In the episode 1x01 of Mr. Robot, Elliot confronts the owner of Ron's Coffee. He basically states that the man is hosting illegal (child pornography) content served in the form of a website that the customers of his coffee shops can access from the shops' Internet connections. Elliot also briefly describes the owner's use of “Tor networking to keep the servers anonymous”. So, the details are not known, but we can imagine that the guy set his website up as a hidden service.
What bugs me is the moment when Elliot states that he could trace traffic between the coffee shop and the illegal servers, saying: “Whoever is in control of the exit nodes is also in control of the traffic, which makes me the one in control”, implying that he runs one or more Tor exit nodes himself, and that he managed to do either or both of those 2 things:
- somehow “forcing” the traffic from the coffee shop to go through the exit node(s) he runs;
- monitoring packets going through the exit node(s) he runs and tracing them back to their original senders.
Either of those is impossible if I get Tor's innards correctly.
I mean, as far as my understanding of Tor goes, it's not possible to trace a user from the exit node back to his/her origin address, and that's precisely the point of onion routing. The only origin address you can get at the exit node is the address of the direct previous node in the chain. So even if you control an exit node, you can't tell who the incoming packets really belong to. You'd have to control a pretty heavy bunch of nodes for the routing of a user to hypothetically pass only through your nodes from entry to exit. That wouldn't even be as simple as that, because the selection and order of the nodes in the chain are random, aren't they? So you'd have to own a really big number of nodes in order to get only a very, very slim chance to trace a user from A to B.
So, is Elliot's hack really technically feasible the way he says he did it? Couldn't it be some kind of counter-propaganda to undermine Tor and its efficiency (especially given that anti-Tor proponents' main argument is that Tor can be used to cover up criminal activities)? Or maybe this is just some kind of simplification for dramatization's sake (which would be a little lame, even though I guess most of the show's viewers are not tech-savvy)? Or maybe I'm missing something about Tor's general flow of operation?