Security Researchers Discover Residential Proxy Activity on White House Network
Security firms Layer3 Intel and Synthient have identified residential proxy activity originating from the White House network. The findings suggest that devices within the presidential network are routing internet traffic through third-party services, effectively allowing outsiders to rent access to White House IP addresses for a small fee. This activity typically occurs between 5:00 PM ET and midnight, suggesting an individual user's device may be infected with a proxy Software Development Kit (SDK). The vulnerability is believed to stem from third-party SDKs bundled within applications like the watch party app Rave. While residential proxies have legitimate uses in ad verification, they are frequently exploited by bad actors to bypass geolocation controls and conduct malicious activities such as botnet creation and account takeovers. One identified provider, Infatica, has historical links to cyberattacks on U.S. election systems.
Topics: cybersecurity network security residential proxies White House