The danger here, of course, is that while these compromised devices are currently being monetized in a relatively benign way (other than bandwidth costs to the user, which to be sure can be nontrivial)… it would be naive to assume that there isn't a Command and Control capability that can assign less benign tasking - or can be compromised to do so.

This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…

They’re too polite to say it explicitly, but when they say:

> Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.

There really aren’t very many candidates for who that person might be and it really seems like it would be someone who, I don’t know, maybe lives where the traffic is originating.

How did nobody make a (p)residential proxy joke yet?

So they don't actually know what this network is, just who owns the IP space... time for a blog post to advertise our week-old service!

There is no evidence that physically ties this to the WH. It could be in a security lab for all they know. Or a guest network for the news media.

Gotta have your SuperBox set up to watch 24 hr cable news working late into the night.

Those are better than residential proxies. Those are White House proxies. I would pay $10/GB for those babies.

I have T-mobile 5g. My IP shows up as a residential proxy. I can't control the T-Mobile 5g device. It's a black-box. And, I only have one Linux desktop on the home network (so no Windows/Mac malware).

Not sure why my IP is listed as a residential proxy.

"Residential proxies" are just botnets: it's mass-spread software under direct central control without the knowledge of the owners of the machines.

Out of curiosity, how would I check my own device for a residential proxy?

I was under the impression that actual ISP providers embed into their modems/routers ability to resell YOUR connection to proxy services and charge for that without customer's consent.

Same happens within cellphones - via native mobile apps pimped by ISP/Mobile providers.

Could it be the case?

I fear this is just the tip of the iceberg. It's the WH's own TOR node for any paying customer. It's manchurian candidate. It makes Clinton's emails look like ice cream.

It's incorporated into a lot of consumer devices legally. https://brightdata.com/proxy-types/residential-proxies

Can anyone recommend home router that makes handling that threat easy for average Joe? As in a simple list, for TVs detected on my network, with streaming services they should be able to connect to, blocking all other traffic from it?

What is a residential proxy?

If residential proxies detected on White House network, why have network admistrators blocked the device?

And why have they not physically located the device OR at least vastly reduced its possible location , by determining the flow of the traffic from network elements ?

This site is barely a year old. Where is the data and proof? What is the methodology?

I didn't know that residential proxies were a thing. That sounds pretty handy because going online via a VPN gives constant nag popups from the likes of cloudflare :( I hate them.

It would be nice if the VPNs would integrate this option.

I don't need one from the white house though :)

Google just banned a chinese Android tv manufacturer for backdooring and installing malware on their devices. This I think is such a device someone pirate sports or porn streaming device.

How would one detect this on their home network and protect themselves from?

I've never heard the term 'residential proxy' before, but it seems like a Tailscale exit node would qualify for example? This doesn't seem necessarily malicious or even inadvertently dangerous to me?

I was just thinking, what company's reviews could you trust the least than a residential proxy provider.

https://www.trustpilot.com/review/myxproxy.com?languages=all

Not all residential proxy providers are seedy - but I only know of one that isn't out of probably 20 or so major players so I guess fair call out on "infected".

https://archive.ph/ado1H

Not sure why the text is all black, but it's there

Why not? Cass Sunstein even suggested such an approach in his book in the 1990s, back when he was the Presidential Science Advisor. It's no different than the King of England going out among his people in disguise to get the lay of the land.

OTOH it could be a honeypot, OR possibly somebody was careless. But there is no reason it has to be suspicious.

It would be really great to have some info about how to detect such things locally.

Based. Can we turn every IP address that exists into a residential proxy, and then finally end this IP reputation stuff once and for all?

"Infected with a proxy SDK" wouldn't be my first guess. Am I jaded? A realist?

PS: I own proxybase.xyz, and I think we’re the most transparent residential proxy network in the industry.

I don’t think it’s fair to call all residential proxy networks shady. Not all of us run our businesses that way. Our code is open, we have nothing to hide, and we use US-based stablecoins for transactions. User consent is our number one priority. I haven’t seen anyone else in the industry match that level of transparency.

But her e-mail server!

The biggest operator of residential proxy networks (BrightData) is based in Israel, which I'm sure has no connection to this at all...

Domain is feeling the HN hug

Is the first word in that headline missing a P at the beginning?

5:00 PM Eastern Standard Time (EST) is 6:00 AM the next day in Beijing.

But … HER EMAILS!!

Let's assume the worst, that it's a VIP. Ok, now let's do some basic frequency statistics:

If you click the AS2650 link (1) in the article, you will learn that AS2650 is announcing 65,792 addresses in 5 prefixes. Roughly 40-70% of the IP addresses in a typical corporate ASN are associated with actual computers humans are using. Let's go with 40%. You're looking at 26,317 people. Assume they're all adults (please, dear lord, let them all be adults). 3-8% of the workforce is in IT. Let's go with 3%, that's 789 people. I'm guessing one of those 789 folks has thought this through and has a few VLANs set up to keep VIP and family-of-VIP, pattern of life stuff in a box.

As for the thesis that these are all window-licking low-IQ goons, that's just not how the US government cultivates its workforce. It's no accident that Harvard Business School characterizes themselves as "the West Point of capitalism." West Point isn't someone else's anything. The US Government is in it for the long haul and captures folks young with impossible-to-resist opportunities like the military academies, ROTC, SMART scholars, etc. Let's just stick with the academies: 12,000 people a year who were likely competitive for the Ivies, Division 1 athletics, or both, but chose their parents poorly. Free, top tier education and a job is very attractive for kids from fly-over states. Hell, in big states like California, New York, and Texas, it can actually be even more competitive. Something north of 60% of those graduates stick around for at least 20 years of service (because the high three pension + VA benefits is a pretty nice floor for retirement when your options back home are line supervisor at the cotton mill, the sugar mill, the coal mine, or ramp manager for United), usually addicted to the crazy level of mission. Sort of the opposite of finance where people really struggle mentally if they're not making pallets of money at an accelerating rate. Government service pays dogshit, but the work can super interesting, especially as you gain seniority.

Those folks then often loop back into other agencies and do another 20 years. Are there goombas in the Government? Oh, for sure. Absolutely. But it's roughly the same fraction as any other workforce in the rest of the economy.

But by the time you get to top tier stuff like the White House staff, the sorting function has been strong. To make the point: you also see top tier folks in other organizations with government stink on them. I can think of at least two directors at Google who are prior military. A fat pile of McKinsey folks. Something like 8% of Fortune 500 CEOs have served in the military, above the national average (6-7% of Americans have served in the military at some point).

And it's hilarious to watch people simultaneously assert the government is a bunch of idiots, and then get all excited about fighter pilots, the CIA, the CDC, ambassadors, the NIH. As though those people just appeared from the head of Zeus fully formed. Where do you think they worked when they were young? They were stamping visas for the Department of State in some embassy in central Asia. They were rolling blankets and digging wells in Gambia for the Peace Corps. Checking corporate filings for mostly unknown companies at SEC. Studying aerospace engineering at Embry Riddle and then flying cleared checks between clearing houses across the state overnight in a Cessna.

(1) https://layer3intel.com/context/AS2650

NSA honeypots

I mean supply chain-attacks are everywhere. Smart-TV's with certain marketplace apps, IoT devices. Also, I'm surprised the white house's network is not monitored more.

That is not an environment for serious people anymore so that's expected.

probably something IOT with a vulnerability, happens all the time.

Typical modern government bullshit.

Root it out or let it rot us

>that poorly secured proxy SDKs can allow internal network access and lateral movement.

Let me guess. The SDK being used does properly handle this and this whole article is anti residential proxy FUD.

Slop

Seems like the president found a business opportunity and gave internal orders to rent out the network infrastructure to 'ethically sourced' providers :^) Jokes aside, might be some infected IoT crap.

I buy and use residential proxies, though.

Vibe coders really having fun on their side quests these days

Residential proxies are a very important part of the internet, they allow scraping for archiving, automation and can be used for extra anonymity.

While they have grown a bit too much, they are a natural response to the absurd amount of effort every website is pouring into anti-scraping tech.