Someone running software on the White House network allowed outsiders to rent access to White House IP addresses for a few dollars, according to The Verge. Security firms Layer3 Intel and Synthient uncovered the residential proxy activity, which lets users conceal their real locations by routing internet traffic through other devices.
Key takeaways
- Layer3 Intel and Synthient found residential proxy activity on the White House network.
- Outsiders could rent access for a few dollars to route traffic and hide their true origin.
- Windows 10 and Windows 11 devices on the network were beaconing to proxy providers like Geonode, Infatica, and Mellowtel.
- The activity points to a device infected with a proxy SDK rather than public guest Wi-Fi.
How were White House IP addresses exposed to proxy rentals?
A residential proxy allows people to rent access to an IP address and route their web traffic through it. As reported by The Verge, some apps and browser extensions include third-party software development kits that put proxy nodes on user devices without clear knowledge. Cybersecurity firm Spur points out that while legitimate uses exist for ad verification, bad actors use them to bypass geolocation controls, create botnets, and carry out account takeovers.
Layer3 Intel discovered that 28 residential proxy services routed traffic out of the White House network between October 5th and November 3rd. This traffic usually happened between 5PM ET and midnight. Layer3 states that the timing suggests a person regularly on the network late into the evening whose device holds a proxy SDK, rather than a guest Wi-Fi network.
Connections to proxy software and services
Synthient linked the SDK in question to the watch party app Rave, which bundles 12 proxy SDKs into its platform. Windows 10 and Windows 11 devices at the White House beaconed to providers like Geonode, Infatica, and Mellowtel. The Verge notes that Infatica was founded by Vladimir Fomenko, the owner of King Servers, which had links to 2016 cyberattacks on election systems in Illinois and Arizona.
Why it matters
Anyone can obtain this access by signing up for a public residential proxy service, paying a few dollars, and sending requests through it. Layer3 warns that the setup is public access, meaning outsiders gained the ability to rent presidential network connections and obscure their web activity. The findings highlight how third-party SDKs inside common apps can accidentally turn secure institutional devices into proxy nodes for anyone willing to pay a small fee.
Frequently asked questions
A residential proxy opens up a way for people to rent access to a home IP address and route their internet traffic through it, allowing them to conceal where their activity is actually coming from.
The security firms Layer3 Intel and Synthient discovered the residential proxy activity on the White House network, as reported by The Verge and Krebs on Security.
Layer3 Intel found that 28 residential proxy services routed traffic out of the network from October 5th to November 3rd, typically occurring between 5PM ET and midnight.
Synthient stated that the SDK in question might be linked to the watch party app Rave, which bundles 12 proxy SDKs into the platform.
Windows 10 and Windows 11 devices on the White House network were found beaconing to known proxy providers such as Geonode, Infatica, and Mellowtel.
Based on reporting by The Verge. Read the original article
