Residential proxy traffic has exited through the White House network 236 times over a 30-day period, and 28 separate residential proxy services were able to route traffic through six of its addresses. That is not a footnote. It is a warning about how little control anyone has over the devices that connect to the most sensitive network in the country.
Layer3 Intel, a New York-based residential proxy detection firm, published the findings on November 4. The addresses sit in AS2650, the block registered to the Executive Office of the President. Layer3 recorded the exits on 26 of the 30 days between October 5 and November 3 in its newly launched Residential Proxy Observatory, and it cross-checked the addresses against public lookup pages from Spur and Synthient, which independently flagged them as residential proxy exits.
The mechanism is what should worry officials. Layer3 said anyone could route traffic through these addresses by signing up to a public residential proxy service and paying a few dollars. The firm found the activity by chance. It did not find evidence of compromised White House systems, and it did not identify the person behind the device. About half the activity fell between 5pm and midnight Eastern Time, a pattern Layer3 said suggested an individual device on the network rather than a public guest Wi-Fi network.
The deeper risk is the software inside that device. Layer3 pointed to research showing that poorly secured proxy SDKs can allow access to internal networks and lateral movement, and it cited Synthient findings that the Kimwolf botnet reached at least two million devices, mostly Android devices with an exposed Android Debug Bridge service. If a proxy SDK on the White House network carried a similar flaw, Layer3 said, anyone buying proxy access could reach internal systems. Nothing in the report proves that happened. But the possibility alone should prompt a serious audit.
The response should be simple: federal network administrators should inventory every device on AS2650 for proxy SDKs, remove them, and report what they find. Layer3 has already shared its raw logs with a US federal agency, which is the right step. The next step is for the agency to say publicly whether it has acted. Infosecurity has contacted the White House for comment, and the public deserves an answer.