On Wednesday, security firm Layer3 reported that it has found residential proxy services routing traffic through IP addresses assigned to the White House network, suggesting devices connected to that network are running software that allows their internet connections to be rented out to strangers, potentially through free apps installed on computers or phones.

Residential proxy services sell access to phones and computers used by normal people so a customer’s traffic appears to come from those devices’ internet addresses. Cybercriminals often buy that access so their activity looks like ordinary home or office traffic, and the White House addresses Layer3 found are the same kind sold on public residential proxy services that anyone can purchase. In fact, Layer3 said it saw those exit addresses across 28 separate services.

Synthient founder Ben Brundage told Krebs on Security that some resellers “sell bandwidth for as low as 60 cents a Gigabyte, that means for less than a dollar you can gain access into some of the most confidential and trusted networks.” He added that “the reseller ecosystem further enables this with any criminal able to buy access while skipping KYC [Know Your Customer] processes.”

Layer3 said its Residential Proxy Observatory noticed exit traffic on AS2650, the autonomous system registered to the Executive Office of the President, which hosts the White House network. Between October 5 and November 3, Layer3’s monitoring pipeline exited through that network 236 times, using six different IP addresses on 26 of those 30 days. The firm said it was not targeting the White House.

Source link