So an interesting thought popped into my head as I was thinking over the Cryptowall malware. If you don't already know, Cryptowall utilizes the Tor service to make the back-end service it uses untraceable.
While thinking over this, I thought of one of the few attacks Tor is susceptible to, the Man in the Middle attack. This got me thinking what if you could rig the jumps to where you have control of the exit node?
So, Tor has a public list of nodes stating what nodes are available for a client to route through and which are exit nodes. So let's say I spoof my default DNS/IP to redirect to to my own list of nodes within my own network (As Tor is open sourced one could reverse engineer the request format).
Make a few assumptions here such as, There is only one node configured as an exit, and only the exit node has internet access. (Just to make the spoofing easier)
My question is, could one, using a similar method as above,essentially redirect and control Tor traffic from an UNMODIFIED Tor Client in a network by providing spoofed nodes, and then perform a Man in the Middle attack on the exit node, and monitor the traffic of say the Tor Browser or something else sending data over Tor?
NOTE: If I got something wrong, an you feel tempted to push that pretty little red down-vote button, at the very least add something to the comments about why you did so. I would appreciate it.