The danger here, of course, is that while these compromised devices are currently being monetized in a relatively benign way (other than bandwidth costs to the user, which to be sure can be nontrivial)⦠it would be naive to assume that there isn't a Command and Control capability that can assign less benign tasking - or can be compromised to do so.
This also puts some of the troubling reports that politicians were bringing phones into SCIFs into contextā¦
dhosekyesterday at 11:09 PM
Theyāre too polite to say it explicitly, but when they say:
> Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.
There really arenāt very many candidates for who that person might be and it really seems like it would be someone who, I donāt know, maybe lives where the traffic is originating.
janoelzetoday at 11:43 AM
How did nobody make a (p)residential proxy joke yet?
lakeviewterraceyesterday at 9:43 PM
So they don't actually know what this network is, just who owns the IP space... time for a blog post to advertise our week-old service!
There is no evidence that physically ties this to the WH. It could be in a security lab for all they know. Or a guest network for the news media.
iandanforthtoday at 12:11 PM
This article seems to cast residential proxies in a wholly negative light. In fact the company is openly antagonistic to anonymity. I find that perspective diminishes my trust in the rest of their claims.
bronco21016yesterday at 8:54 PM
Gotta have your SuperBox set up to watch 24 hr cable news working late into the night.
hackernud3syesterday at 10:02 PM
Those are better than residential proxies. Those are White House proxies. I would pay $10/GB for those babies.
seethishatyesterday at 10:23 PM
I have T-mobile 5g. My IP shows up as a residential proxy. I can't control the T-Mobile 5g device. It's a black-box. And, I only have one Linux desktop on the home network (so no Windows/Mac malware).
Not sure why my IP is listed as a residential proxy.
amaitoday at 12:30 PM
So somebody likes to appear as if he/she works from the white house, but actually isnāt there? Why not use a VPN for that?
stcgtoday at 8:05 AM
"Residential proxies" are just botnets: it's mass-spread software under direct central control without the knowledge of the owners of the machines.
j2kunyesterday at 9:36 PM
Out of curiosity, how would I check my own device for a residential proxy?
reactordevtoday at 12:44 AM
I fear this is just the tip of the iceberg. It's the WH's own TOR node for any paying customer. It's manchurian candidate. It makes Clinton's emails look like ice cream.
I was under the impression that actual ISP providers embed into their modems/routers ability to resell YOUR connection to proxy services and charge for that without customer's consent.
Same happens within cellphones - via native mobile apps pimped by ISP/Mobile providers.
Could it be the case?
Good4bootheetoday at 9:31 AM
Can anyone recommend home router that makes handling that threat easy for average Joe? As in a simple list, for TVs detected on my network, with streaming services they should be able to connect to, blocking all other traffic from it?
skinfaxitoday at 12:59 AM
This site is barely a year old. Where is the data and proof? What is the methodology?
asdefghyktoday at 8:14 AM
If residential proxies detected on White House network, why have network admistrators blocked the device?
And
why have they not physically located the device OR at least vastly reduced its possible location , by determining the flow of the traffic from network elements ?
xbmcusertoday at 3:44 AM
Google just banned a chinese Android tv manufacturer for backdooring and installing malware on their devices. This I think is such a device someone pirate sports or porn streaming device.
anpatyesterday at 9:26 PM
How would one detect this on their home network and protect themselves from?
wolvoleotoday at 7:05 AM
I didn't know that residential proxies were a thing. That sounds pretty handy because going online via a VPN gives constant nag popups from the likes of cloudflare :( I hate them.
It would be nice if the VPNs would integrate this option.
I don't need one from the white house though :)
OJFordyesterday at 11:42 PM
I've never heard the term 'residential proxy' before, but it seems like a Tailscale exit node would qualify for example? This doesn't seem necessarily malicious or even inadvertently dangerous to me?
privacyishumantoday at 4:10 AM
I was just thinking, what company's reviews could you trust the least than a residential proxy provider.
The next administration needs to redo the whole infrastructure from scratch. They have to assume everything is compromised
tgtweaktoday at 3:12 AM
Not all residential proxy providers are seedy - but I only know of one that isn't out of probably 20 or so major players so I guess fair call out on "infected".
Not sure why the text is all black, but it's there
gdevenyiyesterday at 10:21 PM
It would be really great to have some info about how to detect such things locally.
EmX_3000today at 5:06 AM
Why not? Cass Sunstein even suggested such an approach in his book in the 1990s, back when he was the Presidential Science Advisor. It's no different than the King of England going out among his people in disguise to get the lay of the land.
OTOH it could be a honeypot, OR possibly somebody was careless. But there is no reason it has to be suspicious.
cowleveltoday at 12:52 AM
Based. Can we turn every IP address that exists into a residential proxy, and then finally end this IP reputation stuff once and for all?
threecheeseyesterday at 10:17 PM
"Infected with a proxy SDK" wouldn't be my first guess. Am I jaded? A realist?
m00dytoday at 5:23 AM
PS: I own proxybase.xyz, and I think weāre the most transparent residential proxy network in the industry.
I donāt think itās fair to call all residential proxy networks shady. Not all of us run our businesses that way. Our code is open, we have nothing to hide, and we use US-based stablecoins for transactions. User consent is our number one priority. I havenāt seen anyone else in the industry match that level of transparency.
deletedyesterday at 9:36 PM
jefuriiyesterday at 9:44 PM
But her e-mail server!
KoftaBobtoday at 3:26 AM
The biggest operator of residential proxy networks (BrightData) is based in Israel, which I'm sure has no connection to this at all...
IG_Semmelweisstoday at 2:59 AM
Domain is feeling the HN hug
isolaytoday at 4:17 AM
Is the first word in that headline missing a P at the beginning?
50208today at 3:48 AM
5:00 PM Eastern Standard Time (EST) is 6:00 AM the next day in Beijing.
deletedyesterday at 10:58 PM
doolstoday at 1:34 AM
But ⦠HER EMAILS!!
opengrassyesterday at 9:39 PM
NSA honeypots
killjoywasheretoday at 12:14 AM
Let's assume the worst, that it's a VIP. Ok, now let's do some basic frequency statistics:
If you click the AS2650 link (1) in the article, you will learn that AS2650 is announcing 65,792 addresses in 5 prefixes. Roughly 40-70% of the IP addresses in a typical corporate ASN are associated with actual computers humans are using. Let's go with 40%. You're looking at 26,317 people. Assume they're all adults (please, dear lord, let them all be adults). 3-8% of the workforce is in IT. Let's go with 3%, that's 789 people. I'm guessing one of those 789 folks has thought this through and has a few VLANs set up to keep VIP and family-of-VIP, pattern of life stuff in a box.
As for the thesis that these are all window-licking low-IQ goons, that's just not how the US government cultivates its workforce. It's no accident that Harvard Business School characterizes themselves as "the West Point of capitalism." West Point isn't someone else's anything. The US Government is in it for the long haul and captures folks young with impossible-to-resist opportunities like the military academies, ROTC, SMART scholars, etc. Let's just stick with the academies: 12,000 people a year who were likely competitive for the Ivies, Division 1 athletics, or both, but chose their parents poorly. Free, top tier education and a job is very attractive for kids from fly-over states. Hell, in big states like California, New York, and Texas, it can actually be even more competitive. Something north of 60% of those graduates stick around for at least 20 years of service (because the high three pension + VA benefits is a pretty nice floor for retirement when your options back home are line supervisor at the cotton mill, the sugar mill, the coal mine, or ramp manager for United), usually addicted to the crazy level of mission. Sort of the opposite of finance where people really struggle mentally if they're not making pallets of money at an accelerating rate. Government service pays dogshit, but the work can super interesting, especially as you gain seniority.
Those folks then often loop back into other agencies and do another 20 years. Are there goombas in the Government? Oh, for sure. Absolutely. But it's roughly the same fraction as any other workforce in the rest of the economy.
But by the time you get to top tier stuff like the White House staff, the sorting function has been strong. To make the point: you also see top tier folks in other organizations with government stink on them. I can think of at least two directors at Google who are prior military. A fat pile of McKinsey folks. Something like 8% of Fortune 500 CEOs have served in the military, above the national average (6-7% of Americans have served in the military at some point).
And it's hilarious to watch people simultaneously assert the government is a bunch of idiots, and then get all excited about fighter pilots, the CIA, the CDC, ambassadors, the NIH. As though those people just appeared from the head of Zeus fully formed. Where do you think they worked when they were young? They were stamping visas for the Department of State in some embassy in central Asia. They were rolling blankets and digging wells in Gambia for the Peace Corps. Checking corporate filings for mostly unknown companies at SEC. Studying aerospace engineering at Embry Riddle and then flying cleared checks between clearing houses across the state overnight in a Cessna.
I mean supply chain-attacks are everywhere. Smart-TV's with certain marketplace apps, IoT devices. Also, I'm surprised the white house's network is not monitored more.
deletedyesterday at 9:38 PM
spiderfarmeryesterday at 9:06 PM
That is not an environment for serious people anymore so that's expected.
JudahNyquistyesterday at 9:17 PM
probably something IOT with a vulnerability, happens all the time.
LocalHtoday at 5:09 AM
Typical modern government bullshit.
Root it out or let it rot us
charcircuityesterday at 9:55 PM
>that poorly secured proxy SDKs can allow internal network access and lateral movement.
Let me guess. The SDK being used does properly handle this and this whole article is anti residential proxy FUD.
ravivarmattoday at 5:54 AM
[dead]
RemingtonDaviestoday at 3:10 AM
[dead]
bashhq_ryesterday at 9:09 PM
[dead]
gjgtcbkjyesterday at 11:16 PM
[dead]
tonethemanyesterday at 9:13 PM
[dead]
cry0today at 9:33 AM
[dead]
Pissenschaftlomyesterday at 9:24 PM
[flagged]
hbcdbffyesterday at 10:58 PM
Slop
09712306130yesterday at 9:14 PM
Seems like the president found a business opportunity and gave internal orders to rent out the network infrastructure to 'ethically sourced' providers :^) Jokes aside, might be some infected IoT crap.
I buy and use residential proxies, though.
sfmikeyesterday at 9:05 PM
Vibe coders really having fun on their side quests these days
vanyleyesterday at 9:13 PM
Residential proxies are a very important part of the internet, they allow scraping for archiving, automation and can be used for extra anonymity.
While they have grown a bit too much, they are a natural response to the absurd amount of effort every website is pouring into anti-scraping tech.