Can tor nodes (entry, exit, others) store IPs?

Question

I'm a new Tor user. And I want to ensure several questions.

1. Can "entry point" router store my IP?
2. Can "middle relay" store "entry point" IP?
3. Can "exit point" router store "middle relay" IP?

I think yes. And the tor routers can be configured (hacked) to store IP and target server information. So when all points belongs to one owner (eg. network provider, NSA, etd.) then he can know what page I want to see and from which IP. Correct?

I understand, that they cannot see the content due to HTTPS.

This is anonymity problem. So how is this "secured" in tor system. Do I have to believe that tor routers doesn't store and share this information? But "believe" is not secure enough.

Answer 1

What you say is true. This attack exists. If all the nodes are controlled by an attacker such an attack works.

However Tor is designed to make it somewhat hard for one attacker to control all the nodes and really target and individual users.

It also explains why your client chooses and keeps an entry guard. Entry guards, entry points, so the first hops is something your Tor chooses when you start it the very first time. It tries to keep it. That way an attacker attacker (hopefully) gets only one chance to become your entry guard.

Instead of choosing a VPN it may be an alternative to set up your own Tor relay (it's really not hard) and have it be your first hop. That way an attacker will not know if you are the person that uses the middle node and the exit node. It could always be someone else. The more bandwidth you add to that relay the slimmer the more other possibilities (people) there are.

Also every Tor relay/guard node added to the Tor network makes a successful attack harder, more resource intense. There is the sybil attack where an attacker would set up a huge amount of relays to become Tor nodes at once. However, to receive the guard flag a node needs to be stable, "fast" and up and running for a while. This allows the Tor Project to react and for example manually get rid of them in the sense of flagging them in ways that they never end up being used. This actually has been done in the past.

Answer 2

After reading this page https://www.torproject.org/eff/tor-legal-faq.html.en including the paragraph on Should I snoop on the plaintext traffic that exits through my Tor relay? (regarding exit nodes) Which begins:

You may be technically capable of modifying the Tor source code or installing additional software to monitor or log plaintext that exits your relay.

I don't see any reason why someone who owns a relay (including middle nodes and entry guards) wouldn't be able to keep a log of the IP addresses of the next and previous nodes (they do know what they are after all). Even if it is not something that can be done by default (I don't know whether it is) the source code is open and can be modified by any user with the knowledge. However if the adversary only owns one node on the circuit then they would be unable to deanonymize you. If they own the exit node and you are not using end to end encryption then they might still be able to deanonymize you by the content of the packets they are able to sniff as they are sent and received from the website you are visiting (but that is beyond this question).

As you have pointed out if all the nodes are owned by the adversary then it would be trivial for them to deanonymize you. Tor does not protect you from every attack that could be used to identify you and new vulnerabilities are being found and patched all the time. I recommend you acquaint yourself with the various vulnerabilities and ways to stay safe when using Tor and It is up to you to decide whether Tor provides adequate protection for your needs. The Tor website is probably the best place to find the information you require. This is a reasonable place to start https://www.torproject.org/docs/faq.html.en#AnonymityAndSecurity

A word on VPNs; Though they can provide an extra layer of security, you also need to be extremely careful as to which VPNs you trust as they could also be the weakest link in the chain. If you don't acquire a VPN anonymously, then they can pose even more of a threat to your privacy. Properly and anonymously implemented they could be helpful but you need to put in the work and research the topic very thoroughly.

Answer 3

The Tor Project maintains an overview page. There you'll find images on how Tor works.

_{(source: torproject.org)}

Alice builds a connection to the first node in the network. This node can see (and store) Alice' IP address. She then asks the first node to extend the connection. So the first node sees Alice' address and the address of the second node. That's it.

Later Alice asks the second node via the first node to extend the circuit. So the second node just sees the address of the first node and the address of the last node. So this node doesn't know about Alice' IP address and thus can't store it.

It is the same with the last node in the network. However there is a pitfall. If Alice is using plain text (like a HTTP-only page) the last node is able to inject some malware which reads out Alice' real IP address. So if the last node is an attacker and Alice uses some poorly secured browser, also the last node might be able to read her address through attacking her.

Within the design of Tor is that every node can see the IP address of the previous and the next node. You're right when all three parties play together they are able to de-anonymize the user. If all three nodes belong to the same party or if all three parties share their individual encryption keys, the anonymity of Alice is lost. At least for ca. ten minutes. After that Tor will use another circuit with other nodes and also all three nodes must play together.

The Tor Browser shows you the three nodes it currently uses (click on the green onion). If you think that something is wrong and you don't want to investigate further, I'd recommend to use a New Identity. Tor Browser will open a new connection and delete all old session data.