Security firms find residential proxy activity on White House network
Layer3 Intel and Synthient report residential proxy exit traffic on a network registered to the executive office of the US President. The Verge adds that 28 proxy services were seen between October 5 and November 3.
1 / 2
The story, neutrally told
Centre · 1The Residential Proxy Observatory, set up by Layer3 Intel to monitor anonymized network activity, identified proxy exit activity on AS2650, a network registered to the executive office of the US President and operated out of the White House. ComputerworldN “has identified proxy exit activity on one particular network, AS2650, which is registered to the executive office of the US President and operated out of the White House.” Read at Computerworld ↗ Mixed · 2Residential proxies route internet traffic through a home IP address so that it appears to come from somewhere else, letting users conceal where activity originates. ComputerworldN “mask the true source of internet traffic by rerouting it to appear to come from a different IP address” Read at Computerworld ↗ The VergeLC “allowing them to conceal where their activity is actually coming from” Read at The Verge ↗ Left · 1Layer3 Intel found that 28 residential proxy services routed traffic out of the White House network from October 5 to November 3, typically between 5PM ET and midnight. The VergeLC “Layer3 Intel found that 28 residential proxy services routed traffic out of the network from October 5th to November 3rd.” Read at The Verge ↗
Left · 1Layer3 said that pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the network late in the evening whose device is infected with a proxy SDK (software development kit). The VergeLC “That pattern suggests a person rather than a public guest Wi-Fi network” Read at The Verge ↗ Left · 1Synthient found Windows 10 and Windows 11 devices on the network beaconing to known proxy providers such as Geonode, Infatica and Mellowtel, and said the SDK might be linked to the watch party app Rave, which it says bundles 12 proxy SDKs. The VergeLC “a number of Windows 10 and Windows 11 devices on the White House’s network beaconing to known proxy providers like Geonode, Infatica and Mellowtel.”“bundles 12 proxy SDKs into the platform” Read at The Verge ↗ Left · 1The Verge, citing Krebs on Security, noted that Infatica was founded by Vladimir Fomenko, owner of King Servers, which was linked to 2016 cyberattacks on election systems in Illinois and Arizona. The VergeLC “Infatica is a proxy service founded by Vladimir Fomenko, the owner of King Servers, which was linked to 2016 cyberattacks on election systems in Illinois and Arizona.” Read at The Verge ↗
Left · 1Layer3 warned that access is public: anyone can sign up to a residential proxy service, pay a few dollars and send requests through it. The VergeLC “anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it.” Read at The Verge ↗ Centre · 1Computerworld said residential proxies are not illegal in themselves but can be used for illicit activity such as denial-of-service operations or malware distribution, and that the finding fits recent Infoblox research showing proxies are widespread in enterprises. ComputerworldN “While not illegal per se, residential proxies can be used by bad actors for activities that most definitely are illicit”“residential proxies were widespread throughout enterprises” Read at Computerworld ↗ Left · 1The Verge, citing Spur, said proxies have legitimate uses such as ad verification and quality assurance testing, while hackers have used them for botnets and account takeovers. The VergeLC “people can legitimately use residential proxies for purposes like ad verification and quality assurance testing” Read at The Verge ↗
Centre · 1The Observatory also found proxy activity on the island of St Helena. ComputerworldN “also found evidence of their activity on the island of St Helena” Read at Computerworld ↗
Every sentence links to the reporting it rests on. The pill in front of each says where its sources sit: Left, Centre or Right when one side supplies at least half of them, Mixed when they are evenly split. The number is how many outlets it cites.
Left1 outlet
- Framing
- Security-risk angle: leads on the accessibility of White House IP addresses to anyone for a few dollars, with detail on the findings and provider links.
- Emphasis
- Technical detail from Layer3 and Synthient, the Rave app link, and Infatica's founder's ties to King Servers.
- Leaves out or plays down
- Does not mention the wider enterprise prevalence of residential proxies.
- For example
-
“Someone at the White House appears to be running software that could enable outsiders to rent access on the presidential network for just “a few dollars,”” — The Verge
Centre1 outlet
- Framing
- Short explainer framing the find as one example of widespread residential proxy use.
- Emphasis
- Context that proxies are common in enterprises and not illegal per se.
- Leaves out or plays down
- Omits the 28 services, dates, evening pattern, and the Synthient and Rave findings.
- Charged language
- “A mole in the White House?”
- For example
-
“Residential proxies are often used by bad actors to hide the true source of internet traffic — and now one of them appears to have taken up residence in the White House.” — Computerworld
Right0 outlets
No right outlet in our sources has covered this story yet.
What every side reports
- Layer3 Intel found residential proxy activity on a White House network.
- Residential proxies mask the true source of traffic and can be used for both legitimate and malicious purposes.
Layer3 Intel organisation
Layer3 Intel says the activity pattern suggests a person's infected device and that the proxy access is public.
“anybody can obtain it by signing up to a public residential proxy service” — The Verge
Left1 article
-
Just about anyone can rent access to White House IP addresses
Critical Detailed report stressing that White House network access could be rented cheaply by anyone.
Centre1 article
-
A mole in the White House? Residential proxies are everywhere
Mixed Brief, lightly playful explainer that puts the White House finding in the context of widespread proxy use.
Right0 articles
No coverage yet.
- 6 Nov 15:10 First ComputerworldN A mole in the White House? Residential proxies are everywhere
- 6 Nov 17:40 +2h 30m The VergeLC Just about anyone can rent access to White House IP addresses
Times are when each article was published, or when we first saw it if the outlet gave no time.
Ask about this story
Loading…