There 4626 relays online. What is stopping a single entity from adding, say, 9000 relays to the network around the world so they can occasionally watch bits of the network? If the cost of this is unimaginable then what about a single entity operating a botnet?
Has anybody calculated the ratio of 'real' nodes to 'fbi' nodes in such a scenario before it became a genuine problem?
('How vulnerable' is a bit tricky, as there is no unit or scale.)
Assuming that the Bad Guy can see all internet traffic, owning relays does not help much for timing correlation attacks. You're always vulnerable to those, no matter who owns which relays or how many. (Generally, more relays and more traffic make it easier to hide.)
Besides timing, which is a bit fuzzy and becomes harder with more traffic, the only real way to know which incoming traffic belongs to which outgoing traffic is to own the relay. Each relay in a circuit knows who is the previous and the next relay; where packets come from and where they go to. Only the exit node can see the actual traffic.
Client --> Guard -> Middle -> Exit --> Destination
The Bad Guy would have to own the entire circuit, Guard, Middle, and Exit, in order to see and follow the traffic from the Client to the Destination.
Finally, if the Bad Guy owns a bunch of relays, they can still not target anyone specifically. They have to sit and wait and hope that someone happens to create a circuit using only their relays. The probability would be something like (( bad / ( good + bad )) ^ 3 ) except there are other factors at play, like conditions to become a guard and client guard rotation.
I agree with @Jobiwan. The bad guys would have to wait for the unlucky tor user to create a circuit with all of their nodes and only their nodes, the odds of which happening due to the number of nodes available is extremely unlikely.
Though I do think that I read somewhere if they controlled an exit node they could (provided they had govt. level resources) see what is going on. Though don't quote me on that.
