist travels to Moscow, breaks into the mansion and hacks the exit router. That router then reveals the location of the middle router: an opera house in Vienna. So the protagonist goes to Vienna, breaks into the opera house and hacks the middle router. Etc., etc., until he reaches the bad guy’s computer.
To sum up, then, what are circumstances in which one could hack each router individually to find the original sender? Circumstances can be exceptional, but must be believable.
Here are some (bad) ideas of mine:
The bad guy live streams a ticking time bomb, keeping the circuit open.
The bad guy has preselected the routers and left clues to where they are.
The NSA has a device that keeps the circuit open for 24 hours. Something like a cold boot attack, but with circuits instead of RAM.
Please help! I realize this is an atypical request, but I would be grateful for any advice!