Security researchers have found residential proxy activity on the White House network, suggesting that someone inside the presidential compound is running software that would let outsiders route internet traffic through its IP addresses for a few dollars. The findings come from the security firms Layer3 Intel and Synthient and were reported by Krebs on Security and The Register. The activity creates a path for anyone to obscure where their traffic originates by renting access to an address tied to the White House.
A residential proxy lets a user pay to send traffic through a home IP address, hiding the true origin of their activity. Some apps and browser extensions carry third-party software development kits that install proxy nodes on a device, whether or not the user is aware of them, and third-party services can then sell access to those proxies. Layer3 Intel found 28 residential proxy services routing traffic out of the White House network between October 5th and November 3rd, with the activity typically occurring between 5PM ET and midnight.
Layer3 said that pattern points to a person rather than a public guest Wi-Fi network, describing someone regularly on the White House network late into the evening whose device is infected with a proxy SDK. Synthient said the SDK in question might be linked to the watch party app Rave, which it says bundles 12 proxy SDKs into its platform. Synthient also found a number of Windows 10 and Windows 11 devices on the White House network contacting known proxy providers including Geonode, Infatica and Mellowtel.
Krebs on Security noted that Infatica was founded by Vladimir Fomenko, who owns King Servers, a company linked to 2016 cyberattacks on election systems in Illinois and Arizona. Layer3 warned that the residential proxy is publicly accessible, saying anyone can obtain it by signing up for a public residential proxy service, paying a few dollars and sending requests through it.
The cybersecurity firm Spur notes that residential proxies have legitimate uses such as ad verification and quality assurance testing. Bad actors can also use them to get around geolocation controls and defensive filters, and hackers have employed residential proxies for malicious activity including building botnets and carrying out account takeovers.
The discovery places a publicly rentable foothold inside the network used by the executive branch of the US government, at a time when proxy SDKs are being distributed through ordinary consumer apps and browser extensions. The researchers' findings describe activity observed on the network rather than any confirmed intrusion.
More software news from TechManNews.
