Researchers detect residential proxies on the White House network
A cybersecurity firm has found residential proxies running on the White House's internal network, potentially exposing other devices and systems to cyberattacks.
In a blog post on Wednesday, network security company Layer3Intel said it discovered evidence of resproxies on the network run by the Executive Office of the President, or EOP, the office of top officials and staff in the president's inner circle. The company said that it observed resproxy activity on the government network throughout October and into November.
That means at least one device on the network allows outsiders to access the White House's network.
Residential proxies, or resproxies, let other people to share your internet connection via a device that's already on the same residential home or office network. Resproxies rely on code buried in the software of always-on devices, from Android TV set-top boxes, off-brand consumer gadgets like digital photo frames, and phone apps, to allow anyone with a credit card to piggyback off of the same Wi-Fi network. Some use resproxy services to scrape internet data for training AI models. Hackers also use resproxies to hide their malicious activity to carry out cyberattacks. Worse, a resproxy can also be abused to compromise other devices on the network. All to say, resproxies are a growing problem — and especially for sensitive government networks, like the White House.
Layer3Intel verified its findings by checking with other resproxy detection companies, like Spur and Synthient, which also confirmed the activity.
Sergiy Usatyuk, the founder of Layer3Intel, tells me that 28 resproxy providers are selling access to the White House's network, but that it's difficult if not impossible to attribute to a specific provider given the overlaps and reselling across the resproxy industry.
It's unclear who exactly in the White House has the device that's running the resproxy code, but the company offered some clues from the data:
"Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK."
(I mean, we could guess the person...)
Resproxies are difficult to defend against, especially when you have a large number of people who bring in devices from the outside world and connect to the same Wi-Fi. But with a foothold already on the network, likely someone's phone or TV streaming box, Layer3Intel warns that "anyone buying proxy access could use it to reach internal systems."
A spokesperson for the White House did not respond to my request for comment about whether it was aware of the issue or if it plans to take action.
Zack Whittaker
Thank you so much for reading ~this week in security~. If you like this article, please share a link on your social media! Reach out with any feedback or comments about this article: this@weekinsecurity.com.
