Internet开放代理的广泛评估
An Extensive Evaluation of the Internet's Open Proxies
摘要：
开放代理代表任何互联网用户转发流量。它们被列在开放的代理聚合器网站上，经常被用来绕过地理区域限制或规避审查。开放代理有时也通过隐藏请求者的IP地址来提供弱形式的匿名性。为了更好地了解他们的行为和性能，我们对开放代理进行了全面的研究，包括超过107，000个列出的开放代理和50天内的13 M代理请求。虽然以前的研究都集中在恶意开放代理的HTML内容插入/修改广告的操纵，我们提供了一个更广泛的研究，检查可用性，成功率，多样性，也（错误）代理的行为。我们的研究结果表明，列出的开放式代理的可用性很差-超过92%的开放式代理出现在聚合器网站上，对代理请求没有响应。更令人不安的是，我们发现了许多恶意开放代理的例子，其中HTML内容被操纵以挖掘加密货币（即加密劫持）。我们还检测到TLS中间人（MitM）攻击，并发现许多实例，其中通过代理获取的二进制文件被修改为包含远程访问木马和其他形式的恶意软件。作为一个比较点，我们进行和讨论Tor出口继电器的行为类似的测量研究。我们没有发现Tor中继执行TLS MitM或操纵内容的实例，这表明Tor提供了一种更可靠和安全的代理通信形式。
英文摘要：
Open proxies forward traffic on behalf of any Internet user. Listed on open proxy aggregator sites, they are often used to bypass geographic region restrictions or circumvent censorship. Open proxies sometimes also provide a weak form of anonymity by concealing the requestor's IP address. To better understand their behavior and performance, we conducted a comprehensive study of open proxies, encompassing more than 107,000 listed open proxies and 13M proxy requests over a 50 day period. While previous studies have focused on malicious open proxies' manipulation of HTML content to insert/modify ads, we provide a more broad study that examines the availability, success rates, diversity, and also (mis)behavior of proxies. Our results show that listed open proxies suffer poor availability--more than 92% of open proxies that appear on aggregator sites are unresponsive to proxy requests. Much more troubling, we find numerous examples of malicious open proxies in which HTML content is manipulated to mine cryptocurrency (that is, cryptojacking). We additionally detect TLS man-in-the-middle (MitM) attacks, and discover numerous instances in which binaries fetched through proxies were modified to include remote access trojans and other forms of malware. As a point of comparison, we conduct and discuss a similar measurement study of the behavior of Tor exit relays. We find no instances in which Tor relays performed TLS MitM or manipulated content, suggesting that Tor offers a far more reliable and safe form of proxied communication.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
