The White House is apparently a popular residential proxy exit spot
How it got there is another matter entirely
Recent reports have revealed that devices connected to the White House network may be functioning as residential proxy exit nodes, potentially exposing the sensitive network to security threats. Security firm Layer3 Intel discovered this illicit activity using their newly launched Residential Proxy Observatory tool. According to Layer3 founder Sergiy Usatyuk, the activity might have gone unnoticed without the new tool.
Residential proxies, which mask a user's location using IP addresses from residential internet connections, are commonly exploited by threat actors for malicious purposes such as concealing command-and-control (C2) infrastructure, conducting phishing attacks, sending spam, and disguising malicious traffic.
Between October 5 and November 3, Layer3's data shows that 28 distinct residential proxy services exited into the White House network nearly every day, with a total of 236 separate exits. Most of the activity occurred between 5 pm and midnight, suggesting that an infected device within the White House network is likely serving as an exit node, possibly through a compromised proxy software development kit (SDK).
If this is confirmed, it poses a serious security risk, as poorly secured proxy SDKs can allow internal network access and lateral movement, enabling attackers to infiltrate sensitive government systems.
Layer3's data has been independently verified by other residential proxy detection services, indicating that the White House's IP addresses have been utilized by proxy networks for malicious activities for an extended period. However, Usatyuk cannot determine the exact number of devices being used as exit nodes within the White House network.
He suggests that the Infatica SDK, which allows app developers to monetize users' internet connections by turning devices into residential proxy exit nodes, may be installed on multiple Windows 10 and 11 devices at the White House. This software could potentially provide attackers with an entry point into internal systems if vulnerable.
The US State Department has requested a copy of Layer3's logs to investigate the situation, which Usatyuk has already forwarded to them. The White House has not responded to inquiries regarding this matter.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
