Cybercriminals Are Hiding Malicious Web Traffic in Plain Sight (wired.com) 34
Cybercriminals have been increasingly turning to "residential proxy" services over the past two to three years to disguise malicious web traffic as everyday online activity, according to research presented at the Sleuthcon cybercrime conference. The shift represents a response to law enforcement's growing success in targeting traditional "bulletproof" hosting services, which previously allowed criminals to maintain anonymous web infrastructure.
Residential proxies route traffic through decentralized networks running on consumer devices like old Android phones and low-end laptops, providing real IP addresses assigned to homes and offices. This approach makes malicious activity extremely difficult to detect because it appears to originate from trusted consumer locations rather than suspicious server farms. The technology creates particular challenges when attackers appear to come from the same residential IP ranges as employees of target organizations.
Residential proxies route traffic through decentralized networks running on consumer devices like old Android phones and low-end laptops, providing real IP addresses assigned to homes and offices. This approach makes malicious activity extremely difficult to detect because it appears to originate from trusted consumer locations rather than suspicious server farms. The technology creates particular challenges when attackers appear to come from the same residential IP ranges as employees of target organizations.
FUD (Score:5, Insightful)
Re: FUD (Score:3, Informative)
Re: (Score:2)
Let's be real: to trumpers, all immigrants are bad. Trump himself has said so.
Re: FUD (Score:1)
Let's be real, libs are clueless
Re: (Score:2)
Found the red hat with no empathy
Re: (Score:2)
Re: (Score:2)
You do realize you are promoting fascism, right? And that you are complicit as a result.
Re: (Score:2)
Re: (Score:2)
And at the same time, there are non-whites that proudly voted for this crap. Human stupidity is really unlimited.
Re: (Score:1)
Re: (Score:3)
I confess, AC, I don't even know who voted their comment up.
I did note the 'increasingly' bit in the summary. That's because, as you know, this isn't new. Malicious actors have been doing this for a long time. They use these IPs for things like spamming, DDoS attacks, hiding traditional hacking at scale, and things like that.
They're just doing this more often because finding reliable hosts to provide them with compromised addresses. Then again, those hosts were already using hacked residential IP addresses.
Re: (Score:2)
And, yes, it's more difficult these days. I've been trying to find a reputable company (at a reasonable price) to just do a simple DDoS for me.
No, not for anything illegal. I just want to test some of my own infrastructure. It has gone through a DDoS attack a couple of times and has been just fine. But, those were short-lived (under an hour) and not very impressive as far as the numbers go. I'd like to find the breaking point so that I can work on that.
I think you are lying. A localized simulated DDoS is not hard to do and as good as the real thing. Any competent pen-testing outfit should be capable and willing.
Re: (Score:2)
It's not local, but a pair of leased servers. It's nothing huge, or anything like that.
I've yet to find anyone with a reasonable price. I note that you did not include a link to anyone with a reasonable price for this.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Indeed. The usual crap the surveillance-fascists want. To the benefit of absolutely nobody except themselves.
Re: (Score:2)
Indeed. The problem is insecure systems. In any other engineering discipline that gets resolved with liability and minimal standards and, if needed, people going to prison. (No, that will _not_ kill FOSS. That is just a lie.) IT just has not had its really big catastrophes yet, or rather so far they were too abstract. But the way Microsoft (and others) are going, it is just a question of time.
Re: (Score:2)
Indeed. The whole story is essentially nonsense. If anything, they should call for better system security. But then they would have to criticize Microsoft for its abysmally shoddy practices and pathetic security. And that cannot be.
:Look up webscraping... (Score:2)
Refer:
- Reddit - r:/webscraping
- https://www.reddit.com/r/websc... [reddit.com]
- What are my options for proxies for webscraping?
From 3 years ago....
- Discussion of how to spread a web scraper load out on a larger set of IP addresses
> 1. install tor
> 2. start tor
> 3. use tor as proxy on localhost at port 9150
> https://tor.stackexchange.com/... [stackexchange.com]
Can be Summarized in 3 Words (Score:2)
Steganography (Score:2)
The ways data can be hidden in plain site are virtually limitless. Obvious ones are using the least significant bit in WAV data, putting space and tab whitespace on the end of lines in plain text etc. The only limitation is the imagination of people who need to do it.
Is it? (Score:2)
The shift represents a response to law enforcement's growing success in targeting traditional "bulletproof" hosting services
Is that actually a response to law enforcement's growing success or have they simply found that using a bunch of hacked devices that companies have abandoned is a better option?
“The issue is, you cannot technically distinguish which traffic in a node is bad and which traffic is good,”
“That's the magic of a proxy service—you cannot tell who’s who. It's good in terms of internet freedom, but it's super, super tough to analyze what’s happening and identify bad activity.”
“I don’t know yet how we can improve the proxy issue,”
To me, it seems like it has the distinct advantage of being better suited of the purpose and addition to being beyond anyone's reach. Law enforcement may not even be a real consideration here.
Re: (Score:2)
Most are hacked servers. Do you run a webserver? Let it log when someone tries to use it as a proxy. There are A LOT of bots that try that. Have a look where the spam comes from. Almost all comes from addresses like info@webshop-foo, which are obviously just accounts on legitimate servers that were hacked because someone had a weak password. The internet is full of bots that do nothing but test if someone uses a weak password to either start spamming from their mail address, use their open proxy, or install
Re: (Score:2)
Indeed. Crappy systems with crappy system administration. It is time that businesses become liable.
Re: (Score:2)
Too many gray areas.
Do you have a good proof that's my server who sent the spam? Am I liable or my hoster? What about hosted mail? What about hosted homepage+mail (as secondary service), what about vservers, what about dedicated servers? Am I accountable for my weak e-mail password, or only for my weak root password? What if the password was good, but the password reset mechanism relied on stupid "What was your first dogs name" questions?
All of that doesn't matter too much when you sent the hoster an e-mail
Re: (Score:2)
Bullshit. You are probably part of the problem and just do not want to be forced to do good work.
Re: (Score:2)
Ad hominem. Bye.
News flash, subtext (Score:2)
Wited discovers VPNs and Tor routing.
Subtext: only 'cybercriminals' (child molesters!) use them.
Re: (Score:3)
AI scrapers use these residential proxies. It's not (just) VPNs and Tor routing. Several bottom-feeding companies openly advertise such scraping services, for pretty much any country you may want [scraperapi.com]. I administer a wiki that's been on the receiving end of such scraping, and the majority of these scraping requests are in fact coming from residential IP-addresses rather than data centers.
I don't know whether these are hacked accounts, people getting tricked or paid to run these scraping apps on their devices, bu
Is it 1999? (Score:2)