The White House is apparently a popular residential proxy exit spot

What happened

Security firm Layer3 Intel found that devices linked to the White House network seem to be relaying internet traffic for residential proxy services. Layer3 found this with its new Residential Proxy Observatory, a public tool that shows data the firm has collected for about a year. The activity is likely illegal, and it may have come from malware or other hidden software on people's devices.

Key numbers

• 28 different residential proxy services used the White House network between October 5 and November 3.
• There were 236 separate exits in that period.
• Most activity happened in the evening, between 5 pm and midnight, White House time.
• Layer3's data goes back to July 10, so the activity may have started earlier than that.

What is a residential proxy?

A proxy hides where a user's internet traffic comes from. A residential proxy uses home internet addresses instead of data center addresses, which makes the traffic look normal. Many of these services are legitimate, but criminals also use them to hide attacks, send spam, and run phishing scams. The FBI warned about this risk in March. Its warning said that malware and hidden software can turn a victim's computer into an exit point without their permission.

Why it matters

If the activity is coming from an infected device inside the White House network, it could let outsiders reach internal systems. Layer3 warned that some proxy software has weak security that can let buyers move through a network. The problem may have lasted for months, so it is a serious concern for a very sensitive government network.

What to watch

• Whether the White House or its IT teams confirm the activity and find the infected devices.
• Whether Synthient's claim that Infatica software is installed on Windows devices on the network is confirmed.
• Whether other residential proxy detection services confirm Layer3's findings.