4 ms·

Oxylabs(NordVPN) Fined $7.5M by jury for residential proxy botnet

32 points by paulcarroty 5y ago

shreyshnaccount 5y ago
How do we as a society not understand that vpn companies more often than not harm the user's privacy
- hermes8329 5y ago
  Probably because of how incredibly unimportant it is to the vast majority of people?
- pyuser583 5y ago
  Can you explain this?
paxo 5y ago
"Proxy Diversity (or lack of)" is good article about VPNs and proxy monopolies. https://medium.com/spur-intelligence/proxy-diversity-or-lack-of-5d7047d89a3c https://medium.com/spur-intelligence/proxy-diversity-or-lack...
duskwuff 5y ago
... for all the wrong reasons. They're being fined because they stepped on the toes of another residential proxy botnet (Luminati), not because the court felt there was anything inherently wrong with their behavior.
- tinus_hn 5y ago
  To me it reads like they infringed some software patents.
- bubblethink 5y ago
  What's inherently wrong though ? It's just the internet. Share as much as you want. Make every IP a residential IP. It's more annoying that video websites are segregating IPs than someone is providing a service that randomizes it.
  - bradknowles 5y ago
    This is exactly what I would expect to hear from the kind of people who say they have nothing to hide, and therefore have nothing to fear regarding universal spying on them by their own government. “If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.” -Cardinal Richelieu
  - duskwuff 5y ago
    > What's inherently wrong though ? The problem is that residential proxies are primarily used for abusive purposes, like credit card fraud (e.g. making purchases with a proxy in the same city as the credit card holder) or web forum spam. There are very few legitimate use cases for these services; most of the ones I have heard are either poorly justified (you don't really need a residential IP to test web site performance, for example) or borderline abusive (like content scraping or sneaker botting).
fulafel 5y ago
Editorialized title ("botnet"). Botnets are normally malware controlled by criminals via c&c systems, this is more like a feebler and commercial version of Tor.
- ev1 5y ago
  The end-users hosting the proxies of these are absolutely not aware they are being sold off for malicious traffic.
  - fulafel 5y ago
    I'm sure these commercial proxy services and Tor have more than their fair share of abuse to deal with, but that's still a ways from botnets that are by definition illegitimate, in the malware victim case users don't consciously install them for sharing their internet connection. Oxylabs seems to market their service for web scraping which sounds reasonably legitimate. But it would be interesting to know what these companies do to cut down abuse and results thereof...
    - ev1 5y ago
      Tor operators (and generally commercial proxy services) know what they are doing and opted into it specifically with no real way to deny doing so.\ The people providing the exit points for Oxylabs and Luminati do not know they are acting as exit points, nor would they actually approve of it if they knew what it meant.
      - fulafel 5y ago
        That would obviously be not ok. Oxylabs have a public stance about doing it in above-the-board ways (https://oxylabs.io/blog/standards-for-proxy-acquisition https://oxylabs.io/blog/standards-for-proxy-acquisition) but I guess you're saying this is BS.
        ev1 5y ago
        I know several people that are approached with "load our SDK and make money pay per install on your userbase" type of deals for these residential proxy things. I've been approached myself by unknown (I didn't respond) actors offering to monetise my browser addons with more or less the same. For the actual end user it's definitely not above the board. Public notes: https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_with_1million_installs_and_100k_monthly/eg02u38/ https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_w... https://www.reddit.com/r/androiddev/comments/ajfc7w/question_about_oxylabs/ https://www.reddit.com/r/androiddev/comments/ajfc7w/question... https://dx.doi.org/10.14722/ndss.2021.24008 https://dx.doi.org/10.14722/ndss.2021.24008 I have never seen actual informed consent before in ANY of these for the final end user; most of the targeted apps are general rubbish (think flashlight app requesting location permission and contacts type of BS). At best it would be buried deep in a ToS or EULA somewhere, and even that's fairly rare. Using a very very stretched definition of rewarding users, you could argue that "allowing the use of a calculator for free" is the reward for being an open proxy. If you find any example anywhere by the implementors ("oh, it's the sdk includer's fault they aren't saying anything, we're totally above board...") that there is anything approaching informed consent, I would love to know some examples, because I've never seen one in these. (I would dearly love to be wrong here)
jiggawatts 5y ago
“And now, a word from our sponsor: NordVPN” was always going to turn out like this. Sooner or later they’d try to monetise their customers in a shady way, and all those YouTube videos will look like they were made in partnership with an evil corporation.
- EveYoung 5y ago
  But Oxylabs isn't selling access through their NordVPN customers as residential proxies, are they?
saurik 5y ago
https://news.ycombinator.com/item?id=21664692 https://news.ycombinator.com/item?id=21664692 http://web.archive.org/web/20191128170008/https://medium.com/@derek./how-is-nordvpn-unblocking-disney-6c51045dbc30 http://web.archive.org/web/20191128170008/https://medium.com... > See the problem is, NordVPN is linked closely with a Lithuanian data mining company called Tesonet. NordVPN is said to be one of Tesonet’s projects, Oxylabs.io is another one. > So what’s the big deal? Oxylabs.io advertises on its website “32M+ residential proxies…100% anonymous proxies from all over the globe with zero IP blocking.” Think of “residential proxies” this way: 1.) Oxylabs installs some malware on to a user’s device, unknown to the user, by bundling it with other software that the user downloads. 2.)This malware enables Oxylabs to sell off your bandwidth, your computing power, and your IP address to third parties, who will route their internet traffic through your device.

32 points by paulcarroty 5y ago

shreyshnaccount 5y ago

How do we as a society not understand that vpn companies more often than not harm the user's privacy

hermes8329 5y ago
Probably because of how incredibly unimportant it is to the vast majority of people?
pyuser583 5y ago
Can you explain this?

paxo 5y ago

"Proxy Diversity (or lack of)" is good article about VPNs and proxy monopolies. https://medium.com/spur-intelligence/proxy-diversity-or-lack-of-5d7047d89a3c https://medium.com/spur-intelligence/proxy-diversity-or-lack...

duskwuff 5y ago

... for all the wrong reasons. They're being fined because they stepped on the toes of another residential proxy botnet (Luminati), not because the court felt there was anything inherently wrong with their behavior.

tinus_hn 5y ago
To me it reads like they infringed some software patents.
bubblethink 5y ago
What's inherently wrong though ? It's just the internet. Share as much as you want. Make every IP a residential IP. It's more annoying that video websites are segregating IPs than someone is providing a service that randomizes it.
- bradknowles 5y ago
  This is exactly what I would expect to hear from the kind of people who say they have nothing to hide, and therefore have nothing to fear regarding universal spying on them by their own government. “If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.” -Cardinal Richelieu
- duskwuff 5y ago
  > What's inherently wrong though ? The problem is that residential proxies are primarily used for abusive purposes, like credit card fraud (e.g. making purchases with a proxy in the same city as the credit card holder) or web forum spam. There are very few legitimate use cases for these services; most of the ones I have heard are either poorly justified (you don't really need a residential IP to test web site performance, for example) or borderline abusive (like content scraping or sneaker botting).

fulafel 5y ago

Editorialized title ("botnet"). Botnets are normally malware controlled by criminals via c&c systems, this is more like a feebler and commercial version of Tor.

ev1 5y ago
The end-users hosting the proxies of these are absolutely not aware they are being sold off for malicious traffic.
- fulafel 5y ago
  I'm sure these commercial proxy services and Tor have more than their fair share of abuse to deal with, but that's still a ways from botnets that are by definition illegitimate, in the malware victim case users don't consciously install them for sharing their internet connection. Oxylabs seems to market their service for web scraping which sounds reasonably legitimate. But it would be interesting to know what these companies do to cut down abuse and results thereof...
  - ev1 5y ago
    Tor operators (and generally commercial proxy services) know what they are doing and opted into it specifically with no real way to deny doing so.\ The people providing the exit points for Oxylabs and Luminati do not know they are acting as exit points, nor would they actually approve of it if they knew what it meant.
    - fulafel 5y ago
      That would obviously be not ok. Oxylabs have a public stance about doing it in above-the-board ways (https://oxylabs.io/blog/standards-for-proxy-acquisition https://oxylabs.io/blog/standards-for-proxy-acquisition) but I guess you're saying this is BS.
      - ev1 5y ago
        I know several people that are approached with "load our SDK and make money pay per install on your userbase" type of deals for these residential proxy things. I've been approached myself by unknown (I didn't respond) actors offering to monetise my browser addons with more or less the same. For the actual end user it's definitely not above the board. Public notes: https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_with_1million_installs_and_100k_monthly/eg02u38/ https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_w... https://www.reddit.com/r/androiddev/comments/ajfc7w/question_about_oxylabs/ https://www.reddit.com/r/androiddev/comments/ajfc7w/question... https://dx.doi.org/10.14722/ndss.2021.24008 https://dx.doi.org/10.14722/ndss.2021.24008 I have never seen actual informed consent before in ANY of these for the final end user; most of the targeted apps are general rubbish (think flashlight app requesting location permission and contacts type of BS). At best it would be buried deep in a ToS or EULA somewhere, and even that's fairly rare. Using a very very stretched definition of rewarding users, you could argue that "allowing the use of a calculator for free" is the reward for being an open proxy. If you find any example anywhere by the implementors ("oh, it's the sdk includer's fault they aren't saying anything, we're totally above board...") that there is anything approaching informed consent, I would love to know some examples, because I've never seen one in these. (I would dearly love to be wrong here)

jiggawatts 5y ago

“And now, a word from our sponsor: NordVPN” was always going to turn out like this. Sooner or later they’d try to monetise their customers in a shady way, and all those YouTube videos will look like they were made in partnership with an evil corporation.

EveYoung 5y ago
But Oxylabs isn't selling access through their NordVPN customers as residential proxies, are they?

saurik 5y ago

https://news.ycombinator.com/item?id=21664692 https://news.ycombinator.com/item?id=21664692 http://web.archive.org/web/20191128170008/https://medium.com/@derek./how-is-nordvpn-unblocking-disney-6c51045dbc30 http://web.archive.org/web/20191128170008/https://medium.com... > See the problem is, NordVPN is linked closely with a Lithuanian data mining company called Tesonet. NordVPN is said to be one of Tesonet’s projects, Oxylabs.io is another one. > So what’s the big deal? Oxylabs.io advertises on its website “32M+ residential proxies…100% anonymous proxies from all over the globe with zero IP blocking.” Think of “residential proxies” this way: 1.) Oxylabs installs some malware on to a user’s device, unknown to the user, by bundling it with other software that the user downloads. 2.)This malware enables Oxylabs to sell off your bandwidth, your computing power, and your IP address to third parties, who will route their internet traffic through your device.