Layer3 Intel reported on 4 November that its residential proxy enumeration pipeline exited through the White House network 236 times between 5 October and 3 November.
Layer3 says the exits came from 6 addresses in AS2650, which is registered to the Executive Office of the President, on 26 of the 30 days, and that 28 separate residential proxy services were able to exit there. It says Spur and Synthient independently identify the addresses as residential proxy exits, that anyone can buy this access from a proxy service, and that it did not target the network.
Residential proxy services sell access to everyday devices so that a customer’s traffic appears to come from that device’s network. Layer3 notes that about half of the activity falls between 5 p.m. and midnight Eastern time, a pattern it says suggests a person on the network whose device carries a proxy SDK. It adds that “Our data shows the exits, not the device or the person behind them.”
The company raises a second risk. It writes that poorly secured proxy SDKs have allowed internal network access and lateral movement in the past, and cites Synthient’s research on the Kimwolf botnet, which reached at least 2 million devices through residential proxy networks. If an SDK on this network had a similar flaw, Layer3 says, anyone buying proxy access could reach internal systems. Layer3 reports no such access.
For defenders, the finding is a reminder that a proxy SDK can ship inside an ordinary app, game or browser extension, and that outbound traffic from a managed network can reveal it. In our reading, a monthly check of egress addresses against a residential proxy exit list is a cheap control for any organization with a sensitive network. We described a related relay technique when Black Lotus Labs detailed Volt Typhoon’s Silent Train relay framework, and our opinion on watching connected devices after first boot covers the device-side check.
Source: Layer3 Intel, Residential Proxies Detected on White House Network
