Commercial proxy services that anyone can rent cheaply offered customers a way to route their internet traffic out through the network of the Executive Office of the President, security researchers told Krebs on Security, which reported the findings Wednesday night. The case shows how software bundled into free apps can lend any organization's network, and its trusted reputation, to strangers.
What Happened
Residential proxy services sell access to ordinary people's devices, so a customer's traffic looks as if it comes from a normal home or office connection. Researchers at Layer3 Intel said it spotted such proxy nodes on the White House network by accident while buying global rotating proxy access, not by targeting it.
Between Oct. 5 and Nov. 3, proxy traffic exited through that network 236 times, using six internet addresses on 26 of 30 days, mostly in the evening, according to Layer3. It counted 28 separate residential proxy services through which a customer could exit there.
Researchers at Synthient tied the traffic to multiple installations of software from Infatica, a proxy provider whose code is often bundled with free mobile and desktop apps. Synthient founder Ben Brundage told Krebs that some resellers sell bandwidth for as little as 60 cents per gigabyte, without checking who their customers are.
Krebs reported that Infatica's founder is a Russian national whose hosting company, King Servers, hosted six of the eight internet addresses used in the 2016 intrusions into Arizona and Illinois election databases, which Krebs attributed to Russian state security services, citing earlier CNN reporting.
The White House did not immediately respond to Krebs' request for comment.
Why It Matters
If proxy software can turn devices on one of the country's most sensitive networks into rentable exit points, any company's network is exposed to the same risk. Krebs noted that residential proxies are commonly used for account takeover, ad fraud and mass scraping of content, so an organization's internet addresses could end up attached to that activity. Some proxy networks have also had flaws that let outsiders reach other devices on the host's local network.
The problem is not limited to the White House. Security firm Spur said in a January webinar that it had found residential proxies on nearly 300 government-owned or government-operated networks, and vendor Infoblox reported this year that 65% of its customers had queried at least one proxy-related domain, according to Krebs. Both are vendor figures.
The Primary Wire reported in October, citing BleepingComputer, that some low-cost Android phones ship with residential proxy malware built into their firmware.
What to Watch
Watch whether the Executive Office of the President confirms the findings and removes the software, and whether the Cybersecurity and Infrastructure Security Agency issues guidance on proxy software in federal networks. For other organizations, practical steps include checking endpoints for proxy components bundled in free software, blocking connections to known proxy services and monitoring for unexpected outbound traffic.
