A residential proxy opens up a way for people to rent access to a home IP address and route their Internet traffic through it, allowing them to hide where their activity is actually coming from. Some apps and browser extensions include third-party software development kits (SDKs) that place proxy nodes on a user’s device, whether they know it or not. Third-party services can then sell access to residential proxies on users’ devices.
At the White House, Layer3 Intel discovered that 28 residential proxy services routed traffic outside the network from October 5 to November 3. He notes that this activity usually occurs between 5 pm ET and midnight. “That pattern suggests a person rather than a public guest Wi-Fi network: someone who is regularly on the White House network late into the night, whose device is infected with a proxy SDK,” Layer3 says. The SDK in question could be linked to the Rave surveillance app, according to Synthient, which says the app “includes 12 proxy SDKs on the platform.”
Synthient found “several Windows 10 and Windows 11 devices on the White House network targeting well-known proxy providers such as Geonode, Infatica, and Mellowtel.” As pointed out Krebs on securityInfatica is a proxy service founded by Vladimir Fomenko, owner of King Servers, which was linked to the 2016 cyberattacks on election systems in Illinois and Arizona.
Layer3 warns that the residential proxy is “publicly accessible,” adding that “anyone can get it by signing up for a public residential proxy service, paying a few dollars, and submitting requests through it.”
