911 Proxy Service Implodes After Disclosing Breach

https://krebsonsecurity.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/

by todsacerdoti • 4 years ago

98 59 4 years ago

It took me longer than it should to realize we were not talking about a service to place proxy calls to 911 (emergency dispatch) but a service called "911" that sells proxy accounts.

A_No_Name_Mouse• 4 years ago

Not wearing my glasses I misread it as 911 Porsche Service :-)

Bluecobra• 4 years ago

Same here, I have used third party 911 services for enterprise VoIP in the past.

datalopers• 4 years ago

Great. Now can we shutdown HolaVPN and their primary reseller Luminati/BrightData? It’s all backdoored residential proxies just like 911.re

ratsmack• 4 years ago

Hola is a freemium web and mobile application...

When the service is free, you are the product.

jjoonathan• 4 years ago

Yeah, but you can pay to be the product, too.

ranger_danger4• 4 years ago

The problem is their proxy backdoor thing is part of an SDK used by other applications/games/etc., both free and paid.

str3wer• 4 years ago

according to Hola tos you agree to make your device a proxy accessible to everyone else using the service

RockRobotRock4• 4 years ago

Bright Data operates a service where you agree to allow your network to be used in their proxy system. In return, they give you a small amount of money per gigabyte of traffic. https://earnapp.com/

Ian_Kerins2• 4 years ago

The ethics of these free VPNs and hidden proxy SDKs are very questionable. But they are crazy profitable for the proxy providers running them so unlikely to go away.

Did a teardown on their crazy economics recently https://scrapeops.io/web-scraping-playbook/residential-mobil...

The profit margins are insane, easily over 99% profit on millions in revenue.

jvanderbot• 4 years ago

In my new house, Xfinity offers huge discounts if you let them manage the network.

Are they reselling that bandwidth, mining my data, monitoring my traffic, or all of the above?

donkarma• 4 years ago

For the unprepared this is a website commonly used by credit card fraudsters to imitate an IP address close to the card's address

walrus01• 4 years ago

Google "residential proxies for sale" for the tip of a shit laden shady black market iceberg

rubatuga2• 4 years ago

Also called sneaker proxies. Why? Used to bypass restrictions or limits on buying sneakers/shoes online.

mousetree• 4 years ago

Does anyone know of a service that can be used to determine whether an IP has been associated/used by one of these proxy services? It would benefit my company to be able to detect these types of fraudsters

nightpool• 4 years ago

since these proxy services are created by hijacking legitimate users' computers and internet connections, I would imagine any such list would be quickly out of date. Based on their marketing information, at least hundreds of new computers were added to their network each day.

wyattwest2• 4 years ago

Hi! Here at Spur, this is our mission exactly. As another commenter correctly noted, proxy endpoint data - especially those of residential or "callback" proxies like 911 - is highly ephemeral. Our company provides near-real time tracking for many residential & datacenter proxy services, as well as VPNs.

Check us out at https://spur.us

RockRobotRock4• 4 years ago

My first thought is, "Why would it benefit your company, unless you were dealing with payments directly?," and then I read your comment history and it all makes sense now, haha.

Honestly, for assessing risk of individual users, my worry is that the only good option right now is to use tools that require lots of data on the user, like recaptcha v3. You could set up a honeypot that tries to catch as many IP addresses implicated in proxy activity as possible. Maybe that second one would be a good company idea.

charcircuit• 4 years ago

The whole point of these services is to buy proxies that are not on a list.

vatican_banker• 4 years ago

I know at least two:

1. SEON: https://seon.io/

2.IPQS: https://www.ipqualityscore.com/

neilv• 4 years ago

Thanks for the info. I don't know the full story behind any particular residential IP proxy service, but I'd previously decided not to use any of them for a startup's purposes.

As I explained to my colleagues, I wouldn't be able to determine, with confidence, which of the services were 100% legit, and which weren't. We didn't want to accidentally get involved with questionably-obtained residential IPs, etc. That would've been antithetical to our business, and also just not how we operate in general.

(The startup provided solutions in the supply chain integrity space. Part of the technology included bespoke Web scraping, to monitor certain venues for naughtiness scale and patterns over time. Because venues were around the world, and because venues had complicating incentives regarding some of the questionable third-party activity in the venue... I wanted the delicate scraping to look similar to normal consumer users who were in the geopolitical region served by the venue. Instead of a residential IP service, I used an (undisclosed) different, impeccable approach, which won't work for all use cases, but did for ours.)

Scoundreller• 4 years ago

Instead of a residential IP service, I used an (undisclosed) different, impeccable approach, which won't work for all use cases, but did for ours

3G/LTE because all mobile providers use CG-NAT?

(I also discovered that my old DSL ISP accepted its dialup provider's credentials for PPPoE). Best part about PPPoE is that you can run multiple sessions over the same line/modem.

klabb3• 4 years ago

Does anyone know how this software passed Microsoft smartscreen and typical antivirus apps? As someone distributing legitimate software on Windows, I feel like I was heavily scrutinized and getting code signing certs was a real pain, and costly. What's the purpose if it can't even weed out crap like this?

ranger_danger4• 4 years ago

Smartscreen has always been a joke.

game-of-throws• 4 years ago

I hoped with Lets Encrypt we were past the days of paying for cryptographic signatures, but Microsoft is keeping the legacy alive

chatmasta• 4 years ago

They probably just tell the user to bypass the prompts. For example, my college roommate went to great lengths to install what he thought was a Pokémon blue emulator on his laptop. All the security checks in the world won’t protect a user determined to silence them.

I don’t know that’s what happened here, but it sounds like some of the installs were PPI, so I wouldn’t be surprised. That basically means anyone who can figure out how to bundle the software with an artifact can distribute it. A long time ago, and probably today too, people used to crack popular programs, bundle some adware into them, and then seed the torrent. The user is already committed to circumventing security checks and entering strange commands, so I can imagine how they might end up installing some bonus executables in the process.

userbinator2• 4 years ago

All the security checks in the world won’t protect a user determined to silence them.

And that is IMHO a good thing. The alternative is a world where no one has any freedom.

ginja• 4 years ago

Does anyone have any recommendations for legit companies that provide proxies from ASNs not marked as datacenter/proxy? I need some for web scraping, but all the ones I've found so far seem super shady...

leobg• 4 years ago

brightdata, scraperapi

Ian_Kerins2• 4 years ago

this proxy comparison tool shows you the best ones https://scrapeops.io/proxy-providers/comparison/

mh-• 4 years ago

This is neat, thanks for building/sharing it.

ranger_danger4• 4 years ago

No you don't.

dylan604• 4 years ago

Exactly my thinking as well. If you have to do some sort of shady shit to get what you need done, then maybe you're doing shady shit yourself.

rubatuga2• 4 years ago

You won’t find one

yuliyp2• 4 years ago

It sounds like you're looking for a not shady supplier for a service that is itself shady. That sounds tricky.

imiric2• 4 years ago

This disclosure sounds super shady itself.

Among their reasons they list that it's a "huge challenge" to manually vet traffic to detect malicious usage. They've been online for two years and only now determined that this would be a challenge?

And then blame a hacker of manipulating user balances and data loss. Please.

This sounds like incompetence on their side to keep their shady business under wraps, and now that it's been made public, they're shutting down to re-brand and launch a "new" service with the same backend. Any one of their "competitors" could actually just be them.

Lali-cat_112• 4 years ago

the best 911 proxy alternative: yilu proxy https://www.yilu.us and has cooperated with Lalicat Browser: https://www.lalicat.com/911-socks5-proxy

911 Proxy Service Implodes After Disclosing Breach

Related Stories