> Precisely how the BND plans to „chop“ Tor is unfortunately redacted in the document we obtained. But as before, the spy agency refers to public research. To implement the attack, it is likely that the spies runs their own servers in the Tor network. M.S. points to passive snooping servers, which are presumably operated by the NSA, and emphasizes the „protection of the anonymity“ of the spy agencies.
And indeed, there are no specifics.
Tor Project acknowledges that Tor is vulnerable to global adversaries. With enough intercepts, they can correlate traffic at various relays, and connected users and servers. There's nothing magic about onion services. It's just that there are seven relays between users and servers, rather than just the normal three for Tor.
But hey, it provides better anonymity than any alternative. Other than meeting in remote locations, anyway. And you can add VPNs to the mix. I always use Tor through nested VPN chains. That adds misdirection. But perhaps most importantly, it adds latency and jitter, which mitigate traffic correlation attacks.
Edit: As a fun science project, you can play with traffic correlation between you and your private onion service. You use unlisted private bridges as entry guards, both locally and for the onion service. So it's only your traffic that gets analyzed. And you don't need sophisticated software. Wireshark and a spreadsheet are enough. So you have packet captures from your local machine, and from the VPS running the onion service. Using Wireshark, you export bitrate in millisecond bins. Then in the spreadsheet, you have two columns, one with each bitrate series. Just create a third column for the product. Each sheet will hold 1E6 lines, or 1000 seconds. Excel works best, because it uses multiple cores. R would be better, because you could crunch segments in parallel.