Hacker News

points by ZoneZealot 3 days ago | 0 comments

It's described at a high level in media often. Here's more detail though:

Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.

Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.

A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.

[–] cpburns2009 3 days ago

This isn't a theoretical problem either. My employer's website was being hammered by residential proxies a month ago. It wasn't until we setup WAF captcha rules that they mostly subsided. It wasn't even the typical exploit scanner. I don't know what the purpose was but it was effectively a DDoS.

[–] cowlevel 3 days ago

Everyone's is. Far as anyone can tell, it's probably AI companies.

[–] cpburns2009 3 days ago

It wasn't any sensible AI scraper. It kept requesting the same pages a thousand times over.

[–] cowlevel 3 days ago

Yep that's what AI scrapers do

[–] cpburns2009 3 days ago

I thought AI scrapers were generally a little more intelligent than let's spam the same request 1k times (without any obvious permutations).

[–] cowlevel 3 days ago

Nope

[–] mrguyorama 2 days ago

These so called "Best of the best industry experts" don't understand what "Air gapped" means, and still don't even after 3 perfect examples.

They do not respect prior knowledge in any way, and think it has no value.

Of course they don't do standard, table stakes things like making their crawler smart. They don't have to. They're better than that or something.

[–] superjan 3 days ago

I was expecting that VPN’s (maybe not all) also use their own customers as relays, but you don’t mention them. Am I wrong?

[–] rcxdude 3 days ago

It's definitely not all VPNs (typically the ones you pay for will buy their own hardware and internet connections in the places you can route your traffic through), but it is a common situation for the shadier (especially 'free') ones, and in that case it's usually not just a peer-to-peer thing, they make money by selling your connection to people who pay because they want a large pool of relatively reputable and disconnected IPs to send traffic through.

[–] charcircuit 3 days ago

That kind of VPN is considered a residential proxy.

[–] ZoneZealot 3 days ago

You're right, a lot of 'free VPN' software also uses your own internet as a residential proxy. It's often mentioned in the ToS but the users don't read that.

[–] dylan604 3 days ago

Honestly, I expect any of those free VPN services that require an app install to be doing precisely this. At this point, I just assume anything with "free" in it will cost me more than if I just paid for something instead.

[–] rustyhancock 3 days ago

I'm surprised it doesn't cause more chaos, even as simple as people getting copyright infringement notices from their ISP?

[–] deltoidmaximus 3 days ago

Or worse.

But most likely these residential proxy services are more valuable for scraping, DDoS and manipulation plays on social media so they might not actually be used for things that draw direct attention. Using them to download illegal materials would be a waste of resources when a VPN does the job just as well.