Residential proxies detected on White House network
layer3intel.com
layer3intel.com
This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…
I mean politicians are so addicted to twitter the nsa makes special phones…
It's always better to protect politicians from someone else
On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.
How is DDOSing every site on the web benign?
A compromised device inside the White House network could presumably be doing something _much_ worse than participating in a DDOS against random websites.
> One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.
Surely a Russian company known for cyberattacks against the US having direct access to the White House network is far more serious than just DDOSing random websites. This is espionage at the highest level. (Again.)
A whitehouse network. It isn't like everything done in that building run through a single wifi router. It is likely an unprotected network for personal use with zero connecting to anything important.
Great, they have some isolated network.
What are the chances it _never_ touches a device with a path to an important computer (e.g., one core router or switch at some point)? Good thing there haven't been any Cisco/Juniper/etc vulnerabilities ever.
What are the chances no important device _ever_ touches this isolated network? No important person ever gets annoyed at the security/filtering on the secured network and decides to connect to the public one instead? The secured one has some sort of issue, so their phone decides to connect to the guest network?
Are they going to compromise the military C&C network in the underground bunker? Probably not.
But it's probably more realistically damaging if they were to compromise some high level staffer's phone and using it as a listening device in a bunch of mid-level Whitehouse meetings.
So you're looking at not just national security stuff, but the ability to get personal data like selfies of fucking goats or screenshots of Maltese & Azerbaijan bank transfers, etc. Makes it easy for nefarious parties to manipulate standing with POTUS and blackmail people. The only escape for many of these people is pardons.
Indeed. I recently set up a bot on my local machine that I can interact with via Telegram. I gave it the ability to retrieve the contents of a URL via Playwright (with modifications). Basic things like getting the Readability view and getting the site as Markdown with links.
I was essentially mimicking the feature OpenAI etc offer where it can do a web search for you and get you the answer you seek. I just didn't want to pay a company for that feature.
It's not autonomous. It only acts when I tell it to. The actual search is via the Kagi API, but the URL contents is via Playwright. I also ensured it can't do lots of requests at a time. There's a mandatory (random) sleep of between 1 and 5 seconds between two requests.
In less than a week, I've been flagged. When I do a Google search (as a human), I have to prove I'm human. Many sites have simply blocked me - I can't buy stuff from various vendors[1], I cannot access several news sites, etc.
The thing is, I didn't really access that many sites with the bot! At most it's the equivalent of someone mildly addicted to the web. Yet they caught me quickly.
Obviously, I disabled the bot's capability to get site content. I wonder how long my IP will be in the blacklist.
I know some people will say "Good riddance" to the outcome and to what I did. I'd love to have a real, serious discussion on whether what I did was immoral. But whatever your thoughts on the matter, do ponder over the fact that the system has made it hard for average Joes like you and me to have this "feature", but if you pay a giant tech company a monthly fee, you can have it.
[1] Thankfully, Amazon didn't block me. In the past I'd avoid them, but now I'm in the dilemma where I don't want to buy stuff from sites that make it difficult for me to buy stuff from them!
I will instead say "skill issue".
Using Playwright results in some very obvious and easy to detect fingerprints. I'd expect better of someone on hacker news.
Mine hasn't been detected as far as I can tell, so I know it's possible to do better.
I normally use a VPN to access the Internet. It's an ordinary consumer-grade VPN, and I use it for pretty innocuous things like watching the international versions of Netflix or avoiding being geographically-profiled and charged more when I book travel. The VPN itself, I'm sure, is being used for all sorts of naughty stuff: when I look it up in whatismyip, it comes up as VPN, "abuse detected", and "residential proxy detected". I expect to get blocked occasionally on it and just pause the VPN then.
What I found surprising is that pausing the VPN doesn't always clear the CAPTCHAs. The next request will also fail, sometimes. For a while I was wondering if I have a residential proxy on my network, but I went hunting with lsof and bandwidth monitoring and a list of all the open connections through my router, and it seems clear. Yet even with VPN disabled, I'll get CAPTCHAs from Google and Cloudflare.
I suspect they're using browser/TLS fingerprinting and then smearing the results of that across bad IPs. If you connect to them through a known-bad IP, they not only will CAPTCHA you, but they will record a fingerprint of any data they can. Then if you connect again with that fingerprint, regardless of the IP, they block that too.
Ironically, if you are actually malicious, you can get around this pretty easily. Because you'll know not to use a fingerprintable browser, or to rotate fingerprints. So you have one completely separate identity on a given IP (that is not yours), and if it gets blocked, you roll up another completely separate identity on a different IP. But this is too much work for an ordinary consumer who just wants to keep their IP private. So you end up with this excluded middle where the only rational strategies are to either do exactly what the website expects you to do (with no funny business, even if it's innocuous), or to go whole-hog as the aggressor where you're determined to skirt their policies no matter what, and if you're doing that you might as well amortize the effort by extracting everything of value you can from them.
That modified Playwright was based on Firefox, and that's what I use for my regular browsing. So that didn't help.
I can actually launch Chrome and not deal with this - but I'm not going to. In fact, what surprises me is that I can create a new Firefox profile and not get those captchas. I don't know how my using that modified Playwright as a bot got them hooked on to my Firefox profile. I suspect they had my FF profile as a "suspicious" entity even before I made the bot (I use a number of privacy/anti-cookie extensions), and the bot pushed the score over the edge.
I'll probably start fiddling with my profile - disabling extensions, until things seem to work. Thankfully, no one else in the household is impacted.
For now, I got around all this by just paying for the Kagi extract API. It's not as good as my modified Playwright had been, though. I thought of a VPN, but I suspect that won't last long (not a residential proxy, etc), and I don't want an ongoing monthly fee. I like Kagi's pay as you go option.
But as I said, it's a weird world where suddenly Amazon is coming out the "better" site/vendor. It's funny - in the old days I was pretty anti-Walmart, but a few years ago I started preferring them over Amazon (and even several local stores) for a number of reasons (better collection than local stores, not having to deal with fakes for online orders, etc).
I've not been liking the state of the web for years prior to the advent of LLMs, but this is feeling like a final straw where I accept "the web is dead". We need a fundamentally different protocol - the model of "Set up a server anyone can reach, put content out there, and then put up a lot of sophisticated technology so your server isn't hammered" is not tenable. The protocol itself needs to manage the load.
I made my modifications at the network level and auto redirect a configurable set of sites to go to reader mode/paywall bypass by default with a MITM proxy and a custom CA cert I trust
While your server handles that, what does your CPU do with the other 99% of available cycles?
I run https://bunnystomp.com on an Always Free VM from a major cloud provider. It handles 1,930 req/s at 33 ms latency with no tuning/optimization. It's literally just python behind cloudflare.
I have no idea what the site you linked does, but it doesn't look like a cgit instance to me; that's what got hammered on my end, and when hosting it, one very quickly finds out that many git operations are CPU-bound.
What are you doing to make this true?
I'm a screen reader user (which is as "weird and unusual" as it gets when fingerprinting mechanisms are concerned), and I am not really noticing much difference versus 2022 or so. Sure, there's little bits of anubis here or there, and a few sites (which I know for a fact are experiencing targeted DDoS attacks unrelated to AI scraping) having annoying Cloudflare verification screens, but that's about it.
My setup (other than the screen reader) is as vanilla as it gets. Safari, AdGuard for Ad blocking, no VPN except work VPN when necessary, no PiHole, no settings changed. If you're using something more esoteric, maybe try going mainstream and see if that improves your experience.
In comparison I get cloudflare recaptcha on every site that uses it, sometimes multiple times per session and sometimes not even letting me pass at all due to "error".
And if the website uses Google recaptcha then I close the tab because I know it will just end up in endless recaptcha hell.
It’s DRM that I think of as silly larping that doesn’t really bother me, but it’s clearly drm.
This is what I would like substantiated. I can go to a site behind Anubis, download the content on it, and do whatever I want with it. It doesn't do any kind of attestation of hardware or software. So - what makes it DRM?
! Title: Hide Anubis Image
*/.within.website/x/cmd/anubis/static/img/*.webp$image
2) They're clearly talking from the perspective of the user and network admin. A residential proxy virus is in fact quite benign for both.
3) No matter what, DoS is quite a low priority in terms of security. And it's not even really DDoS, you'll know a real DDoS when you're on the receiving end.
That's only because it isn't being prosecuted appropriately.
I'm all for creating consequences for people who negligently don't secure their systems and people get hurt because of it, but people who installed a mobile game that has a proxy library in it? Please, chill.
I'd say yes since you've allowed random people unauthorized use of the connection. It makes no difference if it's your connection or not. For example, if that proxy gets used as part of a DDoS attack, your device compromised that network.
Yes. And someone did get unauthorized access to it. You don't have the permission to delegate authorization to a third party.
Did the third party connect to the guest wifi or did they connect to your computer and you have allowed them access to the guest wifi?
Did they agree to the ToS that the wifi network requires for people to use it?
Are you certain that the wifi network isn't intentionally limiting the area where it is broadcast, allowing only people within that geographic area the ability to connect to it?
If there is a purely 100% open wifi network who is only limited geographically due to technological constraints but would allow anyone in the world to connect to it if the technology allowed, then using your device to solve the technological constraint of limited wifi range would not fall under compromising the network IMO. Assuming again that the operator of the network publicized it as such and you aren't just making assumptions about their intentions.
There are two main differences. Netflix is working on your behalf. Connections initiated from netflix are no different from connections initiated from your web browser or your email client. Your use of the internet, for you, is authorized. With a proxy you have no idea who is connected or what they are doing with that connection. That network activity uses you, but isn't by you, or for you.
Finally, netflix isn't likely to be hacking, attacking, spamming, or attempting to bypass bans or IP blacklists over that connection, but those are exactly the kinds of activities that shady residential proxies are used for. By using those kinds of apps you basically backdoor/bot your own computer, and now access to the internet through it is being sold to people who want to use it for things that they couldn't get away with when using a VPN or any other legitimate provider.
Depending on the sophistication of the wifi network you may be held liable and accountable for everything that takes place over that connection, including whatever nasty things the people who bought access to your proxy get up to.
If the wifi system isn't set up to keep careful track of who is using it and when (as is common in places like coffee shops), the liability will fall to the entity offering the wifi access, and if that connection is repeatedly used for activity in violation of the law, or the AUP of the ISP being used, that same entity will face the repercussions. Their internet connection may be temporarily suspended. They may have to start blocking certain ports and services, or deny access to specific websites. They may even be forced to stop providing wifi access to guests entirely unless they are willing/able to spend the money needed to log and monitor who is using their connection and respond to notifications of abuse over their network as well as legal requests.
Places like coffee shops that just want to offer free wifi to their customers without worrying about that kind of thing are only able to do that because a small number of local individuals are using their connection. Locals who presumably enjoy being able to the internet at that location and won't take advantage by abusing it. Individuals who are also typically on camera, in full view of employees and other customers.
That kind of very common set up is insecure by nature and those companies are putting themselves at risk by offering the service, but it mostly works because the access is time/location-gated and most people in the neighborhood are generally not criminals. Allowing criminals from all over the globe to access those kind of connections through your device is allowing unauthorized access, and is also being a dick, since you're basically shitting in the pool everybody wants to be able to swim in. It greatly increases the risk that the wifi gets shut down, gets more locked down, or the IP address gets blacklisted making it less useful for everybody who uses it, including you.
Not sure why my IP is listed as a residential proxy.
It should be a balancing act though, somewhere between what you said and my first sentence.
Rate limiting, or additional layers of input sanitisation for IP addresses known to have been malicious in the past.
It's unfortunate that good users will have to endure some difficulties because of bad users on the same network, but if security is the priority, then measures must be taken, you shouldn't just leave to door open to potentially known bad users / traffic.
IPv4 is a shared resource, but some ranges have worse reputations than others, and all are owned by organisations that have the ability to monitor and filter for malicious traffic. It gets into a fraught discussion about censorship, but it is possible for network owners to monitor for, and block / restrict traffic detected as 'bad'. It's just a matter of cost and scale, and those that put the effort in should have their users rewarded with fewer 'trust-issues' roadblocks.
The lists generated by this tool can be useful as well: https://github.com/maximilianfeix/proxy-scraper (which point to here: https://github.com/maximilianfeix/free-proxy-list)
There is also this bot proxy IP list: https://github.com/antoinevastel/avastel-bot-ips-lists
Is this like a corporate support response? I legit can't tell. Try explaining to a retail consumer why they can't buy from your site because they have TMobile service.
Why not? If security is the priority, the worst that could happen from that is clutter in logs and higher resource use. Nobody wastes 0days spraying them on random hosts, and a real motivated attacker targeting your server will not be stopped by an ip blacklist.
I was aghast when my partner connected a pet watering bowl to the WiFi.
https://support.frameo.com/hc/en-us/articles/23433637149842-...
Great gifts! (At least for those unconcerned with privacy or security, which is most people.)
Multiple times I caught unexpected traffic and was able to block it piecewise including a lightbulb(!) that was sending mb packets of god knows what home.
If they were ethernet based I reckon some smart VLAN capable switches would be nice even at home to keep them out of each others business.
I moved home a few years ago and now I'm back with the ISP router and do often feel a little in the dark about what my network is doing!
I had to recently inform my sister and didn't realize just how unaware the general public was of how utterly terrible things have gotten, like with LG TVs or the Meta Quest's access to your family.
When someone tells you "I have nothing to hide, I don't care", let them know that companies like LG make 5x as much money selling your data as selling $1000 TVs, so clearly your data is valuable and you shouldn't be giving it away for free. That's a message normal people can understand.
If there's anything there, monitor your network to figure out exactly what
{
"ip": "175.107.211.204",
"last_seen": "2025-06-24",
"percent_days_seen": 14,
"service": "ipfoxy"
We collect the residential proxy data continuously from independent systems; when you visit the page, we take your IP address and look it up in our database. Note the percent_day_seen field, which is frequency metadata. You can also complement it with our device count data to understand if you are on a NATed IP.
If you are on a static IP address and a single user, we flag your IP address as a residential proxy. I think you should install some DNS monitoring service and start uninstalling unnecessary apps from internet-connected devices.
— Abdullah | DevRel, IPinfo
<li class="...">
<div class="...">
<div class="..."></div>
</div>
<span class="text-sm">Residential Proxy</span>
<span class="sr-only">Not detected</span>
</li>It's no longer a botnet, it's a "residential proxy" and you are doing clean business.
And I’d argue that’s not clean business, the user doesn’t know what their connection is being used for :)
Definitely pretty crazy. This is probably have they’re in the White House, all it takes is a random smart device to install a seemingly benign wallpaper app
There is another word for a C2 channel being created within a device you own without your knowledge, and that word is malware. And it's most often used for botnets, which is the least malicious thing they are used for.
> Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network.
Many questionable TV streaming boxes pretend to deliver you video, but in reality they are also piggy backing on your personal ISP to power those companies.
+ Sketchy Apps
+ Malware
+ Weird Android Variants
Such as ignoring web scraping countermeasures, and DDoS.
Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.
Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.
A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.
But most likely these residential proxy services are more valuable for scraping, DDoS and manipulation plays on social media so they might not actually be used for things that draw direct attention. Using them to download illegal materials would be a waste of resources when a VPN does the job just as well.
They do not respect prior knowledge in any way, and think it has no value.
Of course they don't do standard, table stakes things like making their crawler smart. They don't have to. They're better than that or something.
* I initially thought this meant someone in the WH network was using commercial proxies to appear as if they were exiting from a different network (which would align with "some user is firing up a proxy on their phone to exit in a different location")
* But then the description of residential proxies seemed to align more with traffic hitting an endpoint in the White House, and _exiting_ from the network there. But this didn't explain the timing (why isn't it 24/7).
* Finally it sounds like some person, legitimately on the WH network, has a device (cell phone, TV, whatever) that, when activated, is proxying outside traffic into the WH network.
The whole industry is dirty.
This didn't particularly surprise me (unfortunately). Your average phone is loaded with spyware from "legit" American companies but plenty of them come with carrier spyware, adware or shady apps that auto install. Most people seem to be apathetic about this or have given up so the Chinese botnet device (that reliably delivers lots of illegal media) is just making the same kind of trade they're already making. Look at all the shit about smart TVs in the news recently that people have hardly stopped buying, those don't even come with free pirate NFL games. They've been told they were being spied on for years already and their response was that you're a tin foil hatter for bringing it up, they have nothing to hide or they don't care.
You almost can't blame them though. Even you put a lot of effort into protecting yourself from this stuff you're exposed anyway. Why should they do without their free streaming services when government agencies and companies that they don't even have a direct relationship with lose all their PII a dozen times a year and the DMV legally sells a dossier on them for 1.5cents?
It'd be an instant "yes" from everyone making under 80k a year and for many making more.
Spur.us on purchasable IPs from a site that sells microtargeted IPs and not large IP pool packages:
https://cleanshot.com/share/0Dn5Bh9B
https://cleanshot.com/share/jRGrjxK8
Unlimited traffic, under a dollar a pop, what good is a service when it returns the same info as my own ip? It's just hucksters all the way down. The result is that whoever takes some time or already has the skills to appear inconspicuous to the arbitrary standards set by a few almost-literal gatekeepers will have fewer problems running automations compared to the average user who are liable to run into what's turning into a general enshittification of the internet writ large. It's not, after all, illegal to use a residential, or any, proxy service on its own. Although my guess is that the anti-bot measures are going to exacerbate the already flagging economy if it haven't already, it's always going to be the boogeyman du jour who gets the blame, and not the overzealous and mindless policing and gatekeeping who of course would never admit to being part of the problem, even though they are absolutely part of the problem.
Thankfully security researchers exist to fill the gaps that lawmakers haven't gotten to / won't get to: https://blog.includesecurity.com/2026/06/the-smart-tv-in-you...
These are the specific URLs mentioned:
proxyjs.brdtnet.com
proxyjs.luminatinet.com
proxyjs.bright-sdk.com
clientsdk.bright-sdk.com
clientsdk.brdtnet.com
/(\.|^)brdtnet\.com$/
/(\.|^)luminatinet\.com$/
/(\.|^)bright-sdk\.com$/
/(\.|^)luminati\.io$/
In my experience, out of the two, iphunter.info has the more comprehensive database, I think the owner/operator frequents HN.
I recommend folks just check our website: https://ipinfo.io/my and if they have questions, ask me, I will try to get to the bottom of this.
What we do is connect to residential proxy IP address and verify them before putting them in our database.
But DNS and traffic monitoring is a good practice. If you see gigabytes of traffic without explanation, you have more serious concerns than resproxy.
Beyond that gross metric you're getting into capturing traffic and decoding it.
If your IP address is part of a residential proxy network, it will be flagged.
Also, I recommend seeing the device count data we have for you. If you are on a NATed IP, you have virtually no control to remove the residential proxy SDK from your system. Let me know if you have any questions, as I work for IPinfo.
The biggest danger is that said proxies can also allow access to internal networks, and as you might guess from how they are installed, are not usually operated by the most scrupulous of organizations.
is that actually a thing that was caught before?
Also some free VPNs use their users as exit nodes for their actual paying customers, good luck finding a user who understands that. It's the obvious way to monetize such a service other than ads.
https://cloud.google.com/blog/topics/threat-intelligence/goo...
Residential proxies are a scourge on the internet as a whole, but it's generally in their best interests to be transparent and unnoticeable to the places where they're hosted.
Things like Apple Cloud relay and other corporate VPN services do make it more difficult for the services my company purchases to find your identity and track you. We are trying to find out how we can continue to prevent credit card fraud while supporting customers to continue using such services to protect their data and privacy.
Literally everything else is malicious though. The purpose is literally just a botnet. The point is to be able to get arbitrary packets stamped with arbitrary and diverse IP addresses to prevent IP address filtering and tracking from being able to block malicious activity.
It's ban evasion.
I'd be very interested in AI capabilities in detecting anomalous activity given that it should be very effective at pattern matching across large data sets. What would be required, however, is significant training with industry/application specific 'normal' browsing traffic patterns to determine acceptable tolerances, and then design escalating deterrence if and when tolerances are breached.
How is the scraper process stepping through the site? It must be programmatic, even if it's programmed to be random. What does that look like in traffic data in terms of timing and content requests?
What hazards can be put in place that a normal user would never go near, but a scraper is likely to trip over?
If scraping is being performed from multiple locations in parallel, what might that look like? ie. joining multiple sessions together that may show a more 'scraper' kind of behaviour.
Under IPv6 wouldn't detection start burning a lot of addresses? Yes, the pool is large, but that just means it's a scaling issue from IPv4 to IPv6, rather than a new problem requiring new thinking to solve? (assuming ways of detection were successful).
I'm being somewhat devil's advocate in my blocking rhetoric. The internet is in a weird confluence of wild-west and surveillance state. I like that there are ways and means of being anon-/pseudon-ymous; I like a bit of anarchaos, that's where the spirit of hacking lives. But I also don't want it sticking to my boots when I walk in the house. I'm also not fundamentally against scraping; there's definitely good scraping. There is an irony, though, in protecting scraped data or services that are built on scraped data (and I'm not accusing you, personally, just my general logical ideology of scraping). On residential proxies, I think they're 99% run by erstwhile criminals leveraging what were, until recently, referred to as botnets into a service they can launder their botnets through as 'I am legitimate business man'. I think most, basically all, residential proxies are run involuntarily or unwittingly and that blocking them would provide a greater society benefit than it would a drawback. Anything that promotes the sanitisation of end user devices can only be a good thing. The whole ecosystem is in a terrible state and regulation doesn't even seem to be on the distant horizon.
Maybe I'm hypocritical, or I'm trying to maintain mutually exclusive positions. This is where I'm at though.
IP scoring is such a difficult product to do reliably. When someone says we provide IP scoring, you have to ask them based on what and what is your methodology. Now, IP reputation scoring can be good if both the vendor and the customer know what they are looking for very specifically.
For example, there are abusive IP databases. Now, some abusive IP databases run global honeypots, and they can say these IP addresses tried to exploit the CVE patterns. Sounds good, so when you buy their product, you can say the scoring they are providing can help with blocking IP addresses that run automated CVE exploits that match this pattern. Those services act as beacons, rather than a flat, generic, and everlasting database of bad IP addresses.
Now, do you take that score and try to use it as a baseline for protecting your login portal or credit card fraud? Of course not! You have to go to specialized vendors who provide specialized scoring.
We do not do IP reputation because we provide IP metadata that we can verify, and we can discuss methodologies publicly. If you ask us to do IP reputation scoring, we can easily do that, as we run a global honeypot ourselves as well. But that will involve us providing explanations and education to folks that the score you see fits a very specific pattern of attack that is not generic.
For example, we sell residential proxy detection data, and the database contains 100 million IP addresses. Are all 100 million IP addresses bad? Of course not. But this is not our call to make; our customers have to see the metadata we provide as well, such as percent days seen, last seen, etc. Now, if an IP address is flagged for being 100 percent seen and the last seen date is fairly new, it fits a certain threat model which can be categorized as concerning.
Same happens within cellphones - via native mobile apps pimped by ISP/Mobile providers.
Could it be the case?
https://www.trustpilot.com/review/myxproxy.com?languages=all
And why have they not physically located the device OR at least vastly reduced its possible location , by determining the flow of the traffic from network elements ?
> Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.
There really aren’t very many candidates for who that person might be and it really seems like it would be someone who, I don’t know, maybe lives where the traffic is originating.
Which in the 1907 case meant 8,513 people's hands.
Guest networks are configured to disallow intranet connectivity, so the "security" risk would be from the device having access to the internet, on a guest network IP. But a guest network exists for the purpose of giving untrusted devices access to the internet, without compromising the security of the intranet. My local library, the local airport, Home Depot, the movie theater, etc all have public wifi, yet nobody would claim they were directly compromised. I understand the connection could be used for receiving and sending packets over the internet, like a DDoS (which would trigger rate limits, even at Home Depot), but framing a guest network, giving an untrusted device access to the internet, as some security issue seems very odd. The isolation is the mitigation.
I'm no expert but even I've read that "Works at the White House" is bigger than the executive residence and oval office, including the West Wing and the big office building that's directly connected to it by basement walkways. The National Security Council maintains 24-hour watch operations in the Situation Room (which is more a 'complex' than 'room'), while regional desk officers routinely work late evenings to overlap with morning business hours in Europe and Asia.
I asked Gemini if my recollection was correct and got: "The EOP network (managed by the EOP Office of Administration in coordination with Presidential Information Technology Community entities like the White House Communications Agency) operates as a single campus enterprise network. Its high-speed backbone links the West Wing, the EEOB, the East Wing, and nearby administrative facilities such as the New Executive Office Building (NEOB) on 17th Street."
So, definitely an issue that there's a device with some rogue malware installed but the total workforce across all shifts at the White House Complex is roughly between 2,500 and 4,000.
I ask in good faith, but why didn't you just say the Treasury Building?
If it's someone who lives there, it would be different than a shift worker.
Oh and also the part where no one has caught this internally which is possibly the bigger takeaway. It’s a zero-trust network made out of incompetence.
If it was someone who lived there it wouldn’t be exclusively that time period. Why wouldn’t it happen overnight or in the morning or any other time of day?
Is that really how national security works?
He very famously does not know how to use computers and can only basically manage tweeting from his phone, which he is mostly not, actually, doing himself.
Now, there are two or three terminally online people around him. I would be more quick to point the finger at his foul-mouthed spokesman but it’s admittedly because I hate that guy and he seems rather stupid. But perhaps it could be the devoted portable printer lady, or the overpromoted unblinking former golf caddy guy.
All of them are around to help with the, er, modern day presidential communications.
Despite the constant negative press covfefe
Service staff, including the storied hundred or so White House butlers, work whatever hours are needed. Then you have Secret Service, Kitchen staff, Natalie, house admin staff like the Chief Usher, maybe even NPS staff as the WH grounds are a national park as well, any of whom I would assume might be given access to the secure but unclassified WH wifi and likely a government-issued device. One device with a proxy among all of those people? Entirely unsurprising.
Maybe it's just the printer that Natalie carries around in her purse.
Though the fact that it lines up with an 8 hour shift also makes it seem human-like, so I think I'd rank a human carrying an infected device as more likely than an infected periodically-active device.
Step 2: have you bought any devices made by large companies like LG or Samsung?
Now, how to prevent this. If you are on a NATed connection, it is nearly impossible to prevent this from happening because you cannot control what apps people install who share the same IP address with you. If you have control over your network, then I suggest you install a DNS monitoring service. You can periodically monitor the DNS requests to find unusual patterns.
Not sure why the text is all black, but it's there
I don’t think it’s fair to call all residential proxy networks shady. Not all of us run our businesses that way. Our code is open, we have nothing to hide, and we use US-based stablecoins for transactions. User consent is our number one priority. I haven’t seen anyone else in the industry match that level of transparency.
It should be made illegal.
OTOH it could be a honeypot, OR possibly somebody was careless. But there is no reason it has to be suspicious.
In legal terms, it is consented when you install an app that has the Resproxy SDK built into it.
It would be nice if the VPNs would integrate this option.
I don't need one from the white house though :)
There is no evidence that physically ties this to the WH. It could be in a security lab for all they know. Or a guest network for the news media.
They don't need to be physically inside a specific building to be a networking security problem.
The core issue is whether an outsider has bypassed your firewall and can send+receive traffic from a node which is getting more trust than it deserves. If they've compromised the computer's microphone/camera/wifi-control that's an additional problem.
That seems significantly worse.
Firewall it from your local network if you want to - it'll still work - they're not after that.
https://darknetdiaries.com/episode/172/
There's a transcript if you want to read, not listen. At the start, you'll be "hey! I gotta get me one!" and later you'll be like "burn it with fire!"
“ Most of the infected devices were manufactured in China. ” uh… most devices are manufactured in China period. Very strange article/podcast.
Such things are threats to humanity imho. They can get us back to the times we couldn't exploit the internet to run a society.
https://hn.algolia.com/?q=starlink+whitehouse
The sheer bumbling incompetence of this current regime is almost akin to the plot of a "Hogan's Heroes" episode, with management style provided by Colonel Klink...
Seriously? Discovering proxies exist and actually finding the people that use them are two different things.
Trying to conflate those two things in an article meant for a technical audience is quite funny.
Most likely scenario is a 20-something holdover from DOGE who accidentally had his phone p0wned while downloading groyper memes.
Let me guess. The SDK being used does properly handle this and this whole article is anti residential proxy FUD.
https://lieu.house.gov/media-center/in-the-news/what-can-we-...
If you click the AS2650 link (1) in the article, you will learn that AS2650 is announcing 65,792 addresses in 5 prefixes. Roughly 40-70% of the IP addresses in a typical corporate ASN are associated with actual computers humans are using. Let's go with 40%. You're looking at 26,317 people. Assume they're all adults (please, dear lord, let them all be adults). 3-8% of the workforce is in IT. Let's go with 3%, that's 789 people. I'm guessing one of those 789 folks has thought this through and has a few VLANs set up to keep VIP and family-of-VIP, pattern of life stuff in a box.
As for the thesis that these are all window-licking low-IQ goons, that's just not how the US government cultivates its workforce. It's no accident that Harvard Business School characterizes themselves as "the West Point of capitalism." West Point isn't someone else's anything. The US Government is in it for the long haul and captures folks young with impossible-to-resist opportunities like the military academies, ROTC, SMART scholars, etc. Let's just stick with the academies: 12,000 people a year who were likely competitive for the Ivies, Division 1 athletics, or both, but chose their parents poorly. Free, top tier education and a job is very attractive for kids from fly-over states. Hell, in big states like California, New York, and Texas, it can actually be even more competitive. Something north of 60% of those graduates stick around for at least 20 years of service (because the high three pension + VA benefits is a pretty nice floor for retirement when your options back home are line supervisor at the cotton mill, the sugar mill, the coal mine, or ramp manager for United), usually addicted to the crazy level of mission. Sort of the opposite of finance where people really struggle mentally if they're not making pallets of money at an accelerating rate. Government service pays dogshit, but the work can super interesting, especially as you gain seniority.
Those folks then often loop back into other agencies and do another 20 years. Are there goombas in the Government? Oh, for sure. Absolutely. But it's roughly the same fraction as any other workforce in the rest of the economy.
But by the time you get to top tier stuff like the White House staff, the sorting function has been strong. To make the point: you also see top tier folks in other organizations with government stink on them. I can think of at least two directors at Google who are prior military. A fat pile of McKinsey folks. Something like 8% of Fortune 500 CEOs have served in the military, above the national average (6-7% of Americans have served in the military at some point).
And it's hilarious to watch people simultaneously assert the government is a bunch of idiots, and then get all excited about fighter pilots, the CIA, the CDC, ambassadors, the NIH. As though those people just appeared from the head of Zeus fully formed. Where do you think they worked when they were young? They were stamping visas for the Department of State in some embassy in central Asia. They were rolling blankets and digging wells in Gambia for the Peace Corps. Checking corporate filings for mostly unknown companies at SEC. Studying aerospace engineering at Embry Riddle and then flying cleared checks between clearing houses across the state overnight in a Cessna.
Root it out or let it rot us
I buy and use residential proxies, though.
While they have grown a bit too much, they are a natural response to the absurd amount of effort every website is pouring into anti-scraping tech.
But getting around it sure is annoying, sometimes I get flagged IP's from Comcast and can't visit sites like costco.com despite not doing any questionable stuff on my network.
Maybe some people do not want to provide their entire website as free training material to [insert LLM lab here]?
Aren't they almost always run unknowingly, by people tricked into running them?
Ethically, if someone just wants to play a free game and doesn't care about it, is it okay? How knowledgable does a user have to be in order to have informed consent?
Betcha that means there was "consent" language on page 55 of some click-through EULA.
Help me understand. As far as I'm aware, these residential proxies are almost always malware.
In fairness to me, I did say "Most tools can be dual-use. Residential proxies are also used by malevolent actors to hack infrastructure or financial institutions and let some other poor soul get investigated for it. This is why we can't have nice things."
So it could be Alice. I know Alice has good intentions. It could be Bob, we know what Bob is up to but I will give him a pass regardless because Bob did nice things in the past. But then there is Mallory ... Mallory Malfoid is up to no good. I need to know which IP's are used by Alice and Bob so I can exclude them from my automated protections. Mallory will automatically get rate limited to 16kb/s, 1 HTTP request every 5 seconds and if they bounce around different residential proxies they get redirected to a bathtub regardless of which residential proxy they use.
In no world does "KYC" mean "expose your customer list to the whole world", let alone undermine the entire purpose of the product you're selling.
"I want to dox all of the customers of a proxy provider" is just an unreasonable ask. We wouldn't expect or want ISPs or VPNs or telecoms to do this.
Agreed. Alice Rhodes, Bob Bojangle and Mallory Malfoid will all be treated equally.
This was a fun thread, I have always wanted to give them last names.
> and can be used for extra anonymity
Great, so you can conduct illegal transactions and have some unsuspecting grandma take the blame and have her front door kicked in?
They didn't just connect a coffee pot to their WiFi one day.
Technically correct statement though
Residential proxies are in many cases at least shady, both on the side of who uses them and for what and on providers that are often not above using dark pattern to hide them in some innocuous app for a smart-whatever that silently runs a proxy on a unaware user's connection. And in many places in the world if illegal stuff in done using your connection you are liable, regardless if you knew about it.
So important that we have to trick people into using them. Remember when folks were running SETI@Home? Of course you do, because it was widely thought to be a good thing, and folks willingly signed up.
How many would buy the "box" if the advertising were honest about what's actually in the box?