Commercial proxy services sent internet traffic out through computers on the White House network more than 200 times in a single month, security researchers say. The finding means anyone paying for those services could have made their online activity appear to come from the president's executive office.
Layer3 Intel says six IP addresses on AS2650, the network assigned to the Executive Office of the President, served as exit points for at least 28 residential proxy services from Oct. 5 through Nov. 3. The firm's own testing routed traffic out through the network 236 times during that window.
Nearly all of that activity came between 5 p.m. and midnight Eastern time, with almost nothing in the early morning hours. Layer3 Intel said the schedule points not to a public guest Wi-Fi connection but to one person who stays on the network late and whose device carries proxy software.
Synthient, a startup that tracks proxies, VPNs and bot infrastructure, said the traffic originates from Windows 11 computers running a software kit made by Infatica. Its researchers singled out Rave, an app for watching streaming services with friends, as the probable way the code got onto those machines.
Infatica, based in Singapore, says it offers access to more than 45 million IP addresses around the world. Its founder, Vladimir Fomenko, also owns King Servers, a hosting company whose servers were used by hackers in 2016 attacks on election systems in Arizona and Illinois.
Infatica was not the only proxy company detected. Riley Kilmer, who co-founded Spur Intelligence, said on LinkedIn that several kinds of proxy firms had turned up on the network, among them 9Proxy, a service popular with criminals committing banking fraud.
Researchers have found no sign that the proxy access was used to attack the White House. Experts warn, however, that such a setup could let hackers probe for weaknesses or give outsiders an unwatched entry point into sensitive systems.
It basically gives them a foothold on a network where previously nobody was getting into the White House network,
Sergiy Usatyuk, Layer3 founder
Usatyuk, the Layer3 founder, has his own history with such attacks: he admitted guilt in a 2019 federal case over websites he ran that carried out DDoS attacks.
The software kits behind these services are often bundled into free apps by developers seeking extra income, quietly turning a phone or computer into a relay point. Proxy networks then let paying customers route their requests through those devices.
Layer3 Intel says the problem is global, logging 413 proxy addresses on the remote island of St. Helena alone. Separate research by Infoblox has found residential proxies spread widely across corporate networks.
