Just about anyone can rent access to White House IP addresses

Someone at the White House appears to be running software that could enable outsiders to rent access on the presidential network for just “a few dollars,” as reported by Krebs on Security and The Register . That’s according to findings from the security firms Layer3 Intel and Synthient , which discovered residential proxy activity on the White House network.

What happened

That’s according to findings from the security firms Layer3 Intel and Synthient , which discovered residential proxy activity on the White House network.

Where the sources line up

A residential proxy opens up a way for people to rent access to a home IP address and route their internet traffic through it, allowing them to conceal where their activity is actually coming from. Some apps and browser extensions include third-party software development kits (SDKs) that put proxy nodes on a user’s device — whether users know it or not. Third-party services can then sell access to the residential proxies on users’ devices.

Practical impact for readers

At the White House, Layer3 Intel found that 28 residential proxy services routed traffic out of the network from October 5th to November 3rd. It notes that this activity typically happens between 5PM ET and midnight. “That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK,” Layer3 says. The SDK in question might be linked to the watch party app Rave, according to Synthient, which says the app “bundles 12 proxy SDKs into the platform.

Who should pay attention now

Synthient found “a number of Windows 10 and Windows 11 devices on the White House’s network beaconing to known proxy providers like Geonode, Infatica and Mellowtel. ” As noted by Krebs on Security , Infatica is a proxy service founded by Vladimir Fomenko, the owner of King Servers, which was linked to 2016 cyberattacks on election systems in Illinois and Arizona.

What is still unclear

Layer3 warns that the residential proxy is “public access,” adding that “anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it.

Source notes

The Verge