Residential Proxy Traffic Found Exiting Through White House Network

Residential proxy traffic exited through the White House network 236 times over a 30-day period, according to research published on November 4 by New York-based detection firm Layer3 Intel. Twenty-eight separate residential proxy services could route traffic through six addresses registered to the Executive Office of the President. Residential proxies are services that sell access to everyday devices, so customers' traffic appears to come from that device's network. Layer3 recorded the exits on 26 of the 30 days between October 5 and November 3. Proxy detection services Spur and Synthient independently identified the addresses as residential proxy exits.

Layer3 said anyone could use the same exits by paying a few dollars to a public proxy service, and that it found the activity by chance. About half of it fell between 5pm and midnight Eastern Time. The firm said this pattern suggests a person using an infected device, rather than public guest Wi-Fi, with a proxy software development kit (SDK) installed. Layer3 stressed that its data shows the exits, not the device or person behind them. It did not report any compromise of White House systems, and it has shared its findings with a US federal agency.

The source notes that poorly secured proxy SDKs have allowed access to internal networks and lateral movement in the past, which is how earlier botnets spread. Layer3 cited Synthient research showing the Kimwolf botnet reached at least two million devices, mostly Android devices with an exposed Android Debug Bridge service.