Research: Torrent Proxies Full Scripts That Inject Malware

In some countries, Internet service providers block access to torrent sites, allowing users to use so-called proxy sites to visit blocked websites anyway. However, this is not without risk, says researcher Gabor Szathmári . The researcher analyzed some 6,000 websites that mirror for popular torrent sites are being blocked in Britain, such as The Pirate Bay and KickassTorrents.

The mirrors direct the traffic of visitors to the blocked torrent site. Of the 6,000 mirrors appeared to add 99.7% additional JavaScript to website traffic. In the vast majority of mirrors was about four or five additional scripts. A large part of these scripts contained malware or let users commit click fraud. Thus, for instance so-called updates for Adobe Flash Player and other video codecs offered. Only 0.3% of the proxies did absolutely nothing to do with the user's web traffic and left it intact.

"Several Internet providers block for copyright purposes led to the access popular torrent sites. Internet censorship has thousands of mirrors that provide access to the censored file sharing sites," said Szathmári. The researcher suggests that some of these mirrors are managed by well-meaning citizens, but that most money trying to make the situation by injecting unwanted ads, distribute malware and perpetrate let visitors click fraud.