Why would Tor not be vulnerable to this easy-sounding attack?

Question

I'm thinking of this attack on Tor, which I'm sure won't work, as it is much too simple.

Mr. Blackhat sets up lots of intermediate nodes. However, whenever TCP connections come in, they are given very poor service. Connections are purposefully dropped, interrupted, resetted, sent into delay pools, etc. Mr. Blackhat also advertises a very large bandwidth to the Tor central directory to lure circuits into using his bad nodes.

Although this won't compromise security, why wouldn't this break Tor's reliability completely? I could easily imagine an adversary to Tor itself (Chinese censors for example) setting up purposefully breaking nodes, so people's data connections are broken, Tor becomes unusable, etc.

How does Tor avoid this?

Answer 1

GCHQ / the NSA considered this to be a viable approach to attacking Tor in 2012, see slide 22 of their Tor Stinks presentation, where they discuss creating lots of slow nodes advertised as high bandwidth. (Slide 19 is related, but focuses on compromised networks and end servers.)

The end goal of course, is to force your target off the Tor network onto a less secure network.

Answer 2

The whole Tor model relies on a mass effect. Tor ensures privacy (to some extent) and confidentiality of connections only as long as there are not "too many" rogue nodes. In the mix network theory, when you use a chain of Tor nodes, your privacy is maintained as long as one node is honest. In fact, because encryption leaks data length and because the user wants a low latency, traffic analysis works well against Tor, so Tor breaks down once the ratio of bad-to-good nodes exceeds a rather small proportion, say 10% or 20% (this value is a complete guesstimate of mine).

The same can be said about reliability. The Internet is, on the whole, resilient to bad links (after all, it was initially designed to resist nuclear attacks), but punch sufficiently many holes in it and it will break down. Tor is like an Internet reduced to the Tor nodes: take down sufficiently many, and the network ceases to work properly.

The two things which prevent various governmental agencies (from various governments) from destroying Tor that way are the following:

• Such disruption lasts only as long as the "bad" nodes remain active and act badly. Thus, this is a continuous expense. Government budgets being what they are, agencies don't like solutions which imply spending with no foreseeable end.

• Disruption is an active attack, thus subject to exposure. Spy agencies abhor risks of exposure. Being caught in the act is the worst sin of a spy. So this disruption plan looks not to be worth the effort: disruption of Tor is not an attractive enough goal to be pursued relentlessly, if the cost is being exposed as people who want to disrupt Tor.

In fact, from the point of view of an agency, it is probably much better to keep Tor running and have some nodes which follow the protocol faithfully: at least it allows for traffic analysis and, in particular, building a list of people who use Tor (since Tor implies extra latency, thus degrades user experience, most people who "do not have anything to hide" will simply not use Tor, which kinda defeats the whole concept).