Technology1 min read

Want to Rent an Internet Address at the White House?

By · Published by Everything Blog

In short

Between October 5 and November 3, proxies routed through the Executive Office of the President's network exited from six addresses 236 times over 26 days. Researchers identified 28 distinct commercial services offering routing capabilities through these government systems, with some nodes tied to Windows 11 systems running Infatica software. Infatica was created by a Russian entrepreneur previously linked to servers utilized in the 2016 state election database breaches.

Key points

  • Staff-owned hardware introduces significant vulnerabilities when bundled proxy software s…: Staff-owned hardware introduces significant vulnerabilities when bundled proxy software surreptitiously monetizes sensitive network connections.
  • Bad actors can exploit residential proxies to mask malicious actions such as malware depl…: Bad actors can exploit residential proxies to mask malicious actions such as malware deployment and account takeovers behind trusted White House IPs.
  • The infiltration reflects a wider trend, with similar proxy software detected across near…: The infiltration reflects a wider trend, with similar proxy software detected across nearly 300 government networks and critical infrastructure sectors.

Sources checked by our analysis pipeline: 1

Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.

The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President (AS2650). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period.

The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into “free” mobile and desktop applications. Infatica’s founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home…

Technology