3 ms·

The end-users hosting the proxies of these are absolutely not aware they are being sold off for malicious traffic.

by ev1 5y ago

fulafel 5y ago
I'm sure these commercial proxy services and Tor have more than their fair share of abuse to deal with, but that's still a ways from botnets that are by definition illegitimate, in the malware victim case users don't consciously install them for sharing their internet connection. Oxylabs seems to market their service for web scraping which sounds reasonably legitimate. But it would be interesting to know what these companies do to cut down abuse and results thereof...
- ev1 5y ago
  Tor operators (and generally commercial proxy services) know what they are doing and opted into it specifically with no real way to deny doing so.\ The people providing the exit points for Oxylabs and Luminati do not know they are acting as exit points, nor would they actually approve of it if they knew what it meant.
  - fulafel 5y ago
    That would obviously be not ok. Oxylabs have a public stance about doing it in above-the-board ways (https://oxylabs.io/blog/standards-for-proxy-acquisition https://oxylabs.io/blog/standards-for-proxy-acquisition) but I guess you're saying this is BS.
    - ev1 5y ago
      I know several people that are approached with "load our SDK and make money pay per install on your userbase" type of deals for these residential proxy things. I've been approached myself by unknown (I didn't respond) actors offering to monetise my browser addons with more or less the same. For the actual end user it's definitely not above the board. Public notes: https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_with_1million_installs_and_100k_monthly/eg02u38/ https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_w... https://www.reddit.com/r/androiddev/comments/ajfc7w/question_about_oxylabs/ https://www.reddit.com/r/androiddev/comments/ajfc7w/question... https://dx.doi.org/10.14722/ndss.2021.24008 https://dx.doi.org/10.14722/ndss.2021.24008 I have never seen actual informed consent before in ANY of these for the final end user; most of the targeted apps are general rubbish (think flashlight app requesting location permission and contacts type of BS). At best it would be buried deep in a ToS or EULA somewhere, and even that's fairly rare. Using a very very stretched definition of rewarding users, you could argue that "allowing the use of a calculator for free" is the reward for being an open proxy. If you find any example anywhere by the implementors ("oh, it's the sdk includer's fault they aren't saying anything, we're totally above board...") that there is anything approaching informed consent, I would love to know some examples, because I've never seen one in these. (I would dearly love to be wrong here)
      - fulafel 5y ago
        Ok, thanks for the information, I guess that would make it like a botnet. There's still a remote possibility that they have changed their behaviour, since their post about end-user awareness and monetary compensation is somewhat newer than your references, but at this point I would need some independent third party vetting about that to convince me.

The end-users hosting the proxies of these are absolutely not aware they are being sold off for malicious traffic.

by ev1 5y ago

The end-users hosting the proxies of these are absolutely not aware they are being sold off for malicious traffic.

I'm sure these commercial proxy services and Tor have more than their fair share of abuse to deal with, but that's still a ways from botnets that are by definition illegitimate, in the malware victim case users don't consciously install them for sharing their internet connection. Oxylabs seems to market their service for web scraping which sounds reasonably legitimate. But it would be interesting to know what these companies do to cut down abuse and results thereof...

ev1 5y ago
Tor operators (and generally commercial proxy services) know what they are doing and opted into it specifically with no real way to deny doing so.\ The people providing the exit points for Oxylabs and Luminati do not know they are acting as exit points, nor would they actually approve of it if they knew what it meant.
- fulafel 5y ago
  That would obviously be not ok. Oxylabs have a public stance about doing it in above-the-board ways (https://oxylabs.io/blog/standards-for-proxy-acquisition https://oxylabs.io/blog/standards-for-proxy-acquisition) but I guess you're saying this is BS.
  - ev1 5y ago
    I know several people that are approached with "load our SDK and make money pay per install on your userbase" type of deals for these residential proxy things. I've been approached myself by unknown (I didn't respond) actors offering to monetise my browser addons with more or less the same. For the actual end user it's definitely not above the board. Public notes: https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_with_1million_installs_and_100k_monthly/eg02u38/ https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_w... https://www.reddit.com/r/androiddev/comments/ajfc7w/question_about_oxylabs/ https://www.reddit.com/r/androiddev/comments/ajfc7w/question... https://dx.doi.org/10.14722/ndss.2021.24008 https://dx.doi.org/10.14722/ndss.2021.24008 I have never seen actual informed consent before in ANY of these for the final end user; most of the targeted apps are general rubbish (think flashlight app requesting location permission and contacts type of BS). At best it would be buried deep in a ToS or EULA somewhere, and even that's fairly rare. Using a very very stretched definition of rewarding users, you could argue that "allowing the use of a calculator for free" is the reward for being an open proxy. If you find any example anywhere by the implementors ("oh, it's the sdk includer's fault they aren't saying anything, we're totally above board...") that there is anything approaching informed consent, I would love to know some examples, because I've never seen one in these. (I would dearly love to be wrong here)
    - fulafel 5y ago
      Ok, thanks for the information, I guess that would make it like a botnet. There's still a remote possibility that they have changed their behaviour, since their post about end-user awareness and monetary compensation is somewhat newer than your references, but at this point I would need some independent third party vetting about that to convince me.