Researchers Caught Residential Proxies Exiting the White House Network 236 Times
Residential Proxies Detected on White House Network
Layer3 Intel's new Residential Proxy Observatory flagged residential proxy exits on AS2650, the network registered to the Executive Office of the President: 236 exits from 6 addresses across 26 days, through 28 separate proxy services. Spur and Synthient confirm the addresses. Activity clusters in the evening, pointing to an infected device on the network rather than guest Wi-Fi. The same scan found proxies in Antarctica, Saint Helena and Pitcairn.
This is public access. Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it.
- dhosek
They’re too polite to say it explicitly, but when they say:
> Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.
There really aren’t very many candidates for who that person might be and it really seems like it would be someone who, I don’t know, maybe lives where the traffic is originating.
- btown
The danger here, of course, is that while these compromised devices are currently being monetized in a relatively benign way (other than bandwidth costs to the user, which to be sure can be nontrivial)… it would be naive to assume that there isn't a Command and Control capability that can assign less benign tasking - or can be compromised to do so.
This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…
- XnoiVeX
It's incorporated into a lot of consumer devices legally. https://brightdata.com/proxy-types/residential-proxies
- lakeviewterrace
So they don't actually know what this network is, just who owns the IP space... time for a blog post to advertise our week-old service!
There is no evidence that physically ties this to the WH. It could be in a security lab for all they know. Or a guest network for the news media.
- bronco21016
Gotta have your SuperBox set up to watch 24 hr cable news working late into the night.
- hackernud3s
Those are better than residential proxies. Those are White House proxies. I would pay $10/GB for those babies.
- seethishat
I have T-mobile 5g. My IP shows up as a residential proxy. I can't control the T-Mobile 5g device. It's a black-box. And, I only have one Linux desktop on the home network (so no Windows/Mac malware).
Not sure why my IP is listed as a residential proxy.
- j2kun
Out of curiosity, how would I check my own device for a residential proxy?