Whether through malware or other means, devices associated with the White House network appear to be serving as residential proxy exit nodes, potentially posing security risks to one of the world’s most sensitive networks. News of the security snafu comes from security firm Layer3 Intel, which reported this week that it discovered the likely illicit activity thanks to its recently launched Residential Proxy Observatory. According to Layer3 founder Sergiy Usatyuk, the White House residential proxy activity might have gone unnoticed if not for the new tool. “The observatory is just a public interface to explore the data we’ve been collecting for the past year,” Usatyuk told The Register in an email. For those unfamiliar with residential proxies, they’re like any old proxy network that obfuscates the location of a user, except in this case their exit nodes use IP addresses associated with residential internet connections, as opposed to datacenters. While many are legitimate, others are exploited by threat actors and used in the commission of cybercrimes, as the FBI warned earlier this year. The FBI bulletin, put out in March, warns users to protect their systems against hijacking via malware, illicit SDK partnerships, VPNs with hidden service terms that repurpose user computers as exit nodes, and other threats used to turn victims into nodes without their consent. Residential proxies are commonly used by threat actors to conceal command-and-control (C2) infrastructure, conduct phishing attacks, send spam, disguise malicious traffic, and the like, the FBI explained. According to Layer3, its data shows 28 distinct residential proxy services exiting into the White House network nearly every day between October 5 and November 3, with 236 separate exits in that period. Other residential proxy detection services logged the same information, Layer3 said. Most of the activity was happening in the evening, White House time, between 5 pm and midnight. That, Layer3 said, suggests someone at the White House – not a guest – has an infected device that’s serving as an exit, likely via an infected proxy SDK. If correct, that’s a problem. “Past research has shown that poorly secured proxy SDKs can allow internal network access and lateral movement,” Layer3 explained. “If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems.” In other words, this is a serious security risk, and one Usatyuk tells us could have been a problem for a while. “Our data retention period goes back to July 10,” the Layer3 founder explained. “Given that there was continuous activity for a matter of months and other res proxy detection services independently verified the data, it’s likely that White House IPs have been used by res proxy networks for all sorts of activity for some time now.” Usatyuk said his firm’s data isn’t detailed enough to know how many machines are being used as exit nodes inside the White House network. He pointed us to an X post from security firm Synthient, which said it believes there are multiple Windows 10 and 11 devices on the White House network that likely have the Infatica SDK installed on them. Infatica offers a software development kit (SDK) that allows app developers to monetize users’ internet connections by turning their devices into residential proxy exit nodes. The possibility that this software is running on devices associated with the White House network raises serious security concerns: Vulnerable proxy software could potentially provide attackers with a route into internal systems. Usatyuk told us that the most recent residential proxy activity on the White House network occurred Wednesday night, “hours after the blog went live,” but has since stopped. The US State Department contacted Layer3 Thursday morning to request a copy of the company’s logs, which Usatyuk tells us he’s sent over. “Hopefully they’ve figured out the situation,” Usatyuk added – and hopefully before any government secrets have been exposed. The White House didn’t respond to questions for this story.®
