Could TOR nodes collect IPs and filter them to unmask .onion url IP addresses?

Question

I feel that I generally understand TOR onion routing. From what I understand, the node knows the IP it is receiving data from and the IP it is sending data to. So surely a node can collect the IP addresses and filter out any other node IP addresses (publicly available) and then collect the rest. IP addresses that come up frequently could be accessed and regular TLDs like google could be excluded. If they aren't then it is more than likely that they are one of the popular .onion IP addresses.

Obviously this isn't hugely compromising since you don't know which .onion address it is but maybe more could be done once you have these addresses. Obviously it requires a node with a lot of traffic through it too but is it possible in theory?

Is this a reasonable assumption of the routing model? If not where did I go wrong?

Answer 1

You're talking about attacks by an adversary with a partial view of the network; which is possible, but you actually have to suspect your client and server ahead of time, and in practical terms you have to have control and visibility over a huge amount of network space.

The Tor FAQ may be a good place to have a look, but essentially the attack is possible given:

A bad first of three servers can see encrypted Tor traffic coming from your computer. It still doesn't know who you are and what you are doing over Tor.

and

A bad third of three servers can see the traffic you sent into Tor. It won't know who sent this traffic.

Someone would have to control at least three servers to make the match, and in practice would have to control many, many more as there's no way of determining which three servers any given connection is going to use in a network circuit.

Now scale this up; you want to just identify popular .onion sites, but you're seeing traffic coming in from IPs and out to IPs. You have no idea, none, which traffic is 'response' traffic, and which is 'request' traffic, you have no idea if those IPs are simply relays that happen to be chosen a few times - it's very possible in this scenario that you never see the IP of any popular .onion sites. Additionally, Tor circuits are built to resist this sort of attack.

Specifically if you're watching all traffic in and out, and you identify 1.2.3.4 as being popular - you don't know if that's an endpoint, or a router, a server/client uploading or downloading something. All you know is that it's Tor traffic. Tor is set up so that that's not really interesting information - the fact that you're running Tor isn't a secret (and as you noted, they publish the list of exit nodes - though that's not every node in the system, only the exits).

It's a bit different if you already have some suspects, timing attacks can work in this case - but at the end of the day, you can likely only show that two machines are communicating, not what they're communicating about, and you don't definitively know they're not just a router in the transaction.

Finally, if the service you're trying to identify is a Hidden Service all bets are likely off - they're designed to distribute the sort of traffic you're looking for on one link by deliberately adding a number of pre-trusted routers into the equation, which would negate any knowledge you had of the network.