Resident Evil: Understanding Residential IP Proxy as a Dark Service

Mi, Xianghang; Feng, Xuan; Liao, Xiaojing; Liu, Baojun; Wang, Xiaofeng; Qian, Feng; Zhou, Li; Alrwais, Sumayah; Sun, Limin; Liu, Ying

doi:10.1109/sp.2019.00011

Cited by 38 publications

(41 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Some services can also detect the use of VPNs, adding information to enable tracking, and even block them, such as Netflix who attempts to geo-lock their content. Finally, users must also trust the VPN service since they are ideally positioned for snooping the users' activities, as has been shown in existing work [21].…”

Section: Discussionmentioning

confidence: 99%

Don’t Count Me Out: On the Relevance of IP Address in the Tracking Ecosystem

Mishra

Laperdrix²,

Vastel

et al. 2020

Proceedings of the Web Conference 2020

View full text Add to dashboard Cite

Targeted online advertising has become an inextricable part of the way Web content and applications are monetized. At the beginning, online advertising consisted of simple ad-banners broadly shown to website visitors. Over time, it evolved into a complex ecosystem that tracks and collects a wealth of data to learn user habits and show targeted and personalized ads. To protect users against tracking, several countermeasures have been proposed, ranging from browser extensions that leverage filter lists, to features natively integrated into popular browsers like Firefox and Brave to combat more modern techniques like browser fingerprinting. Nevertheless, few browsers offer protections against IP address-based tracking techniques. Notably, the most popular browsers, Chrome, Firefox, Safari and Edge do not offer any. In this paper, we study the stability of the public IP addresses a user device uses to communicate with our server. Over time, a same device communicates with our server using a set of distinct IP addresses, but we find that devices reuse some of their previous IP addresses for long periods of time. We call this IP address retention and, the duration for which an IP address is retained by a device, is named the IP address retention period. We present an analysis of 34,488 unique public IP addresses collected from 2,230 users over a period of 111 days and we show that IP addresses remain a prime vector for online tracking. 87 % of participants retain at least one IP address for more than a month and 45 % of ISPs in our dataset allow keeping the same IP address for more than 30 days. Furthermore, we also detect the presence of cycles of IP addresses in a user's history and highlight their potential to be abused to infer traits of the user behaviour, as well as mobility traces. Our findings paint a bleak picture of the current state of online tracking at a time where IP addresses are overlooked compared to other techniques like cookies or fingerprinting. CCS CONCEPTS • Security and privacy → Privacy protections; Social aspects of security and privacy.

show abstract

Section: Discussionmentioning

confidence: 99%

Don’t Count Me Out: On the Relevance of IP Address in the Tracking Ecosystem

Mishra

Laperdrix²,

Vastel

et al. 2020

Proceedings of the Web Conference 2020

View full text Add to dashboard Cite

show abstract

“…While we could have used residential proxy services to acquire more residential IP addresses, this approach still has several drawbacks. Mi et al [37] showed that a majority of the devices proposed by residential proxy services did not give their consent. Moreover, since residential proxy services do not provide mechanisms to ensure the nature of the device that will act as a proxy, there can be inconsistencies between the browser fingerprint of our crawlers and the TCP or TLS fingerprints of the proxy, making it more difficult to understand why a crawler was blocked.…”

Section: ) Crawler Familymentioning

confidence: 99%

FP-Crawlers: Studying the Resilience of Browser Fingerprinting to Block Crawlers

Vastel¹,

Rudametkin²,

Rouvoy³

et al. 2020

Proceedings 2020 Workshop on Measurements, Attacks, and Defenses for the Web

View full text Add to dashboard Cite

Data available on the Web, such as financial data or public reviews, provides a competitive advantage to companies able to exploit them. Web crawlers, a category of bot, aim at automating the collection of publicly available Web data. While some crawlers collect data with the agreement of the websites being crawled, most crawlers do not respect the terms of service. CAPTCHAs and approaches based on analyzing series of HTTP requests classify users as humans or bots. However, these approaches require either user interaction or a significant volume of data before they can classify the traffic.In this paper, we study browser fingerprinting as a crawler detection mechanism. We crawled the Alexa top 10K and identified 291 websites that block crawlers. We show that fingerprinting is used by 93 (31.96%) of them and we report on the crawler detection techniques implemented by the major fingerprinters. Finally, we evaluate the resilience of fingerprinting against crawlers trying to conceal themselves. We show that although fingerprinting is good at detecting crawlers, it can be bypassed with little effort by an adversary with knowledge on the fingerprints collected.

show abstract

“…Residential Proxy. The first study examining the behavior of the residential proxies is due to Mi et al [8], where the authors conducted an in-depth analysis on residential proxy services and servers, including about six million residential IP addresses across ≈230 countries and 52,000 Internet Service Providers (ISPs). Their findings show that even though residential proxy providers claim that the proxy hosts willingly participated in providing the service, many proxies operate on compromised hosts.…”

Section: Related Workmentioning

confidence: 99%

“…Residential proxies are not public, so it is difficult to obtain their IP addresses in a similar way. To this end, we obtained the dataset residential proxies from Mi et al [8]. Mi et al utilized an infiltration framework to collect a dataset of 6,419,987 residential proxies distributed across more than 230 countries and more than 52,000 ISPs.…”

Section: Data Collection and Measurement A Proxy Data Collectionmentioning

confidence: 99%

See 1 more Smart Citation

Understanding the Proxy Ecosystem: A Comparative Analysis of Residential and Open Proxies on the Internet

et al. 2020

View full text Add to dashboard Cite

Proxy servers act as an intermediary and a gateway between users and other servers on the Internet, and have many beneficial applications targeting the privacy of users, including bypassing serverside blocking, regional restrictions, etc. Despite the beneficial applications of proxies, they are also used by adversaries to hide their identity and to launch many attacks. As such, many websites restrict access from proxies, resulting in blacklists to filter out those proxies and to aid in their blocking. In this work, we explore the ecosystem of proxies by understanding their affinities and distributions comparatively. We compare residential and open proxies in various ways, including country-level and city-level analyses to highlight their geospatial distributions, similarities, and differences against a large number of blacklists and categories therein, i.e., spam and maliciousness analysis, to understand their characteristics and attributes. We conclude that, while aiming to achieve the same goal, residential and open proxies still have distinct characteristics warranting considering them separately for the role they play in the larger Internet ecosystem. Moreover, we highlight the correlation of proxy locality distribution and five country-level characteristics, such as their Internet censorship, political stability, and Gross Domestic Product (GDP).

show abstract

Resident Evil: Understanding Residential IP Proxy as a Dark Service

Cited by 38 publications

References 22 publications

Don’t Count Me Out: On the Relevance of IP Address in the Tracking Ecosystem

Don’t Count Me Out: On the Relevance of IP Address in the Tracking Ecosystem

FP-Crawlers: Studying the Resilience of Browser Fingerprinting to Block Crawlers

Understanding the Proxy Ecosystem: A Comparative Analysis of Residential and Open Proxies on the Internet

Contact Info

Product

Resources

About