Ethical Hacking News
The White House, a symbol of American power and democracy, has been revealed to be a popular residential proxy exit spot, posing significant security risks to one of the world's most sensitive networks. According to Layer3 Intel, devices associated with the White House network appear to be serving as residential proxy exit nodes, potentially allowing threat actors to access internal systems. The discovery has raised serious security concerns, and experts are urging the White House to take immediate action to address the vulnerability.
Security firm Layer3 Intel discovered that the White House network is being used as a residential proxy exit spot, posing potential security risks. Residential proxies can be used for legitimate or malicious purposes, and Layer3's discovery suggests that malicious actors may be exploiting this vulnerability. 28 distinct residential proxy services were detected exiting into the White House network in a 30-day period, with most activity occurring in the evening. Poorly secured proxy SDKs can allow internal network access and lateral movement, raising concerns about the potential for attackers to reach internal systems. The possibility that the Infatica SDK, which turns devices into residential proxy exit nodes, is running on devices associated with the White House network is a serious security concern.
The White House, a symbol of American democracy and power, has been revealed to be a popular residential proxy exit spot. This discovery was made by security firm Layer3 Intel, which reported that devices associated with the White House network appear to be serving as residential proxy exit nodes, potentially posing security risks to one of the world's most sensitive networks.
According to Layer3 founder Sergiy Usatyuk, the White House residential proxy activity might have gone unnoticed if not for the company's recently launched Residential Proxy Observatory. The observatory is a public interface to explore the data that Layer3 has been collecting for the past year. Usatyuk explained that the observatory is just a tool to help researchers and security professionals like himself identify and track suspicious activity on the internet.
Residential proxies are like any old proxy network that obfuscates the location of a user, except in this case, their exit nodes use IP addresses associated with residential internet connections, as opposed to datacenters. While many are legitimate, others are exploited by threat actors and used in the commission of cybercrimes. The FBI has warned users to protect their systems against hijacking via malware, illicit SDK partnerships, VPNs with hidden service terms that repurpose user computers as exit nodes, and other threats used to turn victims into nodes without their consent.
Layer3 discovered that 28 distinct residential proxy services were exiting into the White House network nearly every day between October 5 and November 3, with 236 separate exits in that period. Most of the activity was happening in the evening, White House time, between 5 pm and midnight. This suggests that someone at the White House - not a guest - has an infected device that's serving as an exit, likely via an infected proxy SDK. If correct, that's a problem.
Past research has shown that poorly secured proxy SDKs can allow internal network access and lateral movement. If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems. Usatyuk told The Register that his firm's data isn't detailed enough to know how many machines are being used as exit nodes inside the White House network. He pointed us to an X post from security firm Synthient, which said it believes there are multiple Windows 10 and 11 devices on the White House network that likely have the Infatica SDK installed on them.
Infatica offers a software development kit (SDK) that allows app developers to monetize users' internet connections by turning their devices into residential proxy exit nodes. The possibility that this software is running on devices associated with the White House network raises serious security concerns: Vulnerable proxy software could potentially provide attackers with a route into internal systems.
The most recent residential proxy activity on the White House network occurred Wednesday night, “hours after the blog went live,” but has since stopped. The US State Department contacted Layer3 Thursday morning to request a copy of the company’s logs, which Usatyuk tells us he’s sent over. “Hopefully they've figured out the situation,” Usatyuk added - and hopefully before any government secrets have been exposed.
The White House did not respond to questions for this story. The discovery of the White House's residential proxy exit spot has raised serious security concerns, and experts are warning that the vulnerability could have been there for a while.
Related Information:
https://www.ethicalhackingnews.com/articles/The-White-Houses-Residential-Proxy-Exit-Spot-A-Growing-Security-Concern-ehn.shtml
https://www.theregister.com/security/2026/11/05/the-white-house-is-apparently-a-popular-residential-proxy-exit-spot/5307969
https://tech.yahoo.com/cybersecurity/articles/device-white-house-apparently-using-171000177.html
Published: Thu Nov 5 18:05:50 2026 by llama3.2 3B Q4_K_M
