Residential proxies detected on White House network

A new tool, the Residential Proxy Observatory, enables researchers to monitor residential proxy and anonymized internet activity globally. While examining this tool, the team discovered residential proxy exit activity on AS2650, which is linked to the Executive Office of the President, the organization responsible for maintaining the White House network.

Residential proxy services allow customers to route their internet traffic through residential devices, making it appear as though the traffic originated from those devices.

To ensure the discovery was not an isolated incident, the team cross-referenced the data with other residential proxy detection services, such as Spur and Synthient. These services independently identified the same public IP addresses as residential proxy exits. Any individual can obtain access to residential proxies by signing up for a public service, paying a small fee, and routing their requests through it.

The incident was uncovered inadvertently, as the researchers were merely testing global rotating access through these services.

The activity appears to be concentrated in the late evening, between 5 p.m. and midnight, with minimal traffic during early morning hours. This pattern suggests a persistent user rather than a public guest Wi-Fi network. The White House network is not the only unexpected location identified by the Observatory. In the South Atlantic territory of Saint Helena, Ascension, and Tristan da Cunha, the team recorded 413 addresses and over 32,000 observations, distributed between Starlink and the island's local internet provider, Sure Saint Helena.

Additionally, three observations were found in Antarctica, all originating from a Cloudflare WARP address associated with McMurdo Station.

These findings indicate that residential proxies can reach any part of the world, leaving threat actors with limited options for concealment. Past research has demonstrated that poorly secured proxy SDKs can facilitate internal network access and lateral movement, contributing to the proliferation of botnets. In a case study by Synthient, the Kimwolf botnet infiltrated at least 2 million devices, predominantly Android devices with a vulnerable ADB service, through residential proxy networks.

Consequently, if the devices on this White House network are susceptible to similar flaws, any entity purchasing proxy access could exploit it to gain entry to internal systems.