Here’s a sentence I didn’t expect to type this week: for a few dollars, you could route your web traffic through the White House. Not metaphorically. Literally through a device sitting on the presidential network, with a White House IP address stamped on every request you make.
That’s the gist of what Layer3 Intel, a small security outfit, stumbled upon with its brand-new Residential Proxy Observatory. The White House residential proxy story sounds like a bad spy novel, but the mechanics behind it are depressingly mundane, and that’s exactly why you should care.
How a White House residential proxy even happens
Quick refresher. A residential proxy is a proxy service whose exit nodes aren’t boring datacenter servers but ordinary home connections. Marketers love them for ad verification, scrapers love them for dodging geo-blocks, and criminals love them because traffic coming from “a house in Virginia” looks a lot less suspicious than traffic coming from a bulletproof host in who-knows-where.
Where do those home connections come from? Mostly from people who never agreed to anything. App developers embed a “monetization SDK” in a free app or browser extension, and in exchange for a few cents, the user’s device quietly becomes an exit node for strangers. The FBI put out a warning about exactly this back in March. Nobody at the White House seems to have read it.
According to Layer3’s data, 28 different proxy services were exiting through the White House network almost daily between October 5 and November 3, for a total of 236 separate exits. The traffic peaked between 5 pm and midnight, Washington time. As The Register reported, that pattern points to a specific person, not guest Wi-Fi: someone who works late, on their own machine, with an infected app installed.
Another firm, Synthient, went further and spotted several Windows 10 and 11 devices on the network beaconing to known proxy providers, including Geonode, Mellowtel and Infatica. The likely culprit, they suggest, is a watch-party app called Rave that bundles no fewer than twelve proxy SDKs. Twelve. In an app for watching Netflix with your friends.
Why this is worse than it looks
You might think, fine, some staffer’s laptop is leaking bandwidth, who cares. The problem is that proxy SDKs have a track record of being written by people who don’t lose sleep over security. Layer3 puts it bluntly: “Past research has shown that poorly secured proxy SDKs can allow internal network access and lateral movement. If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems.”
Read that again. Anyone. Buying. Access. For a handful of dollars, through a public signup form. No zero-day required.
And there’s a detail that made me raise an eyebrow: Infatica was founded by Vladimir Fomenko, who also owns King Servers, a hosting company that got dragged into the 2016 attacks on election systems in Illinois and Arizona. I’m not saying there’s a conspiracy here. I’m saying the supply chain of “free” software is a lot shorter than you’d like between a bored employee and some very interesting people.
Layer3’s founder, Sergiy Usatyuk, says his logs only go back to July 10, but the activity was continuous for months and other detection services confirmed it independently. In other words, this has probably been going on for a good while. The last exit was spotted Wednesday night, hours after the blog post went live, and then it stopped. The State Department asked for the logs the next morning. The White House didn’t comment.
The lesson for the rest of us
If the most monitored network on the planet can host a proxy exit node for months without anyone noticing, your home office doesn’t stand a chance. And I’ve written before about how a single sketchy extension can hand over the keys, so this is the same movie with a bigger budget.
What I’d do, concretely: audit your browser extensions and uninstall the ones you don’t use (yes, the “free VPN” one too). Be deeply suspicious of free apps that need network permissions for no obvious reason. On your router or firewall, block outbound connections you can’t explain, and if you run something like Pi-hole, add the known proxy SDK domains to your blocklist. And for the love of everything, keep work and personal devices separate.
The White House just learned that “free” software has a price. Turns out the price was a seat on the presidential network, sold by the gigabyte.
Discover more from TechPassion
Subscribe to get the latest posts sent to your email.
