What Was IPIDEA and How It Worked?
Google’s Threat Intelligence Group (GTIG) one of the industry’s leading cybersecurity arena has taken a big step forward by disrupting IPIDEA, an enormous worldwide residential proxy service which secretly turned Android devices, Windows machines and other devices into anonymization relays for criminal/State linked threat actors to use to conduct their illegal activities.
In the guise of selling residences as proxies, IPIDEA claimed to sell access to millions of residential IP addresses. In actuality, it was using random apps and other software products to install and distribute malicious software development (SDK) tools on the actual app users’ devices. Once the SDK’s tools were on the device, the app users had no idea they were running these SDK tools and could be used by other parties to turn their everyday home machine into an exit point for sending/receiving internet traffic for other people.
Why This Matters
Proxy networks like IPIDEA route internet traffic through consumer devices, making it difficult for organizations to detect malicious activity such as account takeover attempts, botnet control, credential stuffing, and fake account creation.
The Takedown: How Google Disrupted the Network
To shut down IPIDEA’s infrastructure, Google and its partners took a multi-faceted approach:
- Court Order and Legal Action – A federal court in the United States agreed to issue a court order enabling the shutdown of many of the down online domains and many of the backend systems that were being used by the IPIDEA network.
- Domain Seizures and Servers are shutdown – The companies that provide the network’s supporting infrastructure and those that provide domains were contacted and requested to take action to take down key command-and-control domains.
- Enhanced Detection & Blocking – The availability of Google’s Play Protect technology to detect, block, and remove all apps that include IPIDEA SDKs on certified Android devices.
- Intelligence Sharing – Google shared information about this network with security team partners who can help improve the detection and prevention of similar infrastructure in the future.
Scope of the Threat
IPIDEA was discovered by security researchers within the codes of thousands of desktop binaries and hundreds of applications that run on many different types of devices, with millions of users worldwide utilizing them, including Android smartphones and Windows computers. The network was reportedly leveraged by over 550 distinct threat groups, including cybercriminal gangs and actors linked to various nations.
Some of the compromised devices were used by botnets such as Kimwolf, both of which have used the hijacked IP addresses from IPIDEA to carry out large-scale attacks.
What Users Should Do
To stay secure in light of these revelations:
- Only download apps from official app stores.
- Keep devices updated with the latest security patches.
- Enable built-in protections like Google Play Protect and beware of apps that request unusual permissions.
