Proxy Services Are Not Safe. Try These Alternatives – Wired

Millions of people across the world use free proxy services to bypass censorship filters, improve online security, and access websites that aren’t available in their country. But an analysis has found those free services come at an unexpected cost for users: their privacy and security. Christian Haschek, an Austria-based security researcher, wrote a script that analyzed 443 open proxies, which route web traffic through an alternate, often pseudo-anonymous, computer network. The script tested the proxies to see if they modified site content or allowed users to browse sites while using encryption. According to Haschek’s research, just 21 percent of the tested proxies weren’t “shady.”

Haschek found that the other 79 percent of surveyed proxy services forbid secure, HTTPS traffic.

HTTPS is commonly used to encrypt Web traffic, allowing users to enter credit cards, passwords, and other sensitive information in a manner that makes it difficult for hackers and intermediaries to intercept. By preventing customers from using the Web securely, Haschek warns these open proxies “can analyze your traffic and steal your logins.”

Free proxies are also manipulating websites directly. Haschek reports that 16.6 percent of proxies change HTML and 8.5 percent modified websites’ JavaScript. In most cases, this was done merely to inject advertising into websites. However, Haschek speculates that these services are “probably also cookie stealing.”

Popularity Surge

Proxy usage has been growing over the years along with the rise of content streaming services and growing fears of government surveillance of internet activity. Virtual Private Networks (VPNs), which encrypts all your traffic and routes it through another server to mask your location, are commonly used by people looking to bypass geolocation restrictions on services such as Netflix, Hulu, and BBC iPlayer. And by masking user’s locations, software and media pirates have also flocked to VPNs to make it more difficult for content owners to sue them in court.

VPN services are also popular in countries with strict Internet laws. They have been used in China, particularly by foreigners looking to access Western websites blocked by the Great Firewall, until the Chinese government moved to block VPN access earlier this year. In April, many Australians started using VPNs after the government passed a mandatory data retention law. As a result, CNET reported that one VPN provider’s Australian business increased 500 percent between early March and mid-April.

At the same time, in the past few months free VPN services have been tied to deceptive business practices. Hola, an Israeli VPN service that boasts over 48 million users, was widely criticized last month for selling its free-tier users’ idle bandwidth. This meant Hola’s millions of free users were unknowingly turned into a botnet that was utilized for criminal activities, including repeated denial-of-service attacks against the message board 8chan.

Haschek’s analysis didn’t uncover anything quite so sinister, but noted some of the reviewed services were “definitely bad adware.” A previous report from the security researcher noted that many of these free proxies exist because establishing the service serves as “an easy way to infect thousands of users and collect their data.”

According to that report, Haschek observed that controlling a VPN services makes it is easy to manipulate websites to steal login information, banking and credit card accounts, turn users into a distributed denial-of-service attack botnet, and monitor all their Web activities.

Finding Safe Alternatives

To help combat the security vulnerabilities users expose themselves to when using free proxies, Haschek released a tool called Proxy Checker, which performs a cursory evaluation on any proxy service in use to ensure it isn’t manipulating content or forcing users to forgo encryption.

But Haschek recommends avoiding free proxies altogether. Fortunately, secure alternatives exist.

Source of this news: https://www.wired.com/2015/07/proxy-services-totally-unsecure-alternatives/