Residential proxies detected on White House network

Is that really how national security works?

If it was someone who lived there it wouldn’t be exclusively that time period. Why wouldn’t it happen overnight or in the morning or any other time of day?

On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.

How is DDOSing every site on the web benign?

I mean politicians are so addicted to twitter the nsa makes special phones…

They don't need to be physically inside a specific building to be a networking security problem.

The core issue is whether an outsider has bypassed your firewall and can send+receive traffic from a node which is getting more trust than it deserves. If they've compromised the computer's microphone/camera/wifi-control that's an additional problem.

That seems significantly worse.

https://darknetdiaries.com/episode/172/

There's a transcript if you want to read, not listen. At the start, you'll be "hey! I gotta get me one!" and later you'll be like "burn it with fire!"

If there's anything there, monitor your network to figure out exactly what

I was aghast when my partner connected a pet watering bowl to the WiFi.

https://cloud.google.com/blog/topics/threat-intelligence/goo...

The biggest danger is that said proxies can also allow access to internal networks, and as you might guess from how they are installed, are not usually operated by the most scrupulous of organizations.

1: https://layer3intel.com/context

Beyond that gross metric you're getting into capturing traffic and decoding it.

Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.

Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.

A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.

Such as ignoring web scraping countermeasures, and DDoS.

* I initially thought this meant someone in the WH network was using commercial proxies to appear as if they were exiting from a different network (which would align with "some user is firing up a proxy on their phone to exit in a different location")

* But then the description of residential proxies seemed to align more with traffic hitting an endpoint in the White House, and _exiting_ from the network there. But this didn't explain the timing (why isn't it 24/7).

* Finally it sounds like some person, legitimately on the WH network, has a device (cell phone, TV, whatever) that, when activated, is proxying outside traffic into the WH network.

Many questionable TV streaming boxes pretend to deliver you video, but in reality they are also piggy backing on your personal ISP to power those companies.

[0]: https://layer3intel.com/what-is-a-residential-proxy

> Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network.

Step 2: have you bought any devices made by large companies like LG or Samsung?

Most likely scenario is a 20-something holdover from DOGE who accidentally had his phone p0wned while downloading groyper memes.

https://lieu.house.gov/media-center/in-the-news/what-can-we-...

Aren't they almost always run unknowingly, by people tricked into running them?

Help me understand. As far as I'm aware, these residential proxies are almost always malware.

> and can be used for extra anonymity

Great, so you can conduct illegal transactions and have some unsuspecting grandma take the blame and have her front door kicked in?

Residential proxies are in many cases at least shady, both on the side of who uses them and for what and on providers that are often not above using dark pattern to hide them in some innocuous app for a smart-whatever that silently runs a proxy on a unaware user's connection. And in many places in the world if illegal stuff in done using your connection you are liable, regardless if you knew about it.

But getting around it sure is annoying, sometimes I get flagged IP's from Comcast and can't visit sites like costco.com despite not doing any questionable stuff on my network.

So important that we have to trick people into using them. Remember when folks were running SETI@Home? Of course you do, because it was widely thought to be a good thing, and folks willingly signed up.

How many would buy the "box" if the advertising were honest about what's actually in the box?

Maybe some people do not want to provide their entire website as free training material to [insert LLM lab here]?