In 2013 I wrote an article about how to turn a Squid proxy into a code injection attack mechanism [1] (which many free proxies did at the time [2]). The most "harmless" would just replace the ads you see with their own, the worse ones used browser events to report all keystrokes or mouse positions to the attackers.
[1] https://blog.haschek.at/2013/05/why-free-proxies-are-free-js...
[2] https://blog.haschek.at/2015-analyzing-443-free-proxies/
It's hard to ignore when randos are screwing with you in real-time.
I'm sorry that open view of the internet ended, but it also ended far later than it should have by rights.
One of the slightly more subtle tricks that took a long time for people to identify was to modify ad banners so that they pointed to another provideur. Servers were fixed, image sizes were standardised, etc. This also required much less computing power and bandwidth.
There's a student residence that displayed a lot of ads for Bible studies and gay porn about fifteen years ago.
This wouldn't work nowadays if the majority of traffic was encrypted using TLS and authenticated using certificates.
https://web.archive.org/web/20060315081659/http://www.ex-par...
