Security researchers find proxy traffic exiting the White House network

A proxy is a go-between. You send your internet traffic to it, and it passes the traffic on, so websites see the proxy's address instead of yours.

A residential proxy does the same thing, but it uses an ordinary home internet connection. To a website, the traffic looks like it comes from a normal person on a normal street.

Many of these services are legitimate. The most common use is web scraping, which means collecting public information from websites at scale. But the same trick is handy for people with worse plans.

The FBI warned in March that criminals use residential proxies to hide phishing (fake messages that trick you into giving up passwords), account takeovers, password guessing, data theft and malware delivery.

Layer3 launched a public tool called the Residential Proxy Observatory this week. It is a window onto data the company has collected for about a year.

Using it, Layer3 found proxy traffic leaving the network registered to the Executive Office of the President. The key numbers:

• 236 exits: separate times traffic left the White House network through a proxy, between October 5 and November 3.
• 28 services: distinct public residential proxy services involved.
• Nearly every day: the activity showed up almost daily in that window.
• Evenings: most of it ran between 5 pm and midnight, White House time.

Other proxy-detection services logged the same activity, Layer3 says. Its own data goes back to July 10, and its founder, Sergiy Usatyuk, says the activity was continuous for months.

A hotel or a visitor Wi-Fi would show traffic at random hours. Layer3 reads the evening pattern as a sign that someone who works there, not a guest, has a device quietly serving as an exit.

That device is probably running a proxy SDK. An SDK, or software development kit, is a bundle of ready-made code that app makers drop into their apps. A proxy SDK lets an app share your internet connection with a proxy network, and the app maker gets paid for it.

Layer3 has not named the device. Its data is not detailed enough to say how many machines are involved.

Security firm Synthient posted on X that it believes several Windows 10 and 11 machines on the network have the Infatica SDK installed. Infatica sells residential proxy access, and its SDK is one way it gets home connections to sell.

Riley Kilmer, a co-founder of the security firm Spur Intelligence, wrote in a LinkedIn post that other kinds of proxy companies also showed up on the network, including one called 9Proxy.

None of this is confirmed by the White House or by the companies named. It is the researchers' read of the traffic.

That is the real question. A proxy exit is more than a quirk, because of what a badly built SDK can allow.

Layer3 says past research shows poorly secured proxy SDKs can give access to a device's internal network, and can allow attackers to move from machine to machine. If an SDK on the White House network has that kind of flaw, Layer3 says anyone who buys proxy access could use it to reach internal systems.

In real life Think of renting out your front door. You earn a few dollars, but you have also given strangers a place to stand right next to everything inside.

The catch: there is no evidence that anyone has used the proxy path to attack White House systems. Experts say it could open the door, not that it did.

The White House did not respond to requests for comment. Usatyuk says the most recent proxy activity was Wednesday night, hours after Layer3 published its post, and that it has since stopped.

The US State Department contacted Layer3 on Thursday morning and asked for a copy of its logs. Usatyuk says he sent them over. In his words, "hopefully they've figured out the situation."

You do not need to be a government to be on the list. The FBI says criminals recruit ordinary devices in several ways:

• SDK partnerships: app makers get paid to add proxy code to their apps.
• Free VPNs: a VPN, a tool that hides your location, may bury a proxy clause in its terms.
• Infected devices: streaming boxes, digital picture frames, phones, tablets and routers can arrive infected or get infected later.
• Pirated software: cracked games and free streaming apps often carry hidden malware.
• Passive income schemes: apps that pay you for spare bandwidth.

Smart TVs and connected appliances rarely get checked by their owners. A single unvetted app or an old firmware update can turn a household of gadgets into an exit for a commercial proxy network. Firmware is the built-in software that runs a device.

Researchers have documented some large cases:

• MECOOL boxes: Synthient found more than 1.3 million streaming devices from the China-based maker MECOOL infected with proxy SDKs.
• A 2 million device botnet: earlier this year, Synthient documented one botnet that used a residential proxy to infect more than 2 million devices.
• Smart TV apps: a June report from Spur Intelligence found that roughly one in three apps on Samsung and LG smart TVs sold users' IP addresses.
• SocksEscort: the Justice Department charged this proxy service in March with compromising thousands of routers to file fraudulent unemployment insurance claims.

An IP address is the number that identifies your internet connection. Proxy networks sell it to anyone with a few dollars, and the buyer then looks like you.

Layer3 provides a free proxy checker that searches its database of more than 70 million proxies for your address. GreyNoise, another security company, offers a free IP lookup too.

These tools can tell you that proxy traffic is passing through your network. They cannot tell you which device is the cause, so you may need some detective work.

Good places to start are the usual suspects:

• Free VPN apps.
• Gaming apps you do not remember installing.
• "One price, no subscription" streaming boxes.
• Smart TVs with lots of free apps.

• Check your connection: run your home IP through a free proxy checker once, it takes a minute.
• Be wary of free: free VPNs and no-name streaming boxes often pay their bills by renting your connection.
• Update everything: keep the firmware on TVs, routers and other connected gadgets current.
• Use official app stores: the FBI says unofficial stores and pirated software are a common way in.