White House Network Appears in Residential Proxy Data
A security firm says devices on the White House network have acted as residential proxy exit nodes. The White House did not answer questions.
Security firm Layer3 Intel says devices tied to the White House network seem to be acting as exit nodes for residential proxies. Whether by malware or some other route, that could expose one of the most sensitive networks in the world.
Timeline and response
Layer3's data goes back to July 10. Given continuous activity for months, founder Sergiy Usatyuk says White House IPs have likely been used by these networks for some time. The latest activity came Wednesday night, hours after Layer3 published its blog, and has since stopped.
On Thursday morning the State Department got in touch with Layer3 and asked for its logs. Usatyuk says he sent them. The White House did not respond to The Register's questions.
What a residential proxy is
A proxy network hides where a user really is. In a residential one, the exit nodes use IP addresses tied to home internet connections instead of datacenters, so the traffic looks like it comes from an ordinary household. Many such services are legitimate. Others are abused by threat actors, as the FBI warned in a March bulletin.
That bulletin says criminals use them to cover command-and-control infrastructure and to mask phishing, spam and other malicious traffic. It also lists ways people end up as nodes without consent: malware, illicit SDK partnerships and VPNs whose concealed terms of service turn users' computers into exit nodes.
Evening hours and a likely SDK
Layer3 counted 236 separate exits from 28 distinct residential proxy services into the White House network. The traffic showed up almost every day from October 5 to November 3, and other residential proxy detection services logged the same. Layer3 says its Residential Proxy Observatory, launched recently, made this visible. The observatory is a public view of data it has gathered for a year.
Most of the activity fell between 5 pm and midnight, White House time. Layer3 reads that as a sign that someone working there, not a visitor, has an infected device acting as an exit, probably through a proxy SDK. An SDK is a software kit that app developers bundle into their programs.
Why Infatica comes up
Layer3 cannot tell how many machines act as exit nodes. It pointed The Register to an X post by the firm Synthient, which believes multiple Windows 10 and 11 devices on the network likely have the Infatica SDK installed. Infatica's kit lets app developers earn money from users' connections by turning their devices into exit nodes.
The worry is lateral movement. Layer3 notes that earlier research found weakly secured proxy SDKs can open the way into an internal network. If an SDK here has the same flaw, anyone buying proxy access could reach internal systems.
Source: The Register