Towards Residential Proxies Detection: An Experimental Analysis in the Android Environment

Nowadays, Proxy services are increasingly used by both companies to manage their Intranets and by private users to increase their online privacy. In addition to classic services, a new type of VPN is recently emerging, called RESIP. The idea behind this novel architecture is to exploit residential data connections as exit nodes of the RESIP network, in order to avoid detection based on the blacklisting of the IP addresses of data centers. Luminati is currently the largest RESIP provider globally, with over a million residential IPs under their control. According to their claims, residential devices join their service voluntarily. To recruit these devices, Luminati provides app developers with an SDK to be integrated into their applications, offering monetary rewards in return. On installing applications with an integrated Luminati SDK, the device joins the Luminati network as a proxy node. The traffic from Luminati clients will then be relayed through it. Luminati officially requires developers to mention their SDKs’ presence in terms and conditions of the final application, to safeguard end users. However, this policy is neither strictly implemented nor monitored. The main goal of this thesis is to investigate the feasibility of detecting Luminati’s SDK, both statically and dynamically, to prevent unauthorized use of end-devices without the owner’s permission.