- Published on
Want to Rent an Internet Address at the White House?
- Authors
- Name
- DeepHorus
White House staffers have been using computers and mobile devices that run residential proxy software, exposing internet addresses reserved for the Executive Office of the President to commercial rental, security researchers said. Layer3 Intel reported that multiple proxy nodes beaconed from AS2650, the White House network. The activity was persistent from October 5 to November 3.
The firm said proxies available from AS2650 exited the White House network 236 times during that period. Activity came from six internet addresses and appeared on 26 of 30 days. Most traffic occurred between 5 p.m. and midnight.
Synthient attributed the activity to multiple Windows 11 installations of Infatica, a proxy program often bundled into free apps. Infatica founder Vladimir Fomenko also founded King Servers. That hosting firm held six of eight internet addresses Russian state security services used to compromise Arizona and Illinois election systems in 2016.
Layer3 Intel found 28 separate residential proxy services could exit through the White House network. The team said it did not target AS2650. It caught the activity by chance while requesting global rotating access.
Such services let customers rent someone else’s internet address for a few dollars. To a website, traffic appears to come from the rented address, not the customer. Researchers said the arrangement is public and requires no special access.
Ben Brundage, founder of Synthient, told KrebsOnSecurity some resellers sell bandwidth for as little as 60 cents per gigabyte. He said less than a dollar can buy access into trusted networks. The reseller ecosystem can also let criminals skip Know Your Customer checks.
The White House did not immediately respond to a request for comment. Experts say organizations should inventory endpoint software, block proxy SDKs and monitor outbound traffic. The findings will likely intensify scrutiny of proxy providers and bundled software.
