Your Phone is My Proxy: Detecting and Understanding Mobile Proxy Networks

Your Phone is My Proxy: Detecting and Understanding Mobile Proxy Networks
复制标题

DOI：
10.14722/ndss.2021.24008
复制
发表时间：
2021
期刊：
Proceedings 2021 Network and Distributed System Security Symposium
影响因子：
--
通讯作者：
Xianghang Mi;Siyuan Tang;Zhengyi Li;Xiaojing Liao;Feng Qian;Xiaofeng Wang
Xianghang Mi;Siyuan Tang;Zhengyi Li;Xiaojing Liao;Feng Qian;Xiaofeng Wang
中科院分区：
其他
文献类型：
--
作者：
Xianghang Mi;Siyuan Tang;Zhengyi Li;Xiaojing Liao;Feng Qian;Xiaofeng Wang

文献摘要

被引文献

相似文献

-住宅代理最近作为一种越来越受欢迎的服务出现，其中代理提供商通过他们控制的数以百万计的代理对等点来中继他们客户的网络Traffic。我们发现，这些代理对等点中的许多都是移动设备，它们在代理网络中的角色可能会产生显著的安全影响，因为移动设备往往是隐私和资源敏感的。然而，到目前为止，几乎没有人努力了解他们参与的程度，更不用说这些设备是如何被代理网络招募的，以及它们可能构成什么安全和隐私风险。在本文中，我们报告了移动代理生态系统的fiRST测量研究。我们的研究是由一个新的测量基础设施实现的，它使我们能够识别代理提供商，发现代理SDK(软件开发工具包)，检测基于代理SDK构建的安卓代理应用程序，收集代理IP地址，并了解代理Traffic。通过该基础设施收集的信息为我们带来了对这个生态系统的新理解和重要的安全发现。更具体地说，4家代理提供商被发现向应用程序开发商提供移动代理SDK，作为一种具有竞争力的应用程序盈利渠道，每100万MAU(月度活跃用户)每月支付5万美元。事实证明，1701个Android APK(属于963个Android应用)集成了这些代理SDK，其中大多数都可以在Google Play上使用，总共至少安装了3亿个。此外，其中48.43%的fl被至少5个反病毒引擎标记为恶意，这就解释了为什么截至2019年10月，963款安卓应用中有86.60%已从Google play中删除。此外，虽然这些应用程序在Traffic中继上显示用户同意对话框，但我们的用户研究表明
—Residential proxy has emerged as a service gaining popularity recently, in which proxy providers relay their customers’ network traffic through millions of proxy peers under their control. We find that many of these proxy peers are mobile devices, whose role in the proxy network can have significant security implications since mobile devices tend to be privacy-and resource-sensitive. However, little effort has been made so far to understand the extent of their involvement, not to mention how these devices are recruited by the proxy network and what security and privacy risks they may pose. In this paper, we report the first measurement study on the mobile proxy ecosystem. Our study was made possible by a novel measurement infrastructure, which enabled us to identify proxy providers, to discover proxy SDKs (software development kits), to detect Android proxy apps built upon the proxy SDKs, to harvest proxy IP addresses, and to understand proxy traffic. The information collected through this infrastructure has brought to us new understandings of this ecosystem and important security discoveries. More specifically, 4 proxy providers were found to offer app developers mobile proxy SDKs as a competitive app monetization channel, with $50K per month per 1M MAU (monthly active users). 1,701 Android APKs (belonging to 963 Android apps) turn out to have integrated those proxy SDKs, with most of them available on Google Play with at least 300M installations in total. Furthermore, 48.43% of these APKs are flagged by at least 5 anti-virus engines as malicious, which could explain why 86.60% of the 963 Android apps have been removed from Google Play by Oct 2019. Besides, while these apps display user consent dialogs on traffic relay, our user study indicates that the