Security researchers have uncovered evidence that devices on the White House network have been running software capable of turning the presidential compound’s internet connection into a rentable exit node. The finding centers on a White House residential proxy, a service that lets outsiders route their traffic through an IP address associated with the executive mansion for a fee measured in dollars rather than thousands.
The research comes from Layer3 Intel and Synthient, two security firms that independently detected proxy-related traffic emanating from the White House’s network. Their discoveries were first reported by Krebs on Security and The Register.
What a residential proxy does
A residential proxy lets someone rent access to an IP address tied to a home or office connection and send their internet requests through it. To the outside world, the traffic appears to originate from that address rather than from the person actually making the request. The technique is not inherently malicious: Spur, a cybersecurity firm, notes that legitimate uses include ad verification and quality assurance testing. But the same capability can help bad actors slip past geolocation restrictions and defensive filters, build botnets, or carry out account takeovers.
Many apps and browser extensions ship with third-party software development kits that quietly install proxy nodes on a user’s device, whether the user realizes it or not. Those third-party services can then sell access to the resulting residential proxies.
A late-evening pattern on the White House network
Layer3 Intel tracked 28 residential proxy services routing traffic out of the White House network between October 5 and November 3. The activity clustered between 5 p.m. and midnight Eastern time. In Layer3’s assessment, that schedule points to a person rather than a shared guest Wi-Fi network: someone who is regularly on the White House network late into the evening and whose device is infected with a proxy SDK.
Synthient identified the likely culprit as the watch party app Rave, which the firm says bundles 12 proxy SDKs into its platform. Synthient also found a number of Windows 10 and Windows 11 devices on the White House network communicating with known proxy providers, including Geonode, Infatica and Mellowtel.
An uncomfortable connection
Infatica, one of the proxy services named in the findings, was founded by Vladimir Fomenko. According to Krebs on Security, Fomenko also owns King Servers, a company linked to 2016 cyberattacks on election systems in Illinois and Arizona.
The researchers stress that the proxy access is not restricted. Layer3 describes the residential proxy as public access, meaning anyone can obtain it by signing up with a public residential proxy service, paying a few dollars and directing requests through it. That low barrier to entry is what makes the White House findings notable: the network’s IP address is not a private asset in this context but a commodity that, through an infected device, has become available on the open proxy market.
