White House Network Compromised by Residential Proxy Services
Staff devices running proxy software expose sensitive government network infrastructure to public access.
1Unauthorized Network Exposure
Security researchers identified residential proxy nodes operating within the White House network, specifically the AS2650 address space. These services allow external users to rent internet addresses, effectively turning government-connected devices into exit nodes. This exposure enables anyone to route traffic through the Executive Office of the President's network anonymously.
2Persistent Proxy Activity
Layer3 Intel detected consistent proxy activity between October 5 and November 3, recording 236 exit events from the White House network. Most traffic occurred during evening hours, specifically between 5 p.m. and midnight. This pattern suggests that individual staff devices, rather than public guest Wi-Fi, are the primary source.
3Infatica and Russian Ties
Synthient linked the activity to Infatica, a proxy service often bundled with free mobile and desktop applications. Infatica’s founder, Vladimir Fomenko, previously operated King Servers, a hosting firm associated with 2016 cyberattacks against U.S. election systems. The presence of such software on government devices presents a significant security risk.
4Widespread Public Access
Researchers discovered that 28 separate residential proxy services could exit through the White House network. By paying a few dollars, any individual can obtain rotating access to these nodes. Experts emphasize that this is not a targeted breach but a systemic vulnerability accessible to any public proxy service customer.
5Mechanism of Infection
Proxy services often monetize software by embedding Software Development Kits (SDKs) into seemingly benign applications. When employees bring infected personal devices into the workplace, these SDKs beacon out, creating a bridge into the internal network. This allows third parties to bypass traditional security perimeters using legitimate-looking residential traffic.
6Lateral Movement Risks
Poorly secured proxy SDKs can facilitate lateral movement, allowing attackers to probe local networks for vulnerable systems. Past incidents, such as the Kimwolf botnet, demonstrated how these flaws enable large-scale device control. If a device on the White House network contains similar vulnerabilities, it could potentially expose internal systems.
7Broader Infrastructure Vulnerability
The issue extends far beyond the White House, with residential proxies detected in nearly 300 government networks, 318 utility companies, and 166 healthcare organizations. Security firm Infoblox reported that 65% of its customer base has queried proxy-related domains, highlighting the pervasive nature of this threat across critical global infrastructure.
8Global Reach of Proxies
Residential proxy infections have reached extreme locations, including remote islands and even research stations in Antarctica. As threat actors leverage these networks to anonymize malicious activity, researchers warn that no network is truly isolated. The White House has not yet provided a formal response regarding this security oversight.
Original article: Krebs on Security — White House Network Compromised by Residential Proxy Services