I understand many of the possible attacks against a user visiting a regular website over Tor but I am wondering, what are the potential attacks to identify a connection between a user and a hidden service?
Considering the FBI recently decided that their best exploit was to actually break the hidden service and add malicious javascript to the pages, I want to know if there has been any good research done into other threats against users?
Tor Hidden Services are primarily designed to protect server operators and don't add any additional protections for the users (except perhaps the fact that if the server operator is using a hidden service it's less likely that someone can be squatting on an upstream router attempting to correlate your traffic). However, hidden services can still be compromised by attacking the server or other software directly (ie. going after a vulnerability in Apache or Nginx). The hidden service can then be used in turn to attack the users of that service.
For example, I'm assuming the JavaScript injection attack you're talking about is the one against Freedom Hosting last month. It should be noted that this was an attack against Freedom Hosting itself (not against all Tor Hidden services) that then exploited a bug in the TBB's version of Firefox (which users were using to visit the hidden services). More details about the attack can be found in these blog posts and in the security advisory.
I'm not aware of any research into end-to-end correlation between a user and a hidden service (as you said, most of that goes towards users of Tor exiting to a normal web service), but I'm sure such research exists.
The other case one must consider is are services that are on the public internet and also provide tor hidden services. In this case the hidden service is not actually protecting the server operator (since they're operating publically as well), but it does mean the user doesn't have to trust an exit node (they always stay within the Tor network and only exit directly at the end point). If the hidden service is 'unofficial' however (run by a random person proxying to the end service), no benefit is gained. In fact, at this point, the person is essentially trusting a single effective-exit-node and doesn't have the option of changing their exit node by building a new circuit (it will always simply be the owner of the hidden service doing the proxying). So trusting a service that's not operating completely within the Tor network could potentially make correlating traffic that much easier for a determined attacker.
First it is important to keep in mind that a hidden service tries to keep the provider of the information anonymous. Hidden service hides the IP address of the web server, mail server etc.
The hidden service host can do all nasty things which also a non-hidden-service-host can do. So hidden services provide neither more security nor less security. You are exposed to the same risks like a normal Tor user or a non-Tor user.
