Skip to content
securitytabs

Updated

Layer3 Intel finds residential proxy traffic exiting White House network

A security firm says internet traffic from commercial proxy services, which let users hide behind ordinary home connections, left through the White House network. No action is required of most organizations; the cause and impact are not yet known.

Proxy traffic traced to White House network
Proxy traffic traced to White House network

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Layer3 Intel says its proxy enumeration pipeline exited through AS2650, the network registered to the Executive Office of the President, 236 times between October 5 and November 3. Residential proxies route traffic through ordinary consumer internet connections so it appears to come from a home user. [1]

SecurityWeek reports that 28 residential proxy services used six addresses in that month, mainly between 5 p.m. and midnight Eastern Time. Layer3 spotted the traffic while using its new Residential Proxy Observatory, a tool giving a global view of residential proxy activity. [2][3]

What is not known

Layer3 says the setup may open a path into one of the most closely guarded networks in the world, and the coverage describes a concern about potential exposure of internal systems. The sources provided do not say how the proxy software got onto the network, who is behind it, or whether any systems were accessed. [1][3]

Timeline

  1. Layer3 Intel published its findings from the Residential Proxy Observatory. [3][2]

  2. Layer3 Intel's observation window of 236 exits through the network ended. [1]

  3. Layer3 Intel's observations of proxy exits through the White House network began. [1]

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

No fix or indicators have been published yet, and the finding concerns a government network rather than a product small businesses buy. [1]

What to do

  1. Ask your IT provider whether any software on your devices turns them into residential proxy exits. [1]
  2. Watch for further announcements from Layer3 Intel. [3]

Mid-size company

A small IT or security team

What to know

Layer3 shows that proxy services can exit from inside well-protected networks; no mitigations or indicators have been published yet. [1][2]

What to do

  1. Review outbound traffic from your network for connections that may relate to proxy services. [1]
  2. Confirm which devices and software on your network could relay third-party traffic. [3]

Large enterprise

A security operations team

What to know

Layer3 says the traffic left through AS2650 and warns of possible exposure of internal systems; no indicators have been published in the cited coverage. [1][3]

What to do

  1. Check your own address ranges against residential proxy enumeration data such as Layer3's Residential Proxy Observatory. [3]
  2. Hunt for devices on your network that relay traffic for external proxy services. [2]

Sources

  1. [1]Help Net Security · Nov 6, 10:29 UTC
    Residential proxy traffic caught leaving the White House networkcontext
  2. [2]SecurityWeek · Nov 6, 12:16 UTC
    Researchers Find Residential Proxies on White House Networkcontext
  3. [3]Security Affairs · Nov 6, 22:17 UTC
    White House Network Appears in Global Residential Proxy Trafficcontext