Residential proxy activity found on White House network

Security researchers have detected residential proxy activity on the White House network. According to findings from the security firms Layer3 Intel and Synthient, software running on a device in the network may allow outsiders to reach the internet through the White House network for a small fee.

The cause appears to be a proxy component on a connected device that exposes the device's IP address for use by third parties. Layer3 Intel stresses that the access is open to the public: anyone who signs up for a proxy service and pays a few dollars can send requests this way.

What residential proxies are and how they work

A residential proxy rents out a home user's IP address so that internet traffic can be routed through it, hiding the sender's real location. Some apps and browser extensions can plant a proxy node on a user's device through third-party software development kits (SDKs), often without the user's knowledge. Proxy services can then sell access through those devices.

As the security firm Spur has noted, residential proxies can serve legitimate purposes such as ad verification and quality assurance testing. Malicious actors can also use them to bypass geographic restrictions and protective filters. Botnet building and account takeover attacks are among the examples of abuse.

What the researchers found

According to Layer3 Intel's data, 28 residential proxy services were observed sending traffic out of the White House network between October 5 and November 3. The activity was reportedly concentrated between 5 p.m. and midnight Eastern time. The firm believes that pattern points less to an open guest Wi-Fi network than to a person who stays on the network into the late evening and whose device is infected with a proxy SDK.

Synthient, for its part, said some Windows 10 and Windows 11 devices on the network were sending signals to well-known proxy providers such as Geonode, Infatica and Mellowtel. The firm says the SDK in question may be linked to the co-watching app Rave, and that it has found 12 proxy SDKs bundled into the app's platform.

One provider has drawn attention before

Of the providers named, Infatica was reportedly founded by Vladimir Fomenko, the owner of King Servers. King Servers was linked to the 2016 cyberattacks on election systems in Illinois and Arizona.

Layer3 Intel's warning is that this proxy access is open to the public: anyone who signs up for the service and pays a few dollars can send their requests through it.