What prevents a node from sending a different version of the blockchain?

Question

I understand that proof of work prevents a node from creating a new version of the blockchain unless they have >50% of the hash rate, but what if the attacker is also able to intercept the victim's internet traffic?

In that case, it would be able to mine a few blocks (or if that's too difficult, start a new blockchain from the genesis block) and then replace traffic to any node on the network with traffic to their fake node with a different version of the blockchain. The victim would then not know that a longer chain exists, so would believe the attacker.

What prevents someone from doing this?

Answer 1

In the scenario you describe, in which the only peers a bitcoin core node can connect to are owned by an attacker or colluding attackers, there is a minimum-chain-work-required for the block headers, so the client will not accept a chain which has a total amount of work less than the amount hardcoded into it here. There may be more forms of protection too, my knowledge is incomplete, but that at least provide a lot against such a situation. The node performs headers-first-sync which means it will know what the work of the chain is before it spends a lot more bandwidth and processing power validating the blocks themselves.