Google Takes Down Massive Malicious Proxy Network, Millions of Zombie Devices

Google has a deeply-vested interest in cybersecurity and unparalleled resources to take down bad actors. The latest target on Google's kill list was a malicious proxy network called IPIDEA, and through coordinated efforts inside and outside of Google's umbrella, IPIDEA has been taken down. However, cybercriminals are a notoriously resourceful and persistent bunch, so Google also saw fit to share extensive documentation of its discoveries, so that everyone can take the right measures to keep malicious proxy networks like IPIDEA in the ground.

If you're familiar with botnets, you already understand most of what a malicious proxy network is. A botnet describes a large number of compromised devices being used (often without the knowledge of their owners) for malicious purposes, i.e. password breaking and DDOS attacks. A malicious proxy network also involves a large number of compromised devices, and compromised networks specifically, where a broadband connection becomes the exit point for all kinds of unsavory traffic. This is how IPIDEA functioned, effectively masking criminal traffic in a sea of legitimate users.
Google took the network down by first identifying how IPIDEA was operating. The main form of distribution was through otherwise-legitimate applications, including free VPN services, assorted Android applications, and through pre-compromised devices, like the unlicensed Android TV boxes we covered late last year. To fight against IPIDEA, Google took legal action to take down the critical C2 domains, added IPIDEA detection to Google Play Protect, and partnered with Cloudflare to disrupt domain resolution, among other efforts.

The full Google Cloud blog post details the warplan against IPIDEA, including lists of IOCs (Indicators of Compromise) and File Indicators. Google notes that while a major blow against IPIDEA's functionality has been struck, underworld efforts like these will continue exploiting legitimate users, networks, and devices without sufficient collaboration across the industry and accountability among proxy providers and app developers. So, stay vigilant, and remain wary of applications with no clear monetization path, especially those offering costly services (like VPN functionality, free premium video, etc).

Image Credit: Google, CodyHofstetter on WikiMedia Commons (CC 4.0 license)