Cybersecurity researchers discovered residential proxy services operating within the White House network, exposing a potential security flaw that could allow malicious actors to route traffic through official government IP addresses. As reported by CNET, experts warn that this vulnerability mirrors risks faced by ordinary consumers with smart home devices and connected appliances.
White House Network Vulnerability
Layer3 Intel detected residential proxy activity on AS2650, a network registered to the Executive Office of the President. Another security firm identified software from Infatica, a proxy server company owned by a Russian entrepreneur. While no evidence suggests proxy access was used to attack the White House, experts stated it could allow hackers to exploit vulnerabilities or create an unmonitored back door into high-security systems.
Sergiy Usatyuk, founder of Layer3, told CNET that the activity provides an entry point to a network where nobody was previously getting in, creating potential pathways for exploitation. Layer3 found traffic from six distinct IP addresses exiting the White House network through at least 28 known residential proxy services between Oct. 5 and Nov. 3, primarily during evening hours. This pattern suggests an employee may have connected a personal device to a Wi-Fi network with a compromised application or background proxy software development kit (SDK).
Researchers at Synthient reported on X that several White House staffers were running a Windows 11 machine with the InfaticaSDK installed, pointing to a popular streaming app called Rave as the likely delivery mechanism. Additionally, Spur Intelligence co-founder Riley Kilmer noted in a LinkedIn post that other proxy companies, including 9Proxy, were discovered in the White House. The White House did not respond to CNET’s request for comment.
How Proxy Services Affect Consumer Devices
Commercial proxy networks sell access to consumer devices, making internet activity appear as though it originates from a real person or location. While proxies are often used for web scraping, they also support malware attacks, identity theft, and fake social media accounts. Smart TVs, connected appliances, and home routers are particularly vulnerable due to minimal user oversight, allowing unvetted apps or outdated firmware to turn Internet of Things devices into proxy exit nodes.
App developers often integrate proxy SDKs into free applications to generate revenue. When users install these apps, terms and conditions frequently include clauses allowing the app to add user IP addresses to third-party proxy pools. A Spur Intelligence report from June found that roughly one in three apps on Samsung and LG smart TVs sold users’ IP addresses. Furthermore, the FBI warns that free virtual private networks can expose users to similar risks, and hardware purchases like infected streaming devices can also compromise home networks.
Users can check if their IP address is listed in proxy databases using free tools provided by Layer3 or GreyNoise, though identifying the specific infected device requires further investigation. Cybersecurity experts recommend keeping device firmware up to date and downloading software exclusively from trusted app stores.
The White House network incident highlights that residential proxies can infiltrate even high-security environments through everyday connected devices and apps.
