Researchers have found that internet traffic could be routed through IP addresses assigned to the White House network by buying access from ordinary residential proxy services for a few dollars. Security firm Layer3 Intel disclosed the finding on 4 November after spotting it in its newly launched Residential Proxy Observatory.

Between 5 October and 3 November, Layer3's monitoring pipeline exited through the White House network 236 separate times. Those exits came from six addresses, on 26 of the 30 days, and 28 separate residential proxy services were able to exit through the network. The addresses belong to AS2650, the autonomous system registered to the Executive Office of the President, which hosts the White House network. Layer3 checked the addresses against other proxy-detection services, Spur and Synthient, whose public pages independently identify them as residential proxy exits.

How it happens — and what it does not prove

Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network. The services often work through software bundled into free apps, which rents out the device's bandwidth. Layer3 says it found the White House addresses by chance, simply by requesting globally rotating access through public providers, and that anyone could obtain the same access by signing up and paying a few dollars. Crucially, the researchers have not said this was a breach or an attempt to spy on the White House: the device, its owner and the responsible software have not been established. About half of the activity fell between 5 p.m. and midnight Eastern time, a pattern Layer3 reads as more consistent with a regularly used device than with public guest Wi-Fi. Proxy-intelligence firm Synthient has said it believes with high confidence that the installed app is Rave, a shared streaming app, though that identification is Synthient's assessment.

Activity stopped after disclosure

The Register reported that the latest observed proxy activity on the White House network occurred on the night of Wednesday 4 November and has since stopped, and that the US State Department contacted Layer3 on the morning of 5 November to request its logs. Layer3 says it has kept the raw logs and is willing to share them with relevant agencies. The risk, the researchers say, is that poorly secured proxy software can allow access to the internal network it sits on: Synthient has documented how the Kimwolf botnet reached at least two million devices, mostly Android devices with an exposed debugging service, through residential proxy networks. If software on this network had a similar flaw, anyone buying proxy access could in theory reach internal systems — but no such access has been shown.

Sources: Layer3 Intel; Cyber Insider.