White House staff devices found running residential proxy software

Security firm Layer3 Intel says it found residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President (AS2650). The firm says the activity was fairly persistent between October 5 and November 3, and that proxies available from that network exited from the White House 236 times in that window.

The proxy tracking company Synthient attributed what it saw to multiple installations of Infatica, a proxy program often bundled into free mobile and desktop apps. Infatica's founder, Vladimir Fomenko, ran a hosting firm that KrebsOnSecurity describes as home to six of the eight addresses used by Russia's state security services to compromise election systems in Arizona and Illinois in 2016.

Layer3 Intel said the exit nodes came from six internet addresses, on 26 of the 30 days, mostly between 5 p.m. and midnight. It also said 28 separate residential proxy services could exit through the network. "This is public access," the team wrote, adding that it caught the activity by chance while requesting global rotating access.

The White House did not immediately respond to a request for comment. Nobody has said whether the staffers knew the software was there, and the reporting doesn't establish that anything was taken.

Residential proxies turn up on plenty of corporate and government networks, usually because an app on an employee device ships an SDK that resells bandwidth. For defenders, the check is dull but direct: look for proxy-related domains and outbound beaconing from staff devices, and look at what's installed on them.