Google Disrupts Massive Proxy Network That Hijacked Millions of Smartphones, PCs for Cyberattacks

Google Threat Intelligence Group (GTIG) and its partners announced the disruption of one of the world's largest proxy networks last week. The Mountain View-based tech giant said that it was able to successfully take down IPIDEA, one of the most notorious proxy networks that has been operating in the shadows for quite some time. The company said the residential proxy network secretly turned Android devices and Windows PCs into Internet proxies for bad actors, allowing them to route traffic via their home networks to mask the origin of malicious activity.

GTIG Takes Down Massive Proxy Network

In a blog post, the tech giant announced and detailed the disruption of the IPIDEA proxy network. For the unaware, a residential proxy network is an unauthorised and unethical service that routes Internet traffic through devices to disguise the true source of any activity. Instead of relying on commercial servers, these networks leverage compromised consumer devices to make connections appear to come from legitimate residential IP addresses.

Residential proxy networks are often used by attackers to mask malicious behaviour such as credential stuffing, content scraping, account takeovers and other forms of fraud. Because the traffic appears to come from everyday home or mobile IP addresses, it can be harder for security systems to distinguish legitimate users from illegitimate traffic. Google said it, along with its partners, identified the network, which used a variety of techniques to evade detection, including running hidden services on devices and obscuring command and control channels.

How residential proxy networks operate
Photo Credit: Google

The blog post highlighted that the operation spread through a collection of malicious Android apps and proxy software on Windows PCs. The apps were distributed outside of official app stores as well as through third-party platforms, and included mechanisms to persist in the background while continuing to relay traffic. Google said that the malware's proxy functionality was often invisible to users, and in many cases the network ran without any obvious drain on battery life or data usage that might have alerted device owners.

To dismantle the infrastructure, GTIG and partners identified the command and control servers that managed the network and took steps to disrupt their operation. This included working with infrastructure providers and domain registrars to shut down domains and servers used to issue commands to compromised devices and to receive and forward proxy traffic. Google also said it updated its detection signals so that future attempts to set up similar networks using the same tools and techniques can be identified more quickly.

“We encourage mobile platforms, ISPs, and other tech platforms to continue sharing intelligence and implementing best practices to identify illicit proxy networks and limit their harms,” the tech giant said.