YHK - yet another hacker news clone

Residential proxies detected on White House network

318 points Rasbora 1 hour ago 87 comments

bronco21016 1 hour ago | parent

Gotta have your SuperBox set up to watch 24 hr cable news working late into the night.

thehodge 1 hour ago | parent

That was the first thing I thought of!

JTbane 1 hour ago | parent

I have seen these at mall kiosks advertising "free cable", and today I learned they are proxying from your home network.

sfmike 1 hour ago | parent

Vibe coders really having fun on their side quests these days

spiderfarmer 1 hour ago | parent

That is not an environment for serious people anymore so that's expected.

Bassiestroep 1 hour ago | parent

I mean supply chain-attacks are everywhere. Smart-TV's with certain marketplace apps, IoT devices. Also, I'm surprised the white house's network is not monitored more.

thombat 1 hour ago | parent

Monitoring is the easy part, remedying the problems has proved harder. From early in the first Trump administration:

https://lieu.house.gov/media-center/in-the-news/what-can-we-...

mongrelion 1 hour ago | parent

What is a residential proxy?

gessha 1 hour ago | parent

Second paragraph

RKearney 1 hour ago | parent

The 4th sentence in the article has a link to What is a Residential Proxy?[0]

[0]: https://layer3intel.com/what-is-a-residential-proxy

duiker101 1 hour ago | parent

From the article:

> Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network.

whalesalad 1 hour ago | parent

There are services you can pay for such that you can route internet traffic thru a specific IP in a specific part of the world. People (usually unwillingly and unknowingly) run software that effectively makes them part of a giant botnet. A computer running in Romania might have some kind of weather application or gambling/casino app that I could use to make an HTTP request as if I were on their network. So if you need access to 1,000 or 10,000 IP's to circumvent rate limits or perform crawling tasks, this is how you could do it.

georgel 1 hour ago | parent

There are companies that provide proxy services for scraping services, and residential proxies route through consumer networks (like Comcast) which is flagged less than a datacenter IP.

Many questionable TV streaming boxes pretend to deliver you video, but in reality they are also piggy backing on your personal ISP to power those companies.

sparkling 1 hour ago | parent

>Many questionable TV streaming boxes

+ Sketchy Apps

+ Malware

+ Weird Android Variants

microcode 55 minutes ago | parent

Even not so questionable TV's do this too. https://spur.us/blog/smart-tv-apps-residential-proxy-sdks

dormento 1 hour ago | parent

It means some networked devices in there are being remotely piloted to tunnel network traffic to somewhere else. This scenario usually happens with more "unprofessional" ISPs, which sell bandwidth from their networked clients for people in need of such services.

Such as ignoring web scraping countermeasures, and DDoS.

2OEH8eoCRo0 1 hour ago | parent

Essentially lets bad actors use your home network.

charcircuit 18 minutes ago | parent

Bad actors as defined by who. Why am I bad for not living in the right country to access a website.

ZoneZealot 1 hour ago | parent

It's described at a high level in media often. Here's more detail though:

Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.

Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.

A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.

superjan 48 minutes ago | parent

I was expecting that VPN’s (maybe not all) also use their own customers as relays, but you don’t mention them. Am I wrong?

charcircuit 19 minutes ago | parent

That kind of VPN is considered a residential proxy.

2OEH8eoCRo0 21 minutes ago | parent

The unknowing part is what I don't like. Residential proxies obviously have uses but I think it's scummy that they rely on users who are unaware.

cpburns2009 15 minutes ago | parent

This isn't a theoretical problem either. My employer's website was being hammered by residential proxies a month ago. It wasn't until we setup WAF captcha rules that they mostly subsided. It wasn't even the typical exploit scanner. I don't know what the purpose was but it was effectively a DDoS.

hackernud3s 6 minutes ago | parent

They really should have said "botnet malware detected", it turns the White House into an exit IP for someone's else's botnet.

vanyle 1 hour ago | parent

Residential proxies are a very important part of the internet, they allow scraping for archiving, automation and can be used for extra anonymity.

While they have grown a bit too much, they are a natural response to the absurd amount of effort every website is pouring into anti-scraping tech.

georgel 1 hour ago | parent

I wouldn't call turning on CloudFlare's bot blocker an "absurd amount of effort" from the perspective of site owners.

But getting around it sure is annoying, sometimes I get flagged IP's from Comcast and can't visit sites like costco.com despite not doing any questionable stuff on my network.

sparkling 1 hour ago | parent

>absurd amount of effort every website is pouring into anti-scraping tech.

Maybe some people do not want to provide their entire website as free training material to [insert LLM lab here]?

ethin 17 minutes ago | parent

You... Do know that people scrape websites for non-AI reasons, right?

squidmaster 1 hour ago | parent

Virtually all of it is the product of malware. This is like you saying that robbery is very important because you like buying cheap tools at pawnshops.

10111001 59 minutes ago | parent

> Residential proxies are a very important part of the internet, they allow scraping for archiving, automation and can be used for extra anonymity.

Aren't they almost always run unknowingly, by people tricked into running them?

dabbz 42 minutes ago | parent

There exist services that will pay you a fraction of money to host their residential proxy service on a computer you own. But I do think the majority of residential proxies are hijacked.

kube-system 25 minutes ago | parent

There are providers who claim they are ethically sourced, and that users have consented. Although I guess many are users who don't know or care that it is happening.

Ethically, if someone just wants to play a free game and doesn't care about it, is it okay? How knowledgable does a user have to be in order to have informed consent?

xyzzy_plugh 59 minutes ago | parent

Leveraging compromised devices is a very important part of the Internet??? This is an incredibly twisted perspective.

Help me understand. As far as I'm aware, these residential proxies are almost always malware.

Bender 58 minutes ago | parent

Most tools can be dual-use. Residential proxies are also used by malevolent actors to hack infrastructure or financial institutions and let some other poor soul get investigated for it. This is why we can't have nice things.

kube-system 49 minutes ago | parent

They're also used by the good guys who are going after those exact same bad guys.

Bender 35 minutes ago | parent

True, though unfortunately people can not be trusted to declare their intentions so the residential proxies will ultimately have to be sacrificed and given they are fairly easy to identify by behavior I could foresee the feds now having a reason to round 'em up faster. They already took out NetNut, IPIDEA, SocksEscort, Doppellganger and the "Kim Wolf" Offshoots.

kube-system 23 minutes ago | parent

Some of the more legit providers have KYC in place, and do literally require you to declare you intentions to open an account, and block certain traffic proactively unless you can prove a legitimate use.

Bender 20 minutes ago | parent

How do I identify which residential proxies have gone through KYC and which are wanting to pour hot sauce in my under garments?

kube-system 14 minutes ago | parent

The ones that do KYC list it pretty prominently on their website.

Bender 6 minutes ago | parent

They list the IP addresses of all the residential proxies? Is there a list of all the IPv4 addresses they are using I can download once a day?

benjojo12 54 minutes ago | parent

Did a residential proxy provider write this

mcmcmc 51 minutes ago | parent

Frontier lab training data “collector”

lakeviewterrace 34 minutes ago | parent

Huh, and I wonder why I've been getting tons of "you might be a bot" CAPTCHA challenges from Google lately.

mcmcmc 52 minutes ago | parent

Hard disagree. They are malware 99.9% of the time. The utility does not erase the fact they are abusive.

lakeviewterrace 48 minutes ago | parent

"Malware is an important part of the Internet"

> and can be used for extra anonymity

Great, so you can conduct illegal transactions and have some unsuspecting grandma take the blame and have her front door kicked in?

kube-system 24 minutes ago | parent

Just like Tor, encryption, VPNs, etc, there are tons of legal uses for these proxies as well.

lakeviewterrace 20 minutes ago | parent

People who run Tor exit nodes generally do so by choice, and know the risks implications involved.

They didn't just connect a coffee pot to their WiFi one day.

kube-system 14 minutes ago | parent

Not all of these networks are built via malware.

e.g. https://packetstream.io/share-bandwidth/

OptionX 48 minutes ago | parent

And making DDoS-attacks nigh impossible to IP block.

Residential proxies are in many cases at least shady, both on the side of who uses them and for what and on providers that are often not above using dark pattern to hide them in some innocuous app for a smart-whatever that silently runs a proxy on a unaware user's connection. And in many places in the world if illegal stuff in done using your connection you are liable, regardless if you knew about it.

mikestew 33 minutes ago | parent

Residential proxies are a very important part of the internet

So important that we have to trick people into using them. Remember when folks were running SETI@Home? Of course you do, because it was widely thought to be a good thing, and folks willingly signed up.

How many would buy the "box" if the advertising were honest about what's actually in the box?

mzajc 32 minutes ago | parent

s/Residential proxies/DDoS networks/, then re-read your comment.

09712306130 1 hour ago | parent

Seems like the president found a business opportunity and gave internal orders to rent out the network infrastructure to 'ethically sourced' providers :^) Jokes aside, might be some infected IoT crap.

I buy and use residential proxies, though.

btown 1 hour ago | parent

The danger here, of course, is that while these compromised devices are currently being monetized in a relatively benign way (other than bandwidth costs to the user, which to be sure can be nontrivial)… it would be naive to assume that there isn't a Command and Control capability that can assign less benign tasking - or can be compromised to do so.

This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…

lesuorac 1 hour ago | parent

> This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…

I mean politicians are so addicted to twitter the nsa makes special phones…

mzajc 38 minutes ago | parent

> benign

On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.

How is DDOSing every site on the web benign?

nucleardog 34 minutes ago | parent

Relatively benign.

A compromised device inside the White House network could presumably be doing something _much_ worse than participating in a DDOS against random websites.

lakeviewterrace 26 minutes ago | parent

Not really. The government employs better network security people than the average HN schizo detective.

If something is on their network, they know about it. They have a bigger budget and more bodies to throw at the problem than you want to believe.

hackernud3s 20 minutes ago | parent

Apparently they do not though.

Terr_ 14 minutes ago | parent

There were experts but the Republican White House fired them:

https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...

Perhaps some of them annoyed the President's illegally-appointed mega-donor, if they spoke out against giving root access to all his unvetted junior flunkies.

2III7 14 minutes ago | parent

Read "This is how they tell me the world ends".

Or let me sum it up for you. The government doesn't have the money to employ top security experts and top security experts don't actually want to work for the government.

altairprime 7 minutes ago | parent

[delayed]

manyatoms 9 minutes ago | parent

I'd be stunned if they're paying anywhere near enough to attract top talent

YeahThisIsMe 26 minutes ago | parent

Why are you commenting so pretend ambivalent about the fact that the US government is being spied on?

senordevnyc 18 minutes ago | parent

Why would you assume everyone in the world gives a shit about this?

JudahNyquist 1 hour ago | parent

probably something IOT with a vulnerability, happens all the time.

anpat 53 minutes ago | parent

How would one detect this on their home network and protect themselves from?

blacksmith_tb 48 minutes ago | parent

Step one, find your public IP, I like ipinfo.io but there are many other services that will show it. Then pop it into a tool like the one that's hosting TFA[1]

1: https://layer3intel.com/context

tom1337 46 minutes ago | parent

Check network traffic from smart devices would be a good start. If your TV does gigabytes of traffic in the night when you don’t use it, it most likely is acting as a residential proxy.

EvanAnderson 45 minutes ago | parent

Unexpected traffic would be the biggest gross red flag. If it constrains itself to moving traffic when it's otherwise perform its desired function (if it's one of those "free TV" boxes and it only proxies when you're playing video) it might be hard to tease-out the unwanted traffic purely looking at bytes in/out.

Beyond that gross metric you're getting into capturing traffic and decoding it.

j2kun 43 minutes ago | parent

Out of curiosity, how would I check my own device for a residential proxy?

Retr0id 42 minutes ago | parent

Watch egress at the router for anything unaccounted for, tbh.

0cf8612b2e1e 40 minutes ago | parent

Fantastic question. There is so much IOT garbage out there that someone might slip into my network, what can I do to easily detect it?

I was aghast when my partner connected a pet watering bowl to the WiFi.

doublepg23 35 minutes ago | parent

My most worrisome IoT device I have on my network is a digital picture frame my wife connected, but I was surprised the company routinely updates it even though it's on Android 6 (!).

https://support.frameo.com/hc/en-us/articles/23433637149842-...

randomblock1 26 minutes ago | parent

Scroll down to "anonymization": https://ipinfo.io/what-is-my-ip

If there's anything there, monitor your network to figure out exactly what

opengrass 41 minutes ago | parent

NSA honeypots

lakeviewterrace 37 minutes ago | parent

So they don't actually know what this network is, just who owns the IP space... time for a blog post to advertise our week-old service!

There is no evidence that physically ties this to the WH. It could be in a security lab for all they know. Or a guest network for the news media.

1e1a 27 minutes ago | parent

Perhaps ping time measurements could help identify where the devices are physically located.

Terr_ 9 minutes ago | parent

[delayed]

jefurii 36 minutes ago | parent

But her e-mail server!

charcircuit 25 minutes ago | parent

>that poorly secured proxy SDKs can allow internal network access and lateral movement.

Let me guess. The SDK being used does properly handle this and this whole article is anti residential proxy FUD.

hackernud3s 18 minutes ago | parent

Those are better than residential proxies. Those are White House proxies. I would pay $10/GB for those babies.