Access to White House IP addresses is being rented for proxy services

Software running on the White House network could potentially allow external users to rent access to its IP addresses for a nominal fee, according to reports from Krebs on Security and The Register. Research from security firms Layer3 Intel and Synthient identified residential proxy activity occurring within the presidential network.

A residential proxy allows individuals to route internet traffic through a specific home IP address, effectively masking the true origin of that activity. These proxies are often created when apps or browser extensions incorporate third-party software development kits (SDKs) onto a user’s device, often without the user's explicit awareness, allowing third-party services to sell access to those connections.

While cybersecurity firm Spur notes that residential proxies have legitimate uses like ad verification and quality assurance, they are also exploited by malicious actors to circumvent defensive filters and geolocation controls. Hackers frequently utilise these proxies for activities such as managing botnets and executing account takeovers.

Between October 5th and November 3rd, Layer3 Intel observed 28 residential proxy services routing traffic from the White House network, typically between 5PM ET and midnight. Layer3 stated, “That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK.” Synthient suggested that the watch party app Rave might be linked to this, noting the app “bundles 12 proxy SDKs into the platform.”

Synthient identified several Windows 10 and Windows 11 devices on the White House network communicating with proxy providers including Geonode, Infatica and Mellowtel. Krebs on Security reported that Infatica was established by Vladimir Fomenko, the proprietor of King Servers, a company previously connected to 2016 cyberattacks against election systems in Arizona and Illinois.

Layer3 cautioned that this residential proxy access is effectively “public access,” explaining that “anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it.”