White House Network Allows Outsiders to Rent IP Access for a Few Dollars
Security firms found that 28 proxy services routed traffic through presidential computers, likely due to a popular watch party app.
By Emmanuel Obasi ·
Outsiders can currently rent access to Internet Protocol addresses on the White House network for a few dollars, according to findings from security firms Layer3 Intel and Synthient. The discovery reveals that residential proxy software is running on devices within the presidential compound, allowing external parties to route their web traffic through the government's infrastructure.
A residential proxy acts as a middleman that lets users hide their true location by routing traffic through a home IP address. While legitimate uses include ad verification and quality assurance testing, the technology also enables bad actors to bypass geolocation controls and defensive filters. Hackers frequently use these proxies to build botnets and steal accounts.
Layer3 Intel identified 28 distinct residential proxy services sending traffic out of the White House network between October 5 and November 3. The activity typically occurred between 5 p.m. and midnight Eastern Time. Layer3 noted that this specific time pattern suggests a single person was using an infected device late into the evening rather than a public guest Wi-Fi network.
Synthient attributed the issue to a watch party app called Rave. The firm reported that the app bundles 12 proxy SDKs, which are software development kits that install proxy nodes on user devices. This setup allows third-party services to sell access to the connected devices, often without the user's explicit knowledge.
Synthient also found numerous Windows 10 and Windows 11 devices on the White House network beaconing to known proxy providers. These providers include Geonode, Mellowtel, and Infatica. Infatica is particularly notable because its founder, Vladimir Fomenko, owns King Servers. King Servers was linked to cyberattacks on election systems in Illinois and Arizona in 2016.
Layer3 Intel described the setup as public access. The firm explained that anyone can obtain this access by signing up to a public residential proxy service, paying a small fee, and sending requests through the compromised IP addresses. The findings were first reported by Krebs on Security and The Register.
