In Tor, what stops the end server from following the breadcrumbs back to their origin?

Question

This would probably require knocking on people's doors, but — couldn't the endpoint ask the exit node what the relay node was, and then ask the relay node what the entry node was, and then ask the entry node what the origin was?

Is it just not logged long enough for the NSA etc. to show up at the Tor nodes' doors?

I am looking at these diagrams...

• https://www.eff.org/pages/tor-and-https
• https://www.torproject.org/about/overview.html.en#thesolution

...and trying to read the original paper, but not understanding much.

Answer 1

As others have pointed out, "knocking on people's doors" can be difficult when the said doors are spread over the World, in locations which are geographically remote and, more importantly, legally remote. If all the Tor nodes are under in scope of a single law enforcement agency (e.g. they are all in China, or all in the USA), then that agency may indeed knock on all doors and have them opened. In an international context, this becomes harder.

Further complicating the issue is that "honest" Tor nodes (those who follow the protocol faithfully) do not keep logs, so even if they want to comply to a demand for information on a past connection, they simply do not have it any more.

Breadcrumb following is not the only way to unravel Tor, though. As the metaphor goes, if Hop-o'-My-Thumb had been smarter, he would not have brought bread, but a compass. In the case of Tor, information can be obtained by correlation in time and size. When a Tor connection occurs, the data goes through a randomly chosen sequence of nodes; as the theory goes, as long as one of these nodes is honest, the original client cannot be traced back. Or can he ?

If the evil attacker runs several nodes (and I expect big agencies to actually run a lot of Tor nodes, if only to remain "in the loop"), then it may happen that both the entry node and the exit node are attacker-controlled. These two nodes can then notice the case when a data packet entered the entry node, and a packet of the same size exited the exit node a few milliseconds afterwards. A normal connection entails several successive packets back and forth, further strengthening the correlation. The exit node can see the packet contents (and, at least, their final destination), while the entry node knows the client's identity (well, at least its IP address). That's all that is needed to destroy anonymity -- and that attack works regardless of the honesty of the nodes in between, in flagrant contradiction with the overoptimistic theory alluded-to above.

("One honest node is sufficient" is the theoretical framework for Mix networks as used in electronic voting protocols -- but that works only in the context of voting, where a node can accumulate all packets and send them en masse at the end.)

Answer 2

Imagine you pick the following route:

UK --> China --> US -->  Russia --> Netherlands --> end-point

Now if you want to follow the bread crumbs you would need to either get access to the relay nodes by asking them (to which no exit node will answer) or you would need to get a court order to get access to the relay node.

Now let's say that these guys would even keep some type of log, you would first need to notify the Dutch police. Then this goes to Russia, who's not best friends with the Netherlands so this means it might take some time. The russians find out that it went to the US, but they don't really like the US so it might take some time... and so on and so on.

The idea is that if you want a good route using tor, go through countries who hate eachothers guts. It's going to make it more expensive for law enforcement to catch, even if they get past all diplomatic barriers.

Another way of breadcrumbs, would be to inspect the packets at the exit node. Have a look at this blog post I wrote a year or so ago about analyzing Tor traffic to find out people's identity.

Answer 3

Yes, it is possible, but as @LucasKauffman pointed out you will have more than one problem. So the reasons that prevent following the breadcrumbs are:

1. A Tor implementation that does not keep logs.
2. Changing geographical problems, it will be very hard (if not impossible) to have a team in the correct Tor node in the exact time.
3. Legal issues. International collaboration is very hard due to the long timing responses and the lack of agreements.

But even with these problems, there are some attacks that may compromise the IP of the Tor user like:

1. One of the biggest vulnerabilities spotted against the Tor protocol is the " "traffic correlation attack" (read it here).
2. An organization adding tons of Tor nodes so they find chances to own the full circuit.

Tor is not the "panacea", it has its problems, but it is the best option out there and it has the feature of improve the privacy when the users growth.

And above it all, it requires organizations or governments to collaborate in a way they are not willing to to compromise the Tor network.

Also, consider visiting the Tor Stack Exchange.