For a few dollars, you could browse the internet from a White House IP address

Between October 5 and November 3, web requests from the analytics firm Layer3 Intel exited 236 times through the White House network. The company hacked nothing. It simply paid for "residential proxy" services, which resell internet access routed through the connections of individuals or businesses.

In a post published on November 4, Layer3 Intel says it observed these exits on six addresses in the AS2650 network, registered to the Executive Office of the President, the US presidency's administrative services. Twenty-eight different proxy services made it possible to get through, on 26 days out of 30. Such access can be bought for a few dollars, the company points out, adding that it made the discovery by chance. No reaction from the White House has been reported.

How does a residential proxy work?

These services route their customers' traffic through real connections, whether home or business. The website being visited believes it is dealing with an ordinary internet user. It is a common tool for cybercriminals, to the point that the FBI published an alert on these networks in March. The relay is often a device running a proxy software development kit (SDK), built into an application.

Traffic that starts in the evening

The pattern of this activity is telling. About half of the exits occur between 5 p.m. and midnight, Eastern time, and almost none early in the morning. For Layer3 Intel, this profile suggests a person's device rather than visitors' Wi-Fi. The company remains cautious: its data shows the exit points, it writes, "not the device or the person behind it."

Synthient, a young company that tracks these networks, goes further. According to SecurityWeek, it first linked the traffic to Windows 11 machines equipped with InfaticaSDK, Infatica's kit. This Singapore-based company claims access to more than 45 million IP addresses. On November 5, Synthient refined its lead on X: it spotted Windows 10 and 11 devices communicating with the Geonode, Infatica and Mellowtel kits, and believes with high confidence that the installed application is Rave, a shared-streaming app that includes twelve proxy kits, Gizmodo reports.

Should you be worried? The relayed traffic does not, on its own, give access to the device's files or to the internal network, Next reminds readers. But Layer3 Intel warns that poorly secured proxy kits can open access to the internal network. It cites a precedent, the Kimwolf botnet of compromised machines: at least 2 million devices, mostly running Android, according to Synthient's research.

Are your workstations acting as relays too?

If the US presidency's network is not immune, nothing guarantees that a corporate network is spared. These kits often come bundled with a free app, a "free" VPN or a TV box, installed with no ill intent.

• Check the reputation of your public IP addresses with services that track residential proxy exits, such as Spur or Synthient, the very ones Layer3 Intel used.
• Take inventory of the software installed on workstations and remove anything unauthorized, especially free VPNs and apps that offer to "share" your connection.
• Put personal devices and connected objects (TVs, TV boxes) on a network separate from workstations.
• Monitor unusual outbound connections, especially in the evening.

Layer3 Intel says it has saved its raw logs and is ready to hand them to the relevant agencies. It remains to be seen whether anyone in Washington will ask for them, and which device was serving as the relay.