Someone Using White House Network May Have a Compromised Device Allowing Strangers to Route Traffic, Researchers Warn

Someone regularly using the White House internet network may unknowingly be operating a compromised device that allows strangers to route their internet traffic through the sensitive government infrastructure, researchers have warned.

An investigation by Layer3 Intel found 236 separate residential proxy exits from the AS2650 autonomous system registered to the Executive Office of the President, the federal agency that hosts the White House network, between 5th October and 3rd November.

The findings suggest that a device connected to the network could be running residential proxy software, potentially without its owner's knowledge. However, researchers have not identified the device or individual involved, and their investigation does not establish that White House systems have been breached.

Layer3 Intel made the discovery while examining data from its newly launched Residential Proxy Observatory, which provides researchers with a global view of residential proxy and anonymised internet activity.

Note that the activity originated from six IP addresses and appeared on 26 of the 30 days examined, with researchers finding 28 residential proxy services capable of routing traffic through the network. Layer3 Intel cross-referenced the addresses with other residential proxy detection services to confirm the reliability of their findings.

Residential proxy services allow paying customers to route their internet traffic through ordinary devices connected to residential or other networks, making their requests appear to originate from the network hosting those devices rather than from the customers' actual locations.

Layer3 Intel stressed that the discovery was accidental. Its researchers were not specifically targeting the White House network or attempting to force their probes through it. Instead, they encountered the activity while requesting access through globally rotating residential proxy services.

Evening Activity Raises Questions About Regular White House Network User

Layer3 Intel found that roughly half of the recorded proxy exits occurred between 5 p.m. and midnight Eastern time, with almost no activity during the early morning hours. Researchers said this pattern suggested a device belonging to someone who regularly uses the White House network, rather than activity originating from a public guest Wi-Fi hotspot.

However, this remains a theory rather than an established finding. Layer3 Intel explicitly cautioned that its data identifies proxy exit points, not the specific devices or individuals behind them.

The bigger concern is what outsiders can do if the device responsible for the proxy activity is running vulnerable software. Residential proxy software is sometimes distributed through software development kits (SDKs) embedded in seemingly legitimate applications. Users may unknowingly agree to share their devices' internet connections when installing free applications or other software.

Poorly secured SDKs can introduce serious security vulnerabilities, particularly when installed on devices connected to sensitive networks. Layer3 Intel warned that weaknesses in proxy software could potentially allow outsiders purchasing proxy access to reach internal network segments and probe for vulnerable systems.

If an exposed device has access to other parts of an organisation's network, attackers could potentially exploit that connection to move laterally, increasing the risk of unauthorised access to internal infrastructure.

The researchers pointed to previous work by Synthient on the Kimwolf botnet, which demonstrated how vulnerabilities involving residential proxy SDKs and exposed Android Debug Bridge services enabled attackers to spread across roughly two million compromised devices.