What is most likely cause of page injections while using Tor?

Question

So, I have a connection from my Linux-64-tor-2.6.3 TBB browser to an entry node in a foreign country. That country is a very long way from here. The node is running the latest Tor, so it's using a ECDHE* (supposedly strong) encryption cipher suite. I look at netstat, and see only the 443 connection from here to the foreign node. While Tor appears to be working OK, I see that junk is injected into my pages (nasty stuff). I believe the junk may come from a local hostile environment. I did not accept any additional certificates. So, if it's really local, what's the most likely scenario:

1) The ECDHE_RSA_WITH_AES256 suite can be broken on the fly (very quickly)?

2) The certificates for the Tor node are manipulated/compromised?

3) I have somehow been compromised with a trojan, in spite of only using the single encrypted Tor pipe to the foreign node, and having made a fresh OS install immediately prior to that?

4) Your choice

Answer 1

If it is local as you assume, option 3 is by far the most likely. Option 1 seems very unlikely, option two would mean that someone is simulating either your guard, middle and exit nodes or that your guard is simulating your middle and exit nodes, which is only possible if the keys of these relays are compromised (unlikely for an extended period of time). One idea for option 4 is that you're not using the real Tor client, that the Tor client has a bug that can be remotely exploited to execute code.

It's of course also possible that your guess is wrong and the attack isn't local but rather it is happening at the exit node or between exit node and your destination.

Answer 2

Most likely the exit node operator (or someone on their network) is modifying your network traffic.

For example:

http://threatpost.com/researcher-finds-tor-exit-node-adding-malware-to-binaries/109008

While not a common occurrence, IMO, it should be planned for. Try to use https or ssl/tls everywhere you can.