Residential Proxy Traffic Traced to White House Network

Residential proxy traffic has exited through the White House network 236 times over a 30-day period, with 28 separate residential proxy services able to route traffic through six of its addresses.

Layer3 Intel, a New York-based residential proxy detection firm, detailed the findings in research published on November 4. Residential proxies are services that sell access to everyday devices, letting customers send traffic through them so it appears to come from each device's network.

The addresses sit in AS2650, the block of internet addresses (autonomous system) registered to the Executive Office of the President, the federal agency that hosts the White House network. Layer3 spotted the exits, recorded on 26 of the 30 days between October 5 and November 3, in its newly launched Residential Proxy Observatory.

Layer3 cross-checked the addresses against public lookup pages from proxy detection services Spur and Synthient, which independently identified them as residential proxy exits.

Evening Pattern Suggests a Single Device

Layer3 said anyone could route traffic out through the same addresses by signing up to a public residential proxy service and paying a few dollars. It found the activity by chance, while requesting ordinary global rotating access through these services.

half of the activity fell between 5pm and midnight Eastern Time, with almost none in the early morning.

Layer3 said that pattern suggested a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device was infected with a proxy software development kit (SDK).

"Our data shows the exits, not the device or the person behind them," the firm wrote.

Speaking to Infosecurity , Layer3 founder Sergiy Usatyuk said: “The most recent activity was recorded in the evening of November 4; hopefully, it stops soon!”

No Compromise Reported, but Proxy SDKs Carry Risk

Layer3 did not report any compromise of White House systems. It said it has backed up the raw logs of the activity and has shared their finfings with a US federal agency.

Past research has shown that poorly secured proxy SDKs can allow access to internal networks and lateral movement, which is how past botnets have spread.

Layer3 cited Synthient research showing the Kimwolf botnet reached at least two million devices, mostly Android devices with an exposed Android Debug Bridge (ADB) service, through residential proxy networks.

If an SDK on the White House network had the same kind of flaw, Layer3 said, anyone buying proxy access could use it to reach internal systems.

Infosecurity has contacted the White House for .