#residential-proxies

MVMaker Views #Hacker-News #infatica #network-security #proxyware #residential-proxies #White-House

Researchers find residential proxy traffic exiting through the White House network, letting anyone rent its IP addresses

Layer3's post shows the data; Krebs adds that one of the proxy services traced there has a Russian founder tied to the 2016 election-system hacks.

The security firm Layer3 Intel says its residential proxy monitoring routed traffic out through AS2650, the network of the Executive Office of the President, 236 times between October 5 and November 3, from six addresses on 26 of 30 days, via 28 different proxy services. Residential proxy services sell the use of ordinary people's devices so traffic appears to come from their networks, often via SDKs bundled into free apps. Layer3 says anyone could buy this access for a few dollars, that other detection services also list the addresses as proxy exits, and that the evening-heavy timing suggests an infected personal device rather than guest Wi-Fi.

KrebsOnSecurity reports that Synthient linked the activity to Windows 11 installations of Infatica, a proxy service whose founder's hosting firm, King Servers, hosted most of the addresses Russia used against Arizona and Illinois election systems in 2016. Synthient's Ben Brundage says some resellers charge as little as 60 cents a gigabyte. Layer3 says it will share its logs with agencies.

Read it at the source

Layer3 IntelResidential Proxies Detected on White House Network ↗ KrebsOnSecurityWant to Rent an Internet Address at the White House? – Krebs on Security Independent ↗ Hacker NewsDiscussion: Residential proxies detected on White House network Independent ↗

Rabbit Holes 2

Proxy server

After exploring Residential Proxies Detected on White House Network, for how this kind of relaying works, read about Proxy server.

Explains proxy servers, intermediaries between a client requesting a resource and the server providing it, and their uses.

Wikipedia · Wade · 5 min

0
Autonomous system (Internet)

After exploring Residential Proxies Detected on White House Network, what an 'AS2650' actually is is explained in Autonomous system (Internet).

An autonomous system is a set of IP routing prefixes run by one administrative entity, each identified by an AS number used in BGP routing.

Wikipedia · Wade · 5 min

0

CCybersecurity #Android #botnet #google #iot #residential-proxies #supply-chain-attack

Google takes down a 1.3-million-device TV-box botnet and bans the Chinese maker it says built the backdoor in

BleepingComputer details how the backdoor shipped in firmware and was rented out to residential-proxy and ad-fraud operators.

Google and partners including Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI have disrupted XCPE, a botnet of more than 1.3 million Android TV boxes and other devices in over 200 countries. Google's Threat Intelligence Group says "with high confidence" that Shenzhen device maker Videostrong Technology built the backdoor into its firmware during manufacturing and sold access to criminal affiliates.

Those affiliates installed modules for ad fraud and residential-proxy services, which route other people's traffic through the owner's home connection, according to BleepingComputer. Google says it also took down command servers used by more than a dozen related malware families, cutting off at least 10 million more compromised devices, including set-top boxes, karaoke machines and telehealth hardware.

Google has cut ties with Videostrong and banned it and future affiliates from making certified Android devices. The Register notes Videostrong did not immediately respond, and that XCPE belongs to the same ecosystem as BadBox 2.0, disrupted in 2025.

Read it at the source

BleepingComputerGoogle disrupts million-device XCPE Android malware botnet, bans TV box maker Independent ↗ The RegisterCops bust botnet of 1.3M infected Android TV boxes Independent ↗

Rabbit Holes 1

Botnet

After exploring Google disrupts million-device XCPE Android malware botnet, bans TV box maker, how botnets work is explained in Botnet.

A botnet is a group of internet-connected devices running bots, which can be used for denial-of-service attacks, data theft and spam, controlled through command-and-control software.

Wikipedia · Wade · 5 min

0