As I understand it, running sybil BTC nodes through an anonymous network like TOR is much less expensive than in clearnet. This makes it possible that one could be connected to a majority of nodes controlled by the same entity, right?
Is there any way to limit exposure to this when connection through TOR?
( I am asking for a friend :P )
Low-latency transmissions over Tor can be defeated with a timing attack if you're connected to several of the attacker's nodes and the attacker is watching your transmissions at your ISP.
The attacker can relay only blocks that he/she creates, putting you on a Bitcoin fork (separate from the main chain). After that you would be open to double-spending attacks.
Monitor the network hash rates closely. If they are unusually low then you should be careful you are not an a fork created by a sybil attacker, targeting Tor users.
https://en.bitcoin.it/wiki/Weaknesses#Sybil_attack
Potential deonimation of metadata is probably a larger threat than a sybil attack if you are waiting for multiple confirmations and monitoring network hash rates
http://arxiv.org/pdf/1410.6079.pdf
"Consider the following case. A client uses the same computer for sending both benign Bitcoin transactions and sensitive transaction. For benign transactions the user connects to Bitcoin directly, but for sensitive transactions he forwards his traffic through a chain of Tor relays or VPNs. If an attacker implements the attack described in section III, all client’s sensitive transactions with high probability will go through attacker’s controlled nodes which will allow her to fingerprint the user and record his transactions. When the client later connects to the Bitcoin network directly to send benign transactions, he will with some probability choose an entry node controlled by the attacker (in section V we show how to increase this probability). Once it happens, the attacker can query the client for the fingerprint and thus correlate his sensitive transactions with his IP address. Note that even if the attacker is not implementing the complete man-in-the-middle attack on Tor, but just injects Sybil peers and Sybil hidden services he will be able to link many sensitive transactions to the real IP addresses of the users."
The risk here can be limited by never accessing Bitcoin over Tor and clearnet from the same computer. Accessing Tor via a virtual machine over public WIFI can also help reduce your risk of being deanonymized.
