Just about anyone can rent access to White House IP addresses

Someone at the White House appears to be running software that could enable outsiders to rent access on the presidential network for just “a few dollars,” as reported by Krebs on Security and The Register. That’s according to findings from the security firms Layer3 Intel and Synthient, which discovered residential proxy activity on the White House network.

A residential proxy opens up a way for people to rent access to a home IP address and route their internet traffic through it, allowing them to conceal where their activity is actually coming from. Some apps and browser extensions include third-party software development kits (SDKs) that put proxy nodes on a user’s device — whether users know it or not. Third-party services can then sell access to the residential proxies on users’ devices.

As noted by the cybersecurity firm Spur, people can legitimately use residential proxies for purposes like ad verification and quality assurance testing, but bad actors can also use them to bypass geolocation controls and defensive filters. Hackers have used residential proxies for all kinds of malicious activity, including to create botnets and carry out account takeovers.

At the White House, Layer3 Intel found that 28 residential proxy services routed traffic out of the network from October 5th to November 3rd. It notes that this activity typically happens between 5PM ET and midnight. “That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK,” Layer3 says. The SDK in question might be linked to the watch party app Rave, according to Synthient, which says the app “bundles 12 proxy SDKs into the platform.”

Synthient found “a number of Windows 10 and Windows 11 devices on the White House’s network beaconing to known proxy providers like Geonode, Infatica and Mellowtel.” As noted by Krebs on Security, Infatica is a proxy service founded by Vladimir Fomenko, the owner of King Servers, which was linked to 2016 cyberattacks on election systems in Illinois and Arizona.

Layer3 warns that the residential proxy is “public access,” adding that “anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it.”