Is the “Ron's Coffee” Tor-related hack technically possible in episode 1x01 of Mr. Robot?

Question

In the episode 1x01 of Mr. Robot, Elliot confronts the owner of Ron's Coffee. He basically states that the man is hosting illegal (child pornography) content served in the form of a website that the customers of his coffee shops can access from the shops' Internet connections. Elliot also briefly describes the owner's use of “Tor networking to keep the servers anonymous”. So, the details are not known, but we can imagine that the guy set his website up as a hidden service.

What bugs me is the moment when Elliot states that he could trace traffic between the coffee shop and the illegal servers, saying: “Whoever is in control of the exit nodes is also in control of the traffic, which makes me the one in control”, implying that he runs one or more Tor exit nodes himself, and that he managed to do either or both of those 2 things:

1. somehow “forcing” the traffic from the coffee shop to go through the exit node(s) he runs;
2. monitoring packets going through the exit node(s) he runs and tracing them back to their original senders.

Either of those is impossible if I get Tor's innards correctly.

I mean, as far as my understanding of Tor goes, it's not possible to trace a user from the exit node back to his/her origin address, and that's precisely the point of onion routing. The only origin address you can get at the exit node is the address of the direct previous node in the chain. So even if you control an exit node, you can't tell who the incoming packets really belong to. You'd have to control a pretty heavy bunch of nodes for the routing of a user to hypothetically pass only through your nodes from entry to exit. That wouldn't even be as simple as that, because the selection and order of the nodes in the chain are random, aren't they? So you'd have to own a really big number of nodes in order to get only a very, very slim chance to trace a user from A to B.

So, is Elliot's hack really technically feasible the way he says he did it? Couldn't it be some kind of counter-propaganda to undermine Tor and its efficiency (especially given that anti-Tor proponents' main argument is that Tor can be used to cover up criminal activities)? Or maybe this is just some kind of simplification for dramatization's sake (which would be a little lame, even though I guess most of the show's viewers are not tech-savvy)? Or maybe I'm missing something about Tor's general flow of operation?

Answer 1

The hack isn't possible the way he described it. First he implied that the guy was using hidden services to hide his servers, then he said that he was able to mess with his traffic at the exit nodes. Hidden services don't have exit nodes; it's encrypted end-to-end, hence the hack is just gibberish.

If he was using regular Tor then it might be possible provided the guy's traffic was unencrypted (e.g. HTTP instead of HTTPS). To do the hack he could do something like insert code into the page that sends back sensitive information such as IP address to the server which the exit node would then be able to see and would use to deanonymise the client, then he would hope that the guy visits illegal websites before he switches exit nodes. But as you said, for this to be possible he would have to have his exit node selected for use by the guy, which is unlikely if he's just running one.

Answer 2

It is true that hidden services don't use exit nodes, but from what was mentioned in the scene, it can be implied that the local traffic from Ron to his servers (where a HS was hosted) is what Elliot must have sniffed. Elliot is physically at the coffee shop and on the same connection (the gigabit connection mentioned) used by Ron. It's rather implied that all he had to do was compromise Ron's local servers regardless of his Tor usage.

By the movie dialogue, Elliot must have compromised into Ron's system and accessed the files. It can also mean he could then have created few exit nodes to monitor further incoming traffic from the servers.

It was demonstrated Swedish Researcher Dan Egerstad that it is possible to intercept information by controlling a few exit nodes.Read this.

Also given the time of the episode launch in 2015, it can be assumed that the show wanted to hint over the recent vulnerability disclosed in TOR Browser Bundle by the researchers at the MIT. Read This. This issue has been patched since then.

So yes, technically it was possible to do the hack at the time it was mentioned assuming Elliot compromised Ron's local servers.

Answer 3

Yes! Tor Makes Anonymity but as he said whoever is in control with the exit node is also in control with the traffic. It means He can Intercept Traffic between the entry node and the client and also between the exit node and the server. which will help him figure out what's happening.