(Image source from: Cnbctv18.com)
Google Threat Intelligence Group and its collaborators revealed last week that they have disrupted one of the largest proxy networks worldwide. The tech company based in Mountain View announced it successfully shut down IPIDEA, a well-known proxy network that had been operating secretly for a long time. They stated that this residential proxy network covertly transformed Android devices and Windows computers into proxies for malicious users, enabling them to send traffic through ordinary home networks to hide the source of harmful activities. In a blog post, the tech company shared information about the dismantling of the IPIDEA proxy network. For those who may not know, a residential proxy network is an unauthorized and unethical service that directs Internet traffic through devices to hide the actual source of any actions. Rather than using commercial servers, these networks exploit compromised home devices to make it seem like connections are coming from authentic residential IP addresses.
Attackers frequently use residential proxy networks to hide their harmful activities, which include credential stuffing, content scraping, account takeovers, and other fraudulent practices. Since the traffic seems to come from standard home or mobile IP addresses, it becomes more challenging for security systems to tell apart legitimate users from illegitimate traffic. Google mentioned that, along with its partners, they pinpointed the network, which utilized various methods to avoid detection, such as running hidden services on devices and concealing command and control channels. The blog post emphasized that this operation spread through a collection of harmful Android applications and proxy software on Windows computers. The apps were shared outside official app stores and through third-party websites, including features that enabled them to keep running in the background while still transmitting traffic. Google indicated that the proxy function of the malware often went unnoticed by users, as in many situations, the network operated without significantly impacting battery life or data usage that might have alerted device owners.
To break down the network structure, GTIG and their partners pinpointed the command and control servers that ran this network and took actions to disrupt their operations. This involved collaborating with infrastructure providers and domain registrars to close down domains and servers utilized to send commands to compromised devices and to receive and relay proxy traffic. Google also stated it improved its detection signals so that any future attempts to establish similar networks using the same methods could be recognized more promptly. “We encourage mobile platforms, ISPs, and other technology platforms to keep sharing information and adopting best practices to identify illegal proxy networks and reduce their negative impacts,” noted the tech company.
