Cybersecurity experts have found that any internet user could, for a small fee, mask their network traffic as coming from a U.S. government network, the website infohub.kz reports.
Specialists at Layer3 recorded commercial proxy services routing traffic through Autonomous System AS2650, which belongs to the Executive Office of the President of the United States. Such residential services redirect clients' requests through the computers and smartphones of ordinary users in order to conceal the customer's real location. Typically, malicious actors rent such addresses so that their online activity appears to come from ordinary citizens. In the case of the White House, exit nodes were available in 28 public services at once, with access costing from 60 cents per gigabyte.
Between October 5 and November 3, the company's monitoring passed through the presidential administration's network 236 times, using six unique IP addresses. About half of all connections occurred in the evening hours — from 5 p.m. to midnight local time. Analysts stressed that this was not a hack or a spy virus, but third-party software. Developers of free software often embed ready-made monetization modules that quietly rent out the user's internet connection to third parties.
According to Synthient, the network gap may have been caused by the popular streaming app Rave, installed on computers running Windows 10 or 11. Experts warn that coding errors in such libraries could give malicious actors access to other devices on the internal government network if it was not properly isolated.