As if the Trump administration needed any more bad news this week, cybersecurity researchers discovered several residential proxy services originating from the White House network, exposing a potential security flaw that could allow cybercriminals to route traffic through official government IP addresses.
The security firm Layer3 Intel detected residential proxy activity on AS2650, a network registered to the Executive Office of the President. Another security firm identified software from the proxy server Infatica, a company owned by a Russian entrepreneur who ran a server-rental company used by hackers in attacks on election systems in Arizona and Illinois in 2016.
While there’s no evidence that proxy access was used to carry out attacks on the White House, experts say it could open the door for hackers to exploit vulnerabilities or grant outsiders an unmonitored back door into high-security systems.
“It basically gives them a foothold on a network where previously nobody was getting into the White House network,” Layer3 founder Sergiy Usatyuk told CNET. “From a security policy perspective, it gives you all types of potential pathways to exploit.” (Usatyuk pleaded guilty to federal charges in 2019 for his role in operating websites that launched denial-of-service, or DDoS, attacks.)
Residential proxy services route internet traffic through consumer devices (such as smartphones, laptops or home routers) to make it appear that the activity is being performed by a real person. While proxies can be used for relatively benign purposes — web scraping is by far the most common use case — they’re also popular for activities like malware attacks, identity theft and creating fake social media accounts.
For example, earlier this year, Synthient, another company that tracks proxies and VPNs, documented how one botnet infected more than 2 million devices using a residential proxy server. If a similar vulnerability existed in the White House proxy, hackers could probe the infected device’s internal systems and install malicious payloads.
In its report, Layer3 found traffic from six distinct IP addresses exiting the White House network from at least 28 known residential proxy services between Oct. 5 and Nov. 3, with most activity occurring in the evenings between 5 p.m. and midnight EST. This suggests the culprit may be an employee who connected a personal device to a Wi-Fi network with a compromised app or a proxy SDK (software development kit) running in the background. Third-party SDKs can convert a device into a “proxy node.”
Commercial proxy networks sell access to these nodes, so anyone with a few dollars could rent a trusted IP address — in this case, making it appear as though traffic originates from the Executive Office of the President.
Researchers at Synthient provided more details about the case, posting on X that several White House staffers are running “a Windows 11 machine with InfaticaSDK installed.” They pointed directly to Rave, a popular app that lets users watch streaming services with friends, as the likely delivery mechanism for the residential proxy traffic detected on the White House network.
Riley Kilmer, co-founder of the cybersecurity firm Spur Intelligence, wrote in a LinkedIn post that different types of proxy companies had been discovered in the White House, including one called 9Proxy, which is often used by criminals for banking fraud.
The White House didn’t respond to CNET’s request for comment.
How proxy services gain access to your devices
Because smart TVs, connected appliances and home routers usually have minimal user oversight, a single unvetted app or out-of-date firmware update can turn a household of IoT devices into an exit node for commercial proxy networks.
Proxies can generally “glom” onto consumer devices by embedding networking code directly into software, either consensually (users willingly install it) or nonconsensually (by exploiting unsecured device access points).
It starts when app developers look for revenue by integrating those proxy SDKs into their free apps. Then, when you install the app, the fine print of the terms and conditions of service often includes a clause that allows the app to add your IP address to a third-party proxy pool.
A June report from Spur Intelligence found that roughly one in three apps available on Samsung and LG smart TVs were selling users’ IP addresses. To avoid ads, users often accept the terms when downloading the app — a type of unnoticed consent. Once installed, the SDK runs continuously in the background, registering the device’s IP with the proxy provider’s gateway, unless you delete the app or opt out. (The report notes that Amazon and Roku have explicitly banned this practice.)
Using a free VPN could expose you to the same risk, allowing your IP address to be used by someone else for nefarious activities. The FBI’s guidance on protecting yourself against proxies specifically calls out free VPNs as one of the primary ways bad actors gain access to an IP address.
In some cases, you don’t need to download anything to get your IP thrown into a shady proxy pool — you just have to buy the wrong device. A recent investigation by Synthient discovered that more than 1.3 million streaming devices from the China-based device manufacturer MECOOL were infected with proxy SDKs. A proxy service called SocksEscort was charged by the Justice Department in March with compromising thousands of routers to submit fraudulent unemployment insurance claims.
How to check if your devices are being used by proxies
Checking whether your IP address is being used by a proxy service without your knowledge is relatively simple. Layer3 provides a free proxy-checking tool that searches its database of over 70 million proxies to find if yours is listed. GreyNoise, another cybersecurity company, also offers a free IP-checking service.
These tools can tell you if proxy traffic is passing through your network, but they can’t identify which specific device has the SDK running. You’ll have to do some additional detective work to figure out the culprit. Some common sources include free VPNs, gaming apps, “one price, no subscriptions” streaming boxes and smart TVs.
Cybersecurity experts also recommend keeping the firmware on all your internet-connected devices up to date and downloading only from trusted app stores.
See full bio
Read the full article here
