If It Wanted, Google Could Deanonymize a Large Number of Tor Connections
A team of scientists has come up with a new attack method that in the hands of certain adversaries can be used to deanonymize Tor traffic by monitoring the traffic that goes into a Tor relay and the HTTP and DNS traffic that comes out of a Tor exit node.
Called DefecTor, this new attack is an improved version of what security and privacy experts call a "Tor correlation attack."
Tor correlation attacks have been studied and detailed in the past. In a nutshell, these types of attacks imply that a global adversary in the position to monitor large pieces of Internet traffic can see when a user starts a Tor connection and using various clues tie his inbound connection to an outbound packet stream. The adversary can guess with various degrees of accuracy the website a user is accessing via Tor.
