Is there a reasonable chance of a well-funded agent obtaining raw traffic over Tor circuits

Question

If an agent has a few middle Tor relays (Am) and a few exit Tor relays (Ae), could they obtain the original traffic of some of the circuits with a reasonable probability?

Let's assume, without too much loss of generality, that Tor only uses middle-middle-exit circuits and that there are M middle relays and E exit relays.

The probability of such a circuit consisting only of nodes this agent controls then is:

P = Am/M * (Am - 1)/(M - 1) * Ae/E

According to Tor Metrics, there are just short of 7000 relays in total, with almost 2000 being exit relays. I will round these figures up into 7000 - 2000 = 5000 middle relays and 2000 exit relays.

Assuming the attacker owns 10 middle relays and 10 exit relays, the probability of them getting to control the whole circuit is

P = 10/5000 * 9/4999 * 10/2000 ~= 1.8e-8

which is very low. However, once you factor in the enormous amount of Tor circuits being established (could not find a reliable figure anywhere, will gladly edit one in if someone has it), wouldn't this agent be able to consistently get complete circuits through their relays and, as a consequence, have complete access to the data it was relaying?

I understand that some of the data through the circuits would also be using TLS, but at least some of it should be plaintext.

It may also be worth pointing out that if this is a really well-funded agent, they might have substantially more than 20 relays at their disposal.

Answer 1

«Since January 2020, a mysterious threat actor has been adding servers to the Tor network (...) by May 2020, they ran a quarter of all Tor exit relays» (ZDNet)

SecurityWeek clarifies the number as 380 exit nodes. See also the full Nusenu post

Note that this attacker was probably only interested in positioning exit nodes.

So yes, a well-funded agent would be able to control substantially more than 20 relays.

wouldn't this agent be able to consistently get complete circuits through their relays and, as a consequence, have complete access to the data it was relaying?

Not really a consequence. Data is encrypted to the target nodes. If you are using a plaintext protocol (like HTTP), the exit node knows the full contents of the communication. The agent only needs to be chosen as an exit node, and the previous ones are irrelevant.

If the target was a hidden service, or even just a https website, the exit node won't know the contents of the communication (it would know which https server you are communicating with, and the traffic flow, but not what was transmitted).

The point on controlling a full circuit is about deanonymizing users, in order to know not only what was sent but also the origin ip address (which might then be tracked to its physical location and the person behind that)

As for the number of circuits being established, you may be right, but the calculation won't be as simple. The tor client doesn't pick nodes at random. Most importantly, the EntryGuards will try to stick to connecting to the same nodes so that, you won't be at the mercy of many different entry node operators, only a few of them. If you were lucky picking them (they are honest), you'd be safe. See the EntryGuards FAQ