Threat-intelligence firm Layer3 Intel says public online services repeatedly sent its web traffic through a White House-linked network. The company recorded 236 observations between Oct. 5 and Nov. 3 across six internet addresses and 28 services, raising concern about outsiders using government-linked internet connections.
Layer3 identifies the network as hosting White House connectivity. AS2650 is listed under the name EOP-ASN in ARIN’s registration record. The registration does not identify the device or person behind any particular connection.
Residential proxy services sell customers access to other devices’ internet connections. As Layer3 describes the arrangement, traffic sent through a proxy appears to come from the device’s network, rather than the customer buying access.
North Korean hackers used fake crypto firms to deliver malware in job scams
White House proxy traffic and the evening pattern
In its Nov. 4 report, Layer3 said it observed exits on 26 of the 30 days in its monitoring window. Its pipeline encountered the network while requesting global rotating access through residential proxy services, the company said, rather than deliberately selecting AS2650.
Layer3 said anyone could obtain the same type of access by paying a public residential proxy service a few dollars.
Layer3 said it cross-checked the addresses against public IP context pages from proxy-detection firms Spur and Synthient. The company said those pages also identified the addresses as residential proxy exits, but it has not disclosed the six addresses in its published finding.
Those figures describe recorded exits, public addresses and proxy services. They do not establish how many devices were involved or that each observation was an attack.
Services, public addresses and exit observations measure different parts of Layer3’s finding.
The raw logs were not independently examined. Public-address counts are not device counts; internal access is not demonstrated.
Layer3 said about half the activity occurred between 5 p.m. and midnight Eastern, with almost none in the early morning. It interpreted that pattern as suggesting a person’s device running proxy software, rather than a public guest Wi-Fi network.
The company described an infected device with a proxy software development kit (SDK) as its explanation for the pattern, while acknowledging that its data shows neither the device nor the person behind the exits.
The distinction also matters for the security implications. Layer3 warned that poorly secured proxy software can, in some circumstances, expose internal systems. Its warning about this network was conditional: an SDK would need to have the kind of flaw documented in earlier proxy research for that route into internal systems to exist.
The published observations do not demonstrate access to internal White House systems. CryptoSlate has not reviewed the raw logs.
Logs and agency notification
Layer3 said it had backed up its activity logs and was willing to share them with relevant agencies through its contact page.
RuntimeWire reported that founder Sergiy Usatyuk told it Layer3 would not disclose the specific addresses because of the sensitivity of the findings and had not notified anyone.
KrebsOnSecurity reported on Nov. 4 that the White House did not immediately respond to its request for comment.
Be the first to comment