Other

Web Monitoring: Anonymizers vs. Anti-Anonymizers

By Dave Gradijan

March 10, 2008 — CSO — By Fred Hapgood

In the mid-1990s a device appeared called the anonymizer. As the name suggests, this service allowed you to request files without disclosing your IP address. You would send the request to the anonymizer with the desired To: address tucked away on another field; it would strip out your address from the Reply field, replace it with its own, swap in the address of the destination server and send the request on. When the requested file was received, it would reverse the actions and (in theory) erase all evidence of the transaction, keeping your IP address a secret forever. Arbitrarily high degrees of security could be achieved by daisy-chaining two or more anonymizers.

When anonymizers appeared they were embraced as a pure good—a tool that defended against identity theft scams and allowed citizens suffering under oppressive regimes to use the Internet without fear, advancing human rights and the cause of progress. Among other considerations, in a world where data-retention policies were spreading and prosecutors in jurisdictions around the world seemed increasingly likely to file charges against foreign citizens for violating local ordinances, anonymization seemed only prudent. In time, distribution broke along the usual lines: open-source solutions, led by a program called TOR backed by the Electronic Freedom Foundation, and a proprietary segment of the industry, dominated by Anonymizer.com (which, given its name, prefers the term “non-attribution solutions”).

After a few years, however, a new side to the technology emerged, one that wasn’t quite so pure. “Non-attribution solutions” started to be used to spread worms and spam. People on blacklists for any reason—both good and bad—discovered that they could use the tools to evade detection. And employees found that anonymizers allowed them to surf the Internet freely at work, without their activities being detected or blocked by monitoring and control procedures. Some of these tools do, after all, make sense. According to sextracker.com, most porn traffic occurs during work hours. (To learn more about web monitoring, see CSO’s in-depth story "Keystroke Cops.")

All these more problematic usages have triggered a counter-industry and created something of an arms race between the anonymizers and the anti-anonymizers. One of the first anti-anonymizer ideas was to maintain a blacklist of the proxy sites and block requests from those sites. That worked for a while, but then the “non-attribution” sites just started changing their IP addresses, and their numbers grew out of control. (There might be