Just about anyone can rent access to White House IP addresses

Residential proxy access is now available for a few dollars, meaning anyone could potentially use the White House's IP address to mask their online activity.

Security firms Layer3 Intel and Synthient have discovered evidence of residential proxy activity originating from the White House network. This activity suggests that individuals may be renting out access to the White House's IP addresses for a small fee, allowing them to route their internet traffic through the presidential network and mask their actual location. Residential proxies are typically embedded in third-party software or apps, and can be used for legitimate purposes such as ad verification, but also for malicious activities like bypassing geolocation controls and facilitating account takeovers. Layer3 Intel observed 28 different residential proxy services routing traffic from the White House network between October 5th and November 3rd, primarily during evening hours, indicating a potential infection on a device within the network rather than public Wi-Fi usage. Synthient identified a potential link to the watch party app Rave, which is known to bundle multiple proxy SDKs, and noted devices on the White House network connecting to proxy providers like Geonode, Infatica, and Mellowtel. The latter has past associations with election system cyberattacks.

The discovery of residential proxy activity on the White House network highlights a significant security vulnerability and a potential misuse of government infrastructure. It exposes how even high-security environments can be compromised through seemingly innocuous third-party applications and SDKs, underscoring the pervasive risk of supply chain attacks in software. This incident raises critical questions about device security protocols and vendor vetting within government agencies.

This event signals a broader trend where interconnectedness and the reliance on third-party software create blind spots for security. The low cost and ease of access to such proxies suggest that the barriers to entry for sophisticated cyber reconnaissance or potentially malicious activities have been lowered, affecting not just government entities but any organization using similar software.