Government,
Industry Specific,
Security Operations
Layer3 Intel Discovers 28 Commercial Services Granting Access to Federal Network
In a startling revelation, researchers from security firm Layer3 Intel have identified that devices connected to the White House network are being utilized as proxies. This situation enables external users to masquerade as traffic originating from the President’s office. Such findings raise significant concerns regarding the integrity of federal cyber security.
The investigation commenced when Layer3 Intel was analyzing various services that sell access to everyday devices for the purpose of rerouting internet traffic. During this inquiry, the team unexpectedly stumbled upon access points associated with the White House network. A total of 28 residential proxy services were found to be linked to this high-security governmental network.
Between October 5 and November 3, the researchers discovered that these proxy service providers were routing internet traffic through six different White House IP addresses numerous times. This substantial activity indicated a serious breach of what should be a highly controlled and secure environment.
According to Layer3 Intel, this was not an intentional targeting of the network. In a blog post published on November 1, the firm clarified their discovery: “We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services.”
The analysis conducted by Layer3 Intel revealed that traffic from devices connected to the White House was predominantly observed between the hours of 5 p.m. and midnight, with negligible activity noted during the early morning hours. This timing suggests that the access was likely being utilized by staff members who were working late, rather than being a result of a casual guest Wi-Fi connection.
Adding to the severity of the findings, residential proxy detection service Synthient corroborated Layer3 Intel’s observations. They reported that several employees were operating Windows 11 machines infected with a software development kit (SDK) known as Infatica SDK. This revelation has raised alarms about the potential vulnerabilities within the White House’s network security protocols, which the administration has not publicly addressed.
The founder of Infatica, Vladimir Fomenko, has an alarming background. His hosting firm, King Servers, has been linked to six of the eight internet addresses utilized by Russia’s state security services to compromise electoral databases during the 2016 U.S. elections in states like Arizona and Illinois. Security blogger Brian Krebs highlighted this connection in an analysis piece, shedding further light on Fomenko’s dubious reputation in the field.
Fomenko has openly advertised on LinkedIn that his firm has transitioned from merely renting IP addresses to offering customers what he describes as “clean, structured data” from crucial websites without having to expend engineering resources combatting anti-bot defenses such as Cloudflare and Akamai.
These residential proxy services, which have now been linked to the White House, allow individuals to rent internet addresses belonging to others. Layer3 Intel emphasizes that this anonymization of web traffic raises significant risks to sensitive data and internal networks, often rendering them vulnerable to cybercriminal activities.
The risks associated with such unsecured proxy SDKs are severe. They can provide access not only to public internet networks but also to private IP addresses associated with the device itself. Skilled attackers could exploit these weaknesses to probe the local network for vulnerabilities, effectively spreading malware or launching broader cyber attacks from within the federal system. Layer3 Intel specifically noted that should an SDK on the White House network exhibit similar vulnerabilities, those purchasing access could potentially penetrate internal systems undetected.
Layer3 Intel’s alarming findings were further validated by research conducted earlier in the year by IP security firm Spur. Their studies revealed that residential proxies were active across nearly 300 government-owned networks, spanning large swaths of IP addresses. Such widespread exposure presents critical implications for national security and underscores the urgent need for enhanced protective measures. As more details surface, concern mounts regarding the ramifications of these vulnerabilities on the integrity of federal cybersecurity.