An increasing number of companies are facing potential security threats due to bandwidth-sharing applications, which can convert employee devices into entry points for external traffic. These applications, while not traditional malware, can still expose internal networks to risk. One such app, Peer2Profit, has drawn attention for its ability to turn user devices into gateways for proxy networks like Astroproxy.
Understanding the Threat
Peer2Profit allows users to earn money by sharing their unused internet bandwidth. However, researchers from Silent Push found that this service effectively enrolls devices into Astroproxy’s network, reselling their connections as proxy access. This revelation highlights how consumer applications can inadvertently create security vulnerabilities without triggering antivirus systems.
The broader issue concerns residential proxy networks, which disguise traffic as originating from legitimate sources, making it challenging for security tools to distinguish between genuine and malicious activities. Such networks facilitate various cyber threats, including account takeovers and fraud.
Research Findings and Implications
During a 72-hour period, Silent Push identified over 117,000 unique IP addresses in Astroproxy’s pools, with residential proxies rapidly increasing in number. This rapid growth can outpace traditional IP reputation tracking. The report, shared with Cyber Security News, warns that devices, including those on corporate networks, could be compromised by employees seeking minor financial gains.
The potential consequences are significant, ranging from misuse of a company’s IP address for illicit activities to reputational damage. Peer2Profit pays its users modest sums for bandwidth, but charges much higher rates to its customers, underscoring why these connections are valuable to proxy operators.
Mitigation Strategies
To address these risks, companies should review their software policies and monitor DNS activities. Inspecting browser extensions and consumer apps for unauthorized connections is crucial. Furthermore, the discovery of a DNS bypass capability that allowed access to internal resources underlines the need for more robust network segmentation and management interface restrictions.
Organizations must proactively identify devices running bandwidth-sharing software and block unnecessary connections. Clear policies, employee education, and regular security reviews can mitigate the risk of devices being exploited as proxy nodes.
Future Outlook
As the landscape of cyber threats evolves, the importance of treating bandwidth-sharing applications as a serious security concern grows. Implementing comprehensive network security measures and maintaining vigilance against unauthorized software can help protect corporate networks from becoming unwitting participants in proxy networks.
