  Free-proxies have been widespread since the early days of the Web, helping
users bypass geo-blocked content and conceal their IP addresses. Various proxy
providers promise faster Internet or increased privacy while advertising their
lists comprised of hundreds of readily available free proxies. However, while
paid proxy services advertise the support of encrypted connections and high
stability, free proxies often lack such guarantees, making them prone to
malicious activities such as eavesdropping or modifying content. Furthermore,
there is a market that encourages exploiting devices to install proxies.
  In this paper, we present a 30-month longitudinal study analyzing the
stability, security, and potential manipulation of free web proxies that we
collected from 11 providers. Our collection resulted in over 640,600 proxies,
that we cumulatively tested daily. We find that only 34.5% of proxies were
active at least once during our tests, showcasing the general instability of
free proxies. Geographically, a majority of proxies originate from the US and
China. Leveraging the Shodan search engine, we identified 4,452 distinct
vulnerabilities on the proxies' IP addresses, including 1,755 vulnerabilities
that allow unauthorized remote code execution and 2,036 that enable privilege
escalation on the host device. Through the software analysis on the proxies' IP
addresses, we find that 42,206 of them appear to run on MikroTik routers.
Worryingly, we also discovered 16,923 proxies that manipulate content,
indicating potential malicious intent by proxy owners. Ultimately, our research
reveals that the use of free web proxies poses significant risks to users'
privacy and security. The instability, vulnerabilities, and potential for
malicious actions uncovered in our analysis lead us to strongly caution users
against relying on free proxies.
