Residential Proxy Traffic Traced to White House Network
Layer3 Intel, a New York-based residential proxy detection firm, detailed the findings in research published on November 4.
Layer3 Intel, a New York-based residential proxy detection firm, detailed the findings in research published on November 4.
Residential proxies are services that sell access to everyday devices, letting customers send traffic through them so it appears to come from each device's network.
The addresses sit in AS2650, the block of internet addresses (autonomous system) registered to the Executive Office of the President, the federal agency that hosts the White House network.
Layer3 spotted the exits, recorded on 26 of the 30 days between October 5 and November 3, in its newly launched Residential Proxy Observatory.
Layer3 cross-checked the addresses against public lookup pages from proxy detection services Spur and Synthient, which independently identified them as residential proxy exits.
It found the activity by chance, while requesting ordinary global rotating access through these services.
Layer3 said that pattern suggested a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device was infected with a proxy software development kit (SDK).
Speaking to Infosecurity , Layer3 founder Sergiy Usatyuk said: Read more on residential proxy networks: Police and Tech Firms Team Up to Dismantle XCPE Botnet Layer3 did not report any compromise of White House systems.
Layer3 said anyone could route traffic out through the same addresses by signing up to a public residential proxy service and paying a few dollars.
Past research has shown that poorly secured proxy SDKs can allow access to internal networks and lateral movement, which is how past botnets have spread.
Layer3 cited Synthient research showing the Kimwolf botnet reached at least two million devices, mostly Android devices with an exposed Android Debug Bridge (ADB) service, through residential proxy networks.
What happened
Layer3 Intel, a New York-based residential proxy detection firm, detailed the findings in research published on November 4.
Residential proxies are services that sell access to everyday devices, letting customers send traffic through them so it appears to come from each device's network.
The addresses sit in AS2650, the block of internet addresses (autonomous system) registered to the Executive Office of the President, the federal agency that hosts the White House network.
What changed
Layer3 spotted the exits, recorded on 26 of the 30 days between October 5 and November 3, in its newly launched Residential Proxy Observatory.
Layer3 cross-checked the addresses against public lookup pages from proxy detection services Spur and Synthient, which independently identified them as residential proxy exits.
It found the activity by chance, while requesting ordinary global rotating access through these services.
Who is affected
Layer3 said that pattern suggested a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device was infected with a proxy software development kit (SDK).
Speaking to Infosecurity , Layer3 founder Sergiy Usatyuk said: Read more on residential proxy networks: Police and Tech Firms Team Up to Dismantle XCPE Botnet Layer3 did not report any compromise of White House systems.
Why it matters
Layer3 said anyone could route traffic out through the same addresses by signing up to a public residential proxy service and paying a few dollars.
Past research has shown that poorly secured proxy SDKs can allow access to internal networks and lateral movement, which is how past botnets have spread.
Technical details
Layer3 cited Synthient research showing the Kimwolf botnet reached at least two million devices, mostly Android devices with an exposed Android Debug Bridge (ADB) service, through residential proxy networks.
Attribution
Infosecurity Magazine: Layer3 Intel, a New York-based residential proxy detection firm, detailed the findings in research published on November 4.