Organizations incorporate Conditional Access policies in their security paradigm as an essential line of defense to prevent unauthorized access to the organization’s systems. Organizations rely on limiting the authentication attempts to those IP addresses that belong to the corporate online infrastructure or to geographical locations that make sense. Nevertheless, criminal users quickly adapted to the environments in which they operate, making old-fashioned geo-fencing useless.
The trick of the evasion is the presence of the residential proxy. Residential proxies differ from usual commercial VPNs or datacenter proxies that can be easily spotted by any security software because of their known IP ranges.
Perpetrators create huge proxy botnets through the infection of millions of household devices in the Globe. This is mostly done when a user unknowingly installs some free software, downloaded a cracked game, or accessed a suspicious broadcast source which has bandwidth-sharing software in it. After the infection, the variable user’s appliance will be acting as an exit point allowing the intruder in some foreign land to direct his criminal activity from the victim’s home network.
When some hacker steals a login or session data of a corporate employee he can quickly buy an access to a proxy located in the city where the victim lives. Then, the hacker can log in to the corporate environment using the information he collected earlier and the resident IP that can be seen from the location of the victim.
The geographical trick works properly with Conditional Access policies. The organization's identity management system sees a legitimate username and correct password, along with the IP address that corresponds with a given employee's remote access profile. Consequently, it grants the intruder all access privileges with complete outage of the anomaly detection systems.
This method changes the whole concept of remote access vulnerability detection. Organizations cannot consider an authentication request trustworthy just because the originating IP address belongs to the country.
To improve the security in terms of the residential proxy exploitation method, organizations have to abandon a simple geographical verification of the access request. The security systems have to introduce continuous behavioral analytics instead of a primary authentication system based on the IP address alone. Organizations also have to implement strong device-related access authentication systems allowing using a token only if it has been tied to a particular corporate device in a cryptographic manner, no matter what geographical location is indicated in the access request.
DarkX — DarkX provides the continuous external intelligence required to secure your remote workforce, actively monitoring underground markets for residential proxy botnet activity and correlating external threat telemetry to expose illicit access attempts before they bypass your corporate perimeter.
For more research on cybersecurity, privacy, and emerging digital risks, visit:
IntelligenceX - IntelligenceX enables users to discover digital evidence in a privacy-friendly way.
Top comments (0)