Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label Proxy. Show all posts

Proxy Servers: How They Work and What They Actually Do



When browsing online, your device usually connects directly to a website’s server. However, in certain cases, especially for privacy, security, or access control — a proxy server acts as a go-between. It stands between your device and the internet, forwarding your web requests and returning responses while showing its own public IP address instead of yours.

According to the U.S. National Institute of Standards and Technology (NIST), a proxy server is essentially a system that handles requests from clients and forwards them to other servers. In simple terms, it’s a digital middleman that manages the communication between you and the websites you visit.


How a Proxy Server Operates

Here’s how the process works:

1. Your computer or device sends a request to the proxy server instead of directly contacting a website.

2. The proxy then forwards that request to the destination site.

3. The site responds to the proxy.

4. The proxy returns the data to your device.

From your perspective, it looks like a normal browsing session, but from the website’s end, the request appears to come from the proxy’s IP address. Proxies can exist as physical network devices or as cloud-based services that users configure through system or browser settings.

Companies often use “reverse proxies” to manage and filter incoming traffic to their web servers. These reverse proxies can block malicious activity, balance heavy traffic loads, and improve performance by caching frequently accessed pages.


Why People Use Proxy Servers

Proxy servers are used for several reasons. They provide a basic layer of privacy by hiding your actual IP address and limiting what websites can track about you. They can also make it appear that you’re browsing from another location, allowing access to region-locked content or websites blocked in your area.

In workplaces and educational institutions, proxies help administrators restrict certain sites, monitor browsing activity, and reduce bandwidth consumption by storing copies of commonly visited web pages. Large organizations also rely on proxies to safeguard internal systems and regulate how employees connect to external networks.


The Limitations and Risks

Despite their advantages, proxy servers have notable limits. They do not encrypt your internet traffic, which means that if your connection is not secured through HTTPS, the information passing through can still be intercepted. Free or public proxy services pose particular risks, they often slow down browsing, log user activity, inject advertisements, or even harvest data for profit.

For users seeking genuine privacy or security, experts recommend using paid, reputable proxy services or opting for a Virtual Private Network (VPN). VPNs extend the idea of a proxy by adding encryption, ensuring that all traffic between the user and the internet is protected.


Proxy vs. VPN vs. NAT

Although proxies, VPNs, and Network Address Translation (NAT) all sit between your device and the wider web, they function differently.

• Proxy: Masks your IP address and filters traffic but does not encrypt your connection.

• VPN: Encrypts all online activity and provides a stronger layer of privacy and security.

• NAT: Operates within routers, allowing multiple devices in a household or office to share one public IP address. It’s a background process, not a privacy tool.

Proxy servers are practical tools for managing internet access, optimizing traffic, and adding basic privacy. However, they should not be mistaken for comprehensive security solutions. Users should view proxies as one layer of digital protection, effective when used properly, but insufficient on their own. For strong privacy, encryption, and security, a VPN remains the more reliable choice.



2.8 million IP Addresses Being Leveraged in Brute Force Assault On VPNs

 

Almost 2.8 million IP addresses are being used in a massive brute force password attack that aims to guess the login credentials for a variety of networking devices, including those generated by Palo Alto Networks, Ivanti, and SonicWall.

A brute force assault occurs when an attacker attempts to repeatedly log into an account or device with many usernames and passwords until the correct combination is found. Once the malicious actors access the right credentials, they can use them to access a network or take control of a device.

The Shadowserver Foundation, a threat monitoring platform, reports that a brute force attack has been going on since last month, using around 2.8 million source IP addresses every day to carry out these attacks. Brazil accounts for the majority of them (1.1 million), with Turkey, Russia, Argentina, Morocco, and Mexico following closely behind. However, a very big range of countries of origin generally participate in the activity.

These are edge security equipment, such as firewalls, VPNs, gateways, and other security appliances, which are frequently exposed to the internet to allow remote access. The devices used in these attacks are predominantly MikroTik, Huawei, Cisco, Boa, and ZTE routers and IoTs, which are frequently hacked by big malware botnets. 

The Shadowserver Foundation stated to the local media outlet that the activity has persisted for some time but has recently escalated significantly. ShadowServer also indicated that the attacking IP addresses are distributed across various networks and Autonomous Systems, suggesting the involvement of a botnet or an operation linked to residential proxy networks. 

Residential proxies are IP addresses allocated to individual customers of Internet Service Providers (ISPs), rendering them highly desirable for cybercrime, data scraping, circumvention of geo-restrictions, ad verification, and ticket scalping, among other uses. 

These proxies redirect internet traffic over residential networks, giving the impression that the user is a typical home user rather than a bot, data scraper, or hacker. Gateway devices targeted by this activity may be utilised as proxy exit nodes in residential proxying operations, passing malicious traffic through an organization's enterprise network. These nodes are rated "high-quality" because the organisations have a good reputation and the assaults are more challenging to identify and stop. 

Changing the default admin password to a strong and distinct one, implementing multi-factor authentication (MFA), employing an allowlist of trustworthy IPs, and turning down web admin interfaces when not in use are some ways to defend edge devices against brute-forcing assaults. In the end, patching those devices with the most latest firmware and security upgrades is essential to eliminating flaws that threat actors could use to gain initial access.