Oxylabs(NordVPN) Fined $7.5M by jury for residential proxy botnet | Hacker News Reader

Oxylabs(NordVPN) Fined $7.5M by jury for residential proxy botnet

techradar.com

32 pointspaulcarroty19 comments

https://news.ycombinator.com/item?id=21664692

http://web.archive.org/web/20191128170008/https://medium.com...

> See the problem is, NordVPN is linked closely with a Lithuanian data mining company called Tesonet. NordVPN is said to be one of Tesonet’s projects, Oxylabs.io is another one.

> So what’s the big deal? Oxylabs.io advertises on its website “32M+ residential proxies…100% anonymous proxies from all over the globe with zero IP blocking.” Think of “residential proxies” this way: 1.) Oxylabs installs some malware on to a user’s device, unknown to the user, by bundling it with other software that the user downloads. 2.)This malware enables Oxylabs to sell off your bandwidth, your computing power, and your IP address to third parties, who will route their internet traffic through your device.

... for all the wrong reasons. They're being fined because they stepped on the toes of another residential proxy botnet (Luminati), not because the court felt there was anything inherently wrong with their behavior.

To me it reads like they infringed some software patents.

What's inherently wrong though ? It's just the internet. Share as much as you want. Make every IP a residential IP. It's more annoying that video websites are segregating IPs than someone is providing a service that randomizes it.

This is exactly what I would expect to hear from the kind of people who say they have nothing to hide, and therefore have nothing to fear regarding universal spying on them by their own government.

“If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.”

-Cardinal Richelieu

> What's inherently wrong though ?

The problem is that residential proxies are primarily used for abusive purposes, like credit card fraud (e.g. making purchases with a proxy in the same city as the credit card holder) or web forum spam. There are very few legitimate use cases for these services; most of the ones I have heard are either poorly justified (you don't really need a residential IP to test web site performance, for example) or borderline abusive (like content scraping or sneaker botting).

“And now, a word from our sponsor: NordVPN” was always going to turn out like this. Sooner or later they’d try to monetise their customers in a shady way, and all those YouTube videos will look like they were made in partnership with an evil corporation.

But Oxylabs isn't selling access through their NordVPN customers as residential proxies, are they?

Editorialized title ("botnet"). Botnets are normally malware controlled by criminals via c&c systems, this is more like a feebler and commercial version of Tor.

The end-users hosting the proxies of these are absolutely not aware they are being sold off for malicious traffic.

I'm sure these commercial proxy services and Tor have more than their fair share of abuse to deal with, but that's still a ways from botnets that are by definition illegitimate, in the malware victim case users don't consciously install them for sharing their internet connection. Oxylabs seems to market their service for web scraping which sounds reasonably legitimate.

But it would be interesting to know what these companies do to cut down abuse and results thereof...

Tor operators (and generally commercial proxy services) know what they are doing and opted into it specifically with no real way to deny doing so.\

The people providing the exit points for Oxylabs and Luminati do not know they are acting as exit points, nor would they actually approve of it if they knew what it meant.

That would obviously be not ok.

Oxylabs have a public stance about doing it in above-the-board ways (https://oxylabs.io/blog/standards-for-proxy-acquisition) but I guess you're saying this is BS.

I know several people that are approached with "load our SDK and make money pay per install on your userbase" type of deals for these residential proxy things. I've been approached myself by unknown (I didn't respond) actors offering to monetise my browser addons with more or less the same.

For the actual end user it's definitely not above the board.

Public notes:

https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_w...

https://www.reddit.com/r/androiddev/comments/ajfc7w/question...

https://dx.doi.org/10.14722/ndss.2021.24008

I have never seen actual informed consent before in ANY of these for the final end user; most of the targeted apps are general rubbish (think flashlight app requesting location permission and contacts type of BS). At best it would be buried deep in a ToS or EULA somewhere, and even that's fairly rare. Using a very very stretched definition of rewarding users, you could argue that "allowing the use of a calculator for free" is the reward for being an open proxy.

If you find any example anywhere by the implementors ("oh, it's the sdk includer's fault they aren't saying anything, we're totally above board...") that there is anything approaching informed consent, I would love to know some examples, because I've never seen one in these. (I would dearly love to be wrong here)

Ok, thanks for the information, I guess that would make it like a botnet.

There's still a remote possibility that they have changed their behaviour, since their post about end-user awareness and monetary compensation is somewhat newer than your references, but at this point I would need some independent third party vetting about that to convince me.

"Proxy Diversity (or lack of)" is good article about VPNs and proxy monopolies. https://medium.com/spur-intelligence/proxy-diversity-or-lack...

How do we as a society not understand that vpn companies more often than not harm the user's privacy

Probably because of how incredibly unimportant it is to the vast majority of people?

Can you explain this?

Reply on news.ycombinator.com