People around the world use commercial proxies to hide their true location or identity. This can be done for various purposes, including accessing blocked information or ensuring privacy.
But how reliable are the providers of such proxies when they claim their servers are located in a specific country? This is a crucial question that determines whether certain services can be used by clients who are concerned about protecting their personal information.
A group of American researchers from the University of Massachusetts, Carnegie Mellon, and Stony Brook published , during which they verified the actual location of servers from seven popular proxy providers. We have prepared a brief summary of the main findings.
Introduction
Proxy operators often do not provide any information that could confirm the accuracy of their claims about server locations. IP-to-location databases usually support the marketing claims of such companies; however, there is a large amount of evidence of errors in these databases.
During the study, the American researchers evaluated the locations of 2,269 proxy servers operated by seven proxy companies, located in a total of 222 countries and territories. The analysis showed that at least one-third of all servers are not located in the countries claimed by the companies in their marketing materials. Instead, they are situated in countries with cheap and reliable hosting: in the Czech Republic, Germany, the Netherlands, the United Kingdom, and the United States.
Server Location Analysis
Commercial VPN and proxy providers can influence the accuracy of IP-to-location databases – companies have the ability to manipulate location codes in router names. As a result, marketing materials may claim a large number of available user locations, while in reality, for cost-saving and reliability reasons, servers are physically located in a limited number of countries, even though the IP-to-location databases suggest otherwise.
To verify the actual location of the servers, researchers used an active geolocation algorithm. This algorithm assessed the roundtrip of a packet sent towards the server and other known hosts on the internet.
However, fewer than 10% of the tested proxies responded to pings, and due to understandable reasons, the researchers could not run any software to measure on the server itself. They could only send packets through proxies, making the roundtrip to any point in space the sum of the time it takes for the packet to travel from the test host to the proxy and from the proxy to the destination.
During the study, specialized software was developed based on four active geolocation algorithms: CBG, Octant, Spotter, and hybrid Octant/Spotter. The solution code on GitHub.
Since it was impossible to rely on IP-to-location databases, the researchers used the RIPE Atlas anchor host list for their experiments – information in this database is available online, constantly updated, and the documented locations are accurate. Moreover, hosts from the list continuously send ping signals to each other and update roundtrip data in the public database.
The solutions developed by the researchers comprise a web application that establishes secure (HTTPS) TCP connections over an unprotected HTTP port 80. If the server does not listen on this port, a failure will occur after one request; however, if the server listens on this port, the browser will receive a SYN-ACK response with a TLS ClientHello packet. This will trigger a protocol error, and the browser will display an error, but only after the second roundtrip.
Thus, the web application can measure the time of one or two roundtrips. A similar service has been implemented as a program that runs from the command line.
None of the tested providers disclose the exact location of their proxy servers. At best, cities are mentioned, but most often only the country information is available. Even when a city is specified, there can be mishaps – for example, researchers examined the configuration file of a server named usa.new-york-city.cfg, which contained instructions to connect to a server named chicago.vpn-provider.example. Thus, the server's affiliation to a specific country can only be confirmed with moderate accuracy.
Results
As a result of tests using an active geolocation algorithm, researchers managed to confirm the location of 989 out of 2269 IP addresses. In the case of 642 addresses, this was not possible, while 638 addresses were definitely not in the country they were claimed to be by the proxy services. More than 400 of these false addresses are actually located on the same continent as the stated country.
Valid addresses are located in countries that are most commonly used for server hosting (click image to open in full size)
Suspicious hosts were found among all seven tested providers. Researchers requested comments from the companies, but all declined to engage.
Source: habr.com
