Hacker News Reader

Comment by dhosek | Hacker News Reader

They’re too polite to say it explicitly, but when they say:

> Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.

There really aren’t very many candidates for who that person might be and it really seems like it would be someone who, I don’t know, maybe lives where the traffic is originating.

View on HN

A lot of people work at the White House. Many of them doubtless work a night shift. The set of candidates here is actually quite large.

> A lot of people work at the White House.

I'm no expert but even I've read that "Works at the White House" is bigger than the executive residence and oval office, including the West Wing and the big office building that's directly connected to it by basement walkways. The National Security Council maintains 24-hour watch operations in the Situation Room (which is more a 'complex' than 'room'), while regional desk officers routinely work late evenings to overlap with morning business hours in Europe and Asia.

I asked Gemini if my recollection was correct and got: "The EOP network (managed by the EOP Office of Administration in coordination with Presidential Information Technology Community entities like the White House Communications Agency) operates as a single campus enterprise network. Its high-speed backbone links the West Wing, the EEOB, the East Wing, and nearby administrative facilities such as the New Executive Office Building (NEOB) on 17th Street."

So, definitely an issue that there's a device with some rogue malware installed but the total workforce across all shifts at the White House Complex is roughly between 2,500 and 4,000.

"and the big office building that's directly connected to it by basement walkways"

I ask in good faith, but why didn't you just say the Treasury Building?

Most people don't know that the Treasury Building is a big office building directly connected to the White House by basement walkways.

I didn’t.

Fair point!

Because it's about Eisenhower Executive Office Building

Why is this omission of any note? I know the building and I can tell you that it is not particularly remarkable.

Because it's not the treasury building lol. There are multiple buildings near the White House that are under this umbrella, and I wouldn't think Treasury is one of them since they need their own office space.

the show that came out recently, The Residence, while obviously fiction, made me think about the white house as a semi-public event venue in near constant use by dozens if not hundreds of people. It made for an interesting setting for a whodunit.

Of course it is. It's "The People's House." Look up the Great Cheese Levy of 1837, Lincoln's Office Hours, Coolidge's reception on New Years 1927 or Jackie Kennedy literally giving an "MTV Cribs" on TV in 1962. Or consider, if you can remember, the outcry when they permanently closed Pennslvania Avenue in 1995. Or when they closed Lafayette Square in 2020.

There used to be around the clock anti-nuclear vigils in Peace Park, with soup kitchens feeding folks who lived at their signs.

It's amazing thinking about Teddy Roosevelt following the New Year's Day tradition of shaking every single person's hand who showed up at the White House.

Which in the 1907 case meant 8,513 people's hands.

But if you’re the cleaning staff at the White House do you just get on the WiFi?

Do you believe the availability of wifi for staff/guests is somehow unreasonable? Or, is there a belief that no internet (wifi or cellular) connected devices are allowed on premises? Is them using cellular data, rather than a guest network, somehow more secure?

I'd hope the guest network is completly separate.

I don’t understand. Is it not?

Maybe I'm confused.

Guest networks are configured to disallow intranet connectivity, so the "security" risk would be from the device having access to the internet, on a guest network IP. But a guest network exists for the purpose of giving untrusted devices access to the internet, without compromising the security of the intranet. My local library, the local airport, Home Depot, the movie theater, etc all have public wifi, yet nobody would claim they were directly compromised. I understand the connection could be used for receiving and sending packets over the internet, like a DDoS (which would trigger rate limits, even at Home Depot), but framing a guest network, giving an untrusted device access to the internet, as some security issue seems very odd. The isolation is the mitigation.

The difference is the home depot does not have spies applying for custodial roles. I’d expect nonessential staff to put their phone in a box at the security check. We also live in a world where israel can remotely explode telecom devices they rig in supply chain intercepts.

Again, why is it worse than a device with cellular access? Again, is the belief here that there are no internet connected devices on premises? We know this isn't true, from the twitter feeds of guests!

I can't imagine you'd need very many days of traffic to narrow it down to a very small group of people though. If a device is coming into and out of the campus, that should be fairly easy to reconcile with visitor records. Given that this is one of the most secure locations in the world, I'm reasonably sure a comprehensive list of "who is and isn't on campus" at any given time is available.

My prosumer ubiquiti gear will give me the MAC address and AP that the device is connected to, along with signal strength. WiFiman and a 5 minute walk will give me the mapping of where had that signal strength from that AP and at that point I could find the device with a physical search. There is no way that this device can’t be found in a few hours by anyone who is even vaguely paying attention.

it is easy to correlate with known public travel...

But countable.

Even if many sometimes work at night, you would expect them to also regularly work in the morning, which isn't the case here? So the fact that almost none of the traffic is in the early morning is a further clue pointing to a certain resident whose office hours start around 11 AM...

Cleaner that comes in after normal office hours, with a phone which connects to guest wifi, which is segregated on the LAN side, but has public IPs from the Whitehouse AS

To know that, you'd have to know the pattern of days that it's active.

If it's someone who lives there, it would be different than a shift worker.

Not if you exclude the ones who behave as if the rules apply to them.

Most people working shifts will work varied shifts, sometimes nights, sometimes days, sometimes they'll be missing for days or weeks on end

If it keeps happening I think that at least suggests the source is someone or some people who are “above the rules” most people would be bound by. You can tell the cleaning crew to get off the damned WiFi, others not so much.

Could even be cleaning or security.

As someone elsewhere in the thread noted, this could well be the press. Could also be that this isn’t the White House network at all despite that attribution.

Right, we know the White House owns that public IP, but this could be as bad as an unsecured, unmanaged device that is joined to a private network that is supposed to be secured, OR, on the “all the way good” side, that IP could be the exit for a completely throwaway, untrusted, isolated LAN segment meant only for some iOT device and which has no route to any other peer on the LAN side, and some civilian who has access to that for work brought in his laptop with a “free VPN!” Plugin and joined it to that network because it’s all he had credentials for.

One would expect network activity related to the press to be concentrated during daytime hours, not between 5 PM and midnight.

Even at midnight I can't imagine there being less than 100 people working at the WH in various capacities. While it's probably not the duty/desk officers in the Situation Room/Security Council, there are plenty of maintenance staff that work at night. 5-midnight seems like it overlaps perfectly with a shift schedule.

But how many of them would risk their job by smuggling in a device that violates government policies? Every device in the White House should be accounted for and meeting a number of security criteria. There are really only two or three people there who would know that those rules don't apply to them.

They are not saying that is _on purpose_, in fact they are saying the opposite: a compromised device, could be even an Android phone. It could also be as device planted on purpose, of course.

Given that, why are there so many loose phones at all? Here is one compromised that we know about, in the biggest target for espionage on planet earth.

You’re misreading what this says. It’s someone bringing in a device they managed to get infected.

Oh and also the part where no one has caught this internally which is possibly the bigger takeaway. It’s a zero-trust network made out of incompetence.

There's nothing in the article that suggests it's not just the guest wifi. Which wouldn't be monitored. Why would you? The whole point is that it's segmented and can't actually interact with anything important.

Why are you assuming the person knows and is actively smuggling in the device? And why would you then assume that person is more significant than a shift worker there?

Probably because hegseth decided to actively use signal to discuss military planning instead of secure channels that don’t invite such screwups like adding random citizens to these discussions.

Eh, I would not be surprised if they have a separate wifi that guests can use and you can hook up your private devices to. Basically every large company i have worked for, for the last two decades had that. I suspect deep in the bowels of the White House you don’t get good reception.

Actually sound like the opposite of someone who lives there...Sounds like a shift worker.

There’s a ton of people it could be. Any staffer that works 5-12, which wouldn’t be a particularly weird shift for cooks, cleaners, etc that bring their infected phone with them.

If it was someone who lived there it wouldn’t be exclusively that time period. Why wouldn’t it happen overnight or in the morning or any other time of day?

That timing could also align with a device that is turned on and off at specific times, for example an insecure smart TV that is generally turned on to watch TV in the evening, and turned off around midnight.

Though the fact that it lines up with an 8 hour shift also makes it seem human-like, so I think I'd rank a human carrying an infected device as more likely than an infected periodically-active device.

Or the cleaning or security staff working the night shift.

If you regard 1,000 or less people as few, then this is true. If you regard 1,000 people as "too many" then you rate the national security of the USA at the cost of 1 in 1000 means it's not worth bothing to find out.

Is that really how national security works?

What makes you believe this is related to national security?

There’s at least 500 people on just the staff of the White House, not including many others who work nearby.

With the authority to walk in with a streaming stick, plug it into a TV and connect to WiFi!

Does it continue when the prez is in Florida? Seems a good test on the hypo

The White House doesn't shut down at 5pm. There's whole books, TV series, and movies about the people that are working late every night at the White House. Likely dozens of people are on staff and work shifts that last until midnight every night of the week.

Service staff, including the storied hundred or so White House butlers, work whatever hours are needed. Then you have Secret Service, Kitchen staff, Natalie, house admin staff like the Chief Usher, maybe even NPS staff as the WH grounds are a national park as well, any of whom I would assume might be given access to the secure but unclassified WH wifi and likely a government-issued device. One device with a proxy among all of those people? Entirely unsurprising.

Maybe it's just the printer that Natalie carries around in her purse.

Unless it is running on a government issued iPhone, it is not the Individual #1 you are alluding to.

He very famously does not know how to use computers and can only basically manage tweeting from his phone, which he is mostly not, actually, doing himself.

Now, there are two or three terminally online people around him. I would be more quick to point the finger at his foul-mouthed spokesman but it’s admittedly because I hate that guy and he seems rather stupid. But perhaps it could be the devoted portable printer lady, or the overpromoted unblinking former golf caddy guy.

All of them are around to help with the, er, modern day presidential communications.

> He very famously does not know how to use computers and can only basically manage tweeting from his phone, which he is mostly not, actually, doing himself.

Despite the constant negative press covfefe

Most of it is Harp or Scavino, as far as I have read.

Do you imply this residential proxy is also a Presidential proxy?

It’s probably Natalie.

the politeness appears to be mutual?

Yeah dude you’re right Trump bought an android tv from banggood and got pwned. You’re a genius.

He never buys what he can grift for free. Probably a gift from some autocrat in exchange for politcal favors. Much like the Great Seal bug.

He got gifted an entire jet!

He sure did! And it’s most likely full of listening devices.

Reply on news.ycombinator.com