Want to Rent an Internet Address at the White House?

Security researchers detected residential proxy traffic originating from the White House’s dedicated internet network, suggesting that staff devices may be sharing their internet connections for strangers to rent. Layer3 Intel found six White House-network addresses acting as proxy exits on 26 of 30 days from October 5 to November 3, with activity often occurring in the evening. Researchers observed 236 exits through the network and found that 28 proxy services could route traffic through it. Synthient linked some activity to Infatica, software installed on Windows 11 devices and often bundled into free apps. Infatica’s founder previously ran a hosting company whose servers were tied to Russian security-service attacks on election databases in Arizona and Illinois in 2016.

Residential proxies let customers disguise their location or identity by making web traffic appear to come from someone else’s connection. They are used for legitimate purposes but also enable account theft, fraud, scraping and other abuse; low-cost resellers may let customers buy access without identity checks. Proxy software can reach employee devices through app developers’ embedded software, which earns money by sharing users’ bandwidth. Such services have also exposed users to security flaws that let attackers probe or take control of devices on local networks. Researchers have found proxies on hundreds of government, utility, health-care and financial networks, making the White House discovery part of a wider problem: people may unknowingly turn trusted workplace connections into publicly rentable gateways.