Residential proxy traffic caught leaving the White House network
The White House network has been working as an exit point for residential proxy services, a setup that may open a path into one of the most closely guarded networks in the world, Layer3 Intel found.
The White House network has been working as an exit point for residential proxy services, a setup that may open a path into one of the most closely guarded networks in the world, Layer3 Intel found.
In a blog post, the threat intelligence firm reported that its proxy enumeration pipeline exited through AS2650, the network registered to the Executive Office of the President, 236 times between October 5 and November 3.
The exits came from six addresses on 26 of those 30 days, and 28 separate residential proxy services offered the route.
Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device’s network.
Here, customers’ traffic would appear to come from inside the White House.
Its staff spotted the activity while looking through the company’s Residential Proxy Observatory, simply by requesting global rotating access through the proxy services.
Or at least some that are providing residential proxy access to botnets, security researcher Matt Johansen posted on X.
Layer3 cited past research showing that poorly secured proxy SDKs can give outsiders access to internal networks and let them move laterally.
In A Broken System Fueling Botnets, the researchers at Synthient documented how the Kimwolf botnet reached at least 2 million devices, mostly Android devices with an exposed ADB service, through residential proxy networks, the company wrote.
To rule out a fluke, they checked the addresses against other proxy detection services, whose public IP pages independently flag them as residential proxy exits.
What happened
The White House network has been working as an exit point for residential proxy services, a setup that may open a path into one of the most closely guarded networks in the world, Layer3 Intel found.
In a blog post, the threat intelligence firm reported that its proxy enumeration pipeline exited through AS2650, the network registered to the Executive Office of the President, 236 times between October 5 and November 3.
The exits came from six addresses on 26 of those 30 days, and 28 separate residential proxy services offered the route.
Who is affected
Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device’s network.
Here, customers’ traffic would appear to come from inside the White House.
Why it matters
Its staff spotted the activity while looking through the company’s Residential Proxy Observatory, simply by requesting global rotating access through the proxy services.
Or at least some that are providing residential proxy access to botnets, security researcher Matt Johansen posted on X.
Technical details
Layer3 cited past research showing that poorly secured proxy SDKs can give outsiders access to internal networks and let them move laterally.
In A Broken System Fueling Botnets, the researchers at Synthient documented how the Kimwolf botnet reached at least 2 million devices, mostly Android devices with an exposed ADB service, through residential proxy networks, the company wrote.
Response
To rule out a fluke, they checked the addresses against other proxy detection services, whose public IP pages independently flag them as residential proxy exits.
Attribution
Help Net Security: The White House network has been working as an exit point for residential proxy services, a setup that may open a path into one of the most closely guarded networks in the world, Layer3 Intel found.