Researchers Find Residential Proxies on White House Network

Cybersecurity researchers have uncovered residential proxy services operating from the White House network, raising concerns about potential security risks. These proxies could allow cybercriminals to route traffic through official government IP addresses, potentially granting unauthorized access to sensitive systems. The discovery was made by security firms Layer3 Intel and Synthient, which identified suspicious proxy activity on AS2650, a network registered to the Executive Office of the President.

While no direct evidence of White House hacking was found, experts warn that this could provide a foothold for hackers to exploit vulnerabilities and gain an unmonitored backdoor into high-security networks. Residential proxies route internet traffic through consumer devices, often making it difficult to distinguish between legitimate and malicious activity.

In the past, residential proxies have been used for malicious purposes, such as malware attacks and identity theft. For the White House network, this could mean that hackers could probe infected devices and install malicious payloads. Researchers found that between October 5 and November 3, at least 28 residential proxy services were routing traffic through the White House network, with most activity occurring in the evenings between 5 p.m. and midnight EST. This suggests that the issue may stem from a compromised device connected to the network.

The White House has not commented on the findings. The vulnerability extends beyond the White House, as smart home devices often lack proper user oversight, making them easy targets for proxy exploitation. Proxies can infiltrate consumer devices through embedded networking code in apps, either through user consent or exploitation of unsecured access points.

This often occurs when users install apps with fine print consent clauses allowing proxy integration. Once installed, the proxy software runs continuously in the background, registering the device's IP with the proxy provider's gateway. To avoid such risks, experts recommend using reputable VPN services and monitoring IP addresses for suspicious activity.