I'm reviewing the documents filtered by Snowden related to Tor. Two documents in particular, entitled "A potential technique to deanonymise users of the TOR network (proposal)" and "A potential technique to deanonymise users of the TOR network (presentation)" have caught my attention.
These documents propose "a deanonymisation attack against Tor users based on the collection of data from exit nodes owned by the agency".
It seems that the documents mention a classic attack: the 'traffic correlation attack' or 'end-to-end attack'. But, although the document says that the attacker must control the exit node to consummate the attack, it states that it is not necessary to control the entry node; instead, it proposes to collect the information between the client and the entry node through "SIGINT".
Here you can find a screenshot of one of the documents where the attack is graphically represented.
My question is:
How can information be collected between the client and the entry node by means of "SIGINT".
On the other hand, I already know that one of the vulnerabilities of low latency anonymity networks, such as Tor, is the traffic correlation attack. That's why Tor introduced entry guards and changes the circuit every ten minutes. But has any further improvement been made to prevent this type of attack?