Google Disrupts IPIDEA Proxy Network

"IPIDEA's operators used software development kits (SDKs) and proxy software that developers embedded in their mobile and desktop applications, and which enrolled users' devices into the network. The IPIDEA takedown, Google says, involved both legal action against control and proxy domains, and sharing intelligence on the SDKs and proxy software used in the operation. According to Google, the disruption reduced "the available pool of devices for the proxy operators by millions", causing "significant degradation of IPIDEA's proxy network and business operations"."

"Providing Android, iOS, Windows, and WebOS support, the SDKs were marketed as monetization means for developers, who were paid by IPIDEA's operators, usually on a per-download basis. Once the applications were installed, the SDKs turned users' devices into exit nodes for the proxy network, typically without their knowledge. "While many residential proxy providers state that they source their IP addresses ethically, our analysis shows these claims are often incorrect or overstated. Many of the malicious applications we analyzed in our investigation did not disclose that they enrolled devices into the IPIDEA proxy network," Google says."

Google disrupted IPIDEA through legal action against control and proxy domains and by sharing intelligence on the SDKs and proxy software used in the operation. IPIDEA operators embedded SDKs and proxy code in mobile and desktop applications across Android, iOS, Windows, and WebOS, enrolling users' devices as exit nodes—often without user knowledge—and paid developers per download. Operators controlled multiple proxy and VPN brands and SDKs (Castar, Earn, Hex, Packet) and used a two-tier infrastructure where devices retrieved tier-two node information from domains. The action removed millions of devices from the available proxy pool and materially degraded operations, with potential downstream reseller impacts.

Read at SecurityWeek