Residential Proxy Exit Traffic Detected on White House Network 236 Times in 30 Days
Researchers at Layer3 Intel identified residential proxy traffic exiting through six IP addresses within AS2650, the autonomous system registered to the Executive Office of the President, which hosts the White House network. The firm's new Residential Proxy Observatory recorded 236 exit events across 26 of 30 days between October 5 and November 3, with traffic routable through at least 28 separate commercial residential proxy services. Independent lookup services Spur and Synthient corroborated the addresses as residential proxy exits. Layer3 found the activity by chance while using ordinary rotating residential proxy access and has not reported any compromise of White House systems, but has shared raw logs with a US federal agency.
Detalhes técnicos
About half of the observed exit activity occurred between 5pm and midnight Eastern Time, with minimal activity in early morning hours, a pattern Layer3 says is more consistent with a single device tied to a specific individual regularly on the network in the evening—rather than a shared guest Wi-Fi network. The firm attributes the behavior to a device infected with a proxy software development kit (SDK) that silently monetizes the host's internet connection by selling it as exit bandwidth. Layer3 cited prior Synthient research on the Kimwolf botnet, which compromised roughly two million devices—mostly Android devices with exposed Android Debug Bridge (ADB) services—via residential proxy networks, to illustrate how poorly secured proxy SDKs can enable lateral movement and deeper network access beyond simple traffic relaying.
Remediação
Layer3 noted that if the proxy SDK present on the affected device shares the vulnerabilities seen in other proxy-SDK-enabled botnets, it could potentially allow anyone purchasing proxy access to reach internal network systems. No further mitigation details were provided; Infosecurity Magazine has contacted the White House for comment.
Linha do tempo
-
Residential Proxy Exit Traffic Detected on White House Network 236 Times in 30 Days
ler a análise desta fonte ocultar
Researchers at Layer3 Intel identified residential proxy traffic exiting through six IP addresses within AS2650, the autonomous system registered to the Executive Office of the President, which hosts the White House network. The firm's new Residential Proxy Observatory recorded 236 exit events across 26 of 30 days between October 5 and November 3, with traffic routable through at least 28 separate commercial residential proxy services. Independent lookup services Spur and Synthient corroborated the addresses as residential proxy exits. Layer3 found the activity by chance while using ordinary rotating residential proxy access and has not reported any compromise of White House systems, but has shared raw logs with a US federal agency.
Technical Details
About half of the observed exit activity occurred between 5pm and midnight Eastern Time, with minimal activity in early morning hours, a pattern Layer3 says is more consistent with a single device tied to a specific individual regularly on the network in the evening—rather than a shared guest Wi-Fi network. The firm attributes the behavior to a device infected with a proxy software development kit (SDK) that silently monetizes the host's internet connection by selling it as exit bandwidth. Layer3 cited prior Synthient research on the Kimwolf botnet, which compromised roughly two million devices—mostly Android devices with exposed Android Debug Bridge (ADB) services—via residential proxy networks, to illustrate how poorly secured proxy SDKs can enable lateral movement and deeper network access beyond simple traffic relaying.
Remediation
Layer3 noted that if the proxy SDK present on the affected device shares the vulnerabilities seen in other proxy-SDK-enabled botnets, it could potentially allow anyone purchasing proxy access to reach internal network systems. No further mitigation details were provided; Infosecurity Magazine has contacted the White House for comment.