Rendered at 05:00:13 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
btown 1 days ago [-]
The danger here, of course, is that while these compromised devices are currently being monetized in a relatively benign way (other than bandwidth costs to the user, which to be sure can be nontrivial)… it would be naive to assume that there isn't a Command and Control capability that can assign less benign tasking - or can be compromised to do so.
This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…
mzajc 1 days ago [-]
> benign
On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.
How is DDOSing every site on the web benign?
nucleardog 1 days ago [-]
Relatively benign.
A compromised device inside the White House network could presumably be doing something _much_ worse than participating in a DDOS against random websites.
mcv 19 hours ago [-]
And it's right there in the second line of the article:
> One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.
Surely a Russian company known for cyberattacks against the US having direct access to the White House network is far more serious than just DDOSing random websites. This is espionage at the highest level. (Again.)
KaiserPro 19 hours ago [-]
The owner of the proxy is not great, but the fact that its an open door to snoop on everything else on the entire network is the realy fucker there.
sandworm101 16 hours ago [-]
>> A compromised device inside the White House network
A whitehouse network. It isn't like everything done in that building run through a single wifi router. It is likely an unprotected network for personal use with zero connecting to anything important.
nucleardog 14 hours ago [-]
If the progression of security over the last couple years has made anything clear, it's that letting the barbarians knock down a couple of walls because "well we have more walls" is not a winning defense strategy. The barbarians are very creative and will often exploit the inch you give in unexpected ways.
Great, they have some isolated network.
What are the chances it _never_ touches a device with a path to an important computer (e.g., one core router or switch at some point)? Good thing there haven't been any Cisco/Juniper/etc vulnerabilities ever.
What are the chances no important device _ever_ touches this isolated network? No important person ever gets annoyed at the security/filtering on the secured network and decides to connect to the public one instead? The secured one has some sort of issue, so their phone decides to connect to the guest network?
Are they going to compromise the military C&C network in the underground bunker? Probably not.
But it's probably more realistically damaging if they were to compromise some high level staffer's phone and using it as a listening device in a bunch of mid-level Whitehouse meetings.
Spooky23 13 hours ago [-]
Remember all the senior people are engaged in blatant corruption and illegality.
So you're looking at not just national security stuff, but the ability to get personal data like selfies of fucking goats or screenshots of Maltese & Azerbaijan bank transfers, etc. Makes it easy for nefarious parties to manipulate standing with POTUS and blackmail people. The only escape for many of these people is pardons.
15 hours ago [-]
lakeviewterrace 1 days ago [-]
[flagged]
hackernud3s 1 days ago [-]
Apparently they do not though.
Terr_ 1 days ago [-]
There were experts but the Republican White House fired them:
Perhaps some of them annoyed the President's illegally-appointed mega-donor, if they spoke out against giving root access to all his unvetted junior flunkies.
FireBeyond 1 days ago [-]
The same junior flunkies who would do things like go to government agencies, create administrative accounts, which would then, often with minutes, be seen connecting from Russia and Eastern Europe with the correct credentials.
trismus 1 days ago [-]
Source?
adzm 1 days ago [-]
> Daniel J. Berulis, a cybersecurity architect with the NLRB, filed a whistleblower complaint alleging that within 15 minutes of DOGE team members creating new user credentials and demanding administrative access, multiple login attempts using those exact credentials originated from a Russian IP address
Oh come on, search-engines have gone downhill, but not that far downhill! You already know it involves "DOGE" and "Russia" and "credentials", that ought to be enough:
> Berulis alleged in the affidavit that there attempted logins to NLRB systems from an IP address in Russia in the days after DOGE accessed the systems. He told Reuters Tuesday that the attempted logins apparently included correct username and password combinations but were rejected by location-related conditional access policies.
I could have this entire conversation with ai too.
lukan 1 days ago [-]
You literally asked for a source and when provide by a human it was not enough? Maybe you should rather engage with AI completely then?
trismus 1 days ago [-]
It was enough and I appreciated it with the context, and conversation ensued. Not sure why I was scolded for doing so, that's what I meant by being able to have the conversation with AI - this whole interaction is defunct if we're going by the logic that it could be had another way.. I didn't want to go research it myself, I wanted to know where my peers are sourcing this novel-to-me information from.
xtiansimon 16 hours ago [-]
Maybe the reaction stems from the low effort? "source?"
Personally, sometimes I find a short command like this in a discussion forum insulting to my effort.
Or maybe it's just that I still like sentences, and others are using text message conversational forms. idk. wtf.
lukan 15 hours ago [-]
For me it stems from "I could have this entire conversation with ai too."
what 1 days ago [-]
> often
You have one alleged example.
Terr_ 1 days ago [-]
> You have one alleged example.
That sounds like being deliberately obtuse and arguing in bad-faith. Are you going to "nuh uh" all the journalists and lawyers until you are personally given raw TCP dumps?
Behold, from the sworn affidavit of the DevSecOps guy with the top-secret clearance, as included in a whistleblower disclosure to Congress [0]:
> There were more than 20 such attempts, and what is particularly concerning is that many of these login attempts occurred within 15 minutes of the accounts being created by DOGE engineers.
So there it is, now don't go moving the goalposts.
> The same junior flunkies who would do things like go to government agencies, create administrative accounts, which would then, often with minutes, be seen connecting from Russia and Eastern Europe with the correct credentials.
They are young and think they are very smart. What could go wrong?
brador 20 hours ago [-]
For anyone new, the above are talking about trump and Elons DOGE gov department.
manyatoms 1 days ago [-]
I'd be stunned if they're paying anywhere near enough to attract top talent
dhosek 1 days ago [-]
I applied to USDS in 2023, the process took nearly a year and ended with them just ghosting me after two interview rounds. Pay was capped (by law) below my target salary but at a level that I would accept as it would have been fully remote, but there was also a term limit on the job which meant I would have at most two years in the position.
It’s not just the pay, there’s a lot of structural elements that mean that the potential talent pool is less than desired.
vlan0 1 days ago [-]
Th best folks I know wouldn't touch a government job, no matter the pay.
fhub 1 days ago [-]
There was a period of time where it seemed (as an outsider) that they were attracting good talent. This was when Megan Smith was CTO. https://en.wikipedia.org/wiki/Megan_Smith.
alt227 1 days ago [-]
Dont they usually bargain work against jailtime for domestic cyber criminals?
1 days ago [-]
2III7 1 days ago [-]
Read "This is how they tell me the world ends".
Or let me sum it up for you. The government doesn't have the money to employ top security experts and top security experts don't actually want to work for the government.
swiftcoder 17 hours ago [-]
> The government doesn't have the money to employ top security experts and top security experts don't actually want to work for the
To be fair, they had quite a number of security experts on payroll before the current administration laid them all off...
altairprime 1 days ago [-]
Sometimes, top security experts often can’t work for the U.S. government even if they do want to due to being ineligible for security clearance from checks notes gender and sexuality mistrust, non-zero drug usage lifetime to date, formerly grayhats, have ever sought mental health care, and/or anti-authoritarian viewpoints.
1 days ago [-]
lakeviewterrace 1 days ago [-]
To be fair, the track record for mentally unwell people in positions of trust isn't great.
StilesCrisis 1 days ago [-]
"Saw a therapist once" =/= "unwell."
In fact avoiding therapy at all costs is a good sign of trouble.
lynx97 21 hours ago [-]
[flagged]
maxbond 1 days ago [-]
The track record for preventing people in positions of trust from seeking out mental health care is terrible. It's just brushing problems under the rug and waiting for them to turn rancid. Don't interpret not seeking help as the nonexistence of a problem, especially if their career depends on it.
altairprime 1 days ago [-]
Does the Department of Defense still have a clearance disqual for ADHD?
dylan604 1 days ago [-]
Before the most recent elections, people voted for an unwell person to lead the country. So it's not just someone can obtain the position, but that people actually chose to put one in office. Twice. Although, it was less well known on the first one.
what 1 days ago [-]
[flagged]
vlan0 1 days ago [-]
Bruh do you remember snowden? The government is HEAVILY sub-contracted. Accenture? Really? My guy...
BeetleB 1 days ago [-]
> The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.
Indeed. I recently set up a bot on my local machine that I can interact with via Telegram. I gave it the ability to retrieve the contents of a URL via Playwright (with modifications). Basic things like getting the Readability view and getting the site as Markdown with links.
I was essentially mimicking the feature OpenAI etc offer where it can do a web search for you and get you the answer you seek. I just didn't want to pay a company for that feature.
It's not autonomous. It only acts when I tell it to. The actual search is via the Kagi API, but the URL contents is via Playwright. I also ensured it can't do lots of requests at a time. There's a mandatory (random) sleep of between 1 and 5 seconds between two requests.
In less than a week, I've been flagged. When I do a Google search (as a human), I have to prove I'm human. Many sites have simply blocked me - I can't buy stuff from various vendors[1], I cannot access several news sites, etc.
The thing is, I didn't really access that many sites with the bot! At most it's the equivalent of someone mildly addicted to the web. Yet they caught me quickly.
Obviously, I disabled the bot's capability to get site content. I wonder how long my IP will be in the blacklist.
I know some people will say "Good riddance" to the outcome and to what I did. I'd love to have a real, serious discussion on whether what I did was immoral. But whatever your thoughts on the matter, do ponder over the fact that the system has made it hard for average Joes like you and me to have this "feature", but if you pay a giant tech company a monthly fee, you can have it.
[1] Thankfully, Amazon didn't block me. In the past I'd avoid them, but now I'm in the dilemma where I don't want to buy stuff from sites that make it difficult for me to buy stuff from them!
nostrademons 20 hours ago [-]
I think that major gateways like Google and Cloudflare and Akamai are doing things like TLS-fingerprinting and smearing.
I normally use a VPN to access the Internet. It's an ordinary consumer-grade VPN, and I use it for pretty innocuous things like watching the international versions of Netflix or avoiding being geographically-profiled and charged more when I book travel. The VPN itself, I'm sure, is being used for all sorts of naughty stuff: when I look it up in whatismyip, it comes up as VPN, "abuse detected", and "residential proxy detected". I expect to get blocked occasionally on it and just pause the VPN then.
What I found surprising is that pausing the VPN doesn't always clear the CAPTCHAs. The next request will also fail, sometimes. For a while I was wondering if I have a residential proxy on my network, but I went hunting with lsof and bandwidth monitoring and a list of all the open connections through my router, and it seems clear. Yet even with VPN disabled, I'll get CAPTCHAs from Google and Cloudflare.
I suspect they're using browser/TLS fingerprinting and then smearing the results of that across bad IPs. If you connect to them through a known-bad IP, they not only will CAPTCHA you, but they will record a fingerprint of any data they can. Then if you connect again with that fingerprint, regardless of the IP, they block that too.
Ironically, if you are actually malicious, you can get around this pretty easily. Because you'll know not to use a fingerprintable browser, or to rotate fingerprints. So you have one completely separate identity on a given IP (that is not yours), and if it gets blocked, you roll up another completely separate identity on a different IP. But this is too much work for an ordinary consumer who just wants to keep their IP private. So you end up with this excluded middle where the only rational strategies are to either do exactly what the website expects you to do (with no funny business, even if it's innocuous), or to go whole-hog as the aggressor where you're determined to skirt their policies no matter what, and if you're doing that you might as well amortize the effort by extracting everything of value you can from them.
BeetleB 13 hours ago [-]
Yeah, I didn't want to put too many details as it would obscure my point. I was actually using a modified Playwright that's been designed to better act as a human. It works, in that I got fewer captchas etc than regular Playwright, but apparently not well enough.
That modified Playwright was based on Firefox, and that's what I use for my regular browsing. So that didn't help.
I can actually launch Chrome and not deal with this - but I'm not going to. In fact, what surprises me is that I can create a new Firefox profile and not get those captchas. I don't know how my using that modified Playwright as a bot got them hooked on to my Firefox profile. I suspect they had my FF profile as a "suspicious" entity even before I made the bot (I use a number of privacy/anti-cookie extensions), and the bot pushed the score over the edge.
I'll probably start fiddling with my profile - disabling extensions, until things seem to work. Thankfully, no one else in the household is impacted.
For now, I got around all this by just paying for the Kagi extract API. It's not as good as my modified Playwright had been, though. I thought of a VPN, but I suspect that won't last long (not a residential proxy, etc), and I don't want an ongoing monthly fee. I like Kagi's pay as you go option.
But as I said, it's a weird world where suddenly Amazon is coming out the "better" site/vendor. It's funny - in the old days I was pretty anti-Walmart, but a few years ago I started preferring them over Amazon (and even several local stores) for a number of reasons (better collection than local stores, not having to deal with fakes for online orders, etc).
I've not been liking the state of the web for years prior to the advent of LLMs, but this is feeling like a final straw where I accept "the web is dead". We need a fundamentally different protocol - the model of "Set up a server anyone can reach, put content out there, and then put up a lot of sophisticated technology so your server isn't hammered" is not tenable. The protocol itself needs to manage the load.
83 14 hours ago [-]
My residential network has been on Google's shit list for a few years now, I don't think it will ever go away. Like others on this thread if I see a Google recaptcha that site won't get my business as I have to exit since the captcha is an infinite loop.
proxyscore 1 days ago [-]
Expect to remain blocked, that's how defense works, some services plenty use will have is bot or known proxy exit node set to true, and some websites use the same defense services, request velocity is just one factor, if you don't have random human like scrolling and jitter with a bot, it's a dead profile walking, metaphorically speaking
itishappy 1 days ago [-]
I don't think this is an immoral application at all from your description, but would that be clear on the receiving end?
hnthrow10282910 16 hours ago [-]
I just did this as well. I also added paywall bypass by default along with inline article chat. The internet is such trash these days.
I made my modifications at the network level and auto redirect a configurable set of sites to go to reader mode/paywall bypass by default with a MITM proxy and a custom CA cert I trust
21 hours ago [-]
cowlevel 1 days ago [-]
Just restart your home router to rotate your IP address.
qlte 1 days ago [-]
That is entirely ISP dependent and many don't actually work like that. Your cable modem gets a specific IP for as long as Comcast or whoever sees fit, restarting does nothing on the WAN side.
Denatonium 5 hours ago [-]
On cable ISPs, oftentimes, changing the router's WAN interface's MAC address and then rebooting the modem will get you a fresh IP address, but rebooting the modem without first changing the router's WAN MAC address will get you the same IP address.
consp 22 hours ago [-]
In my case a downtime of over 4 hours will switch it. Might just be lease time doing its job.
drewnick 1 days ago [-]
True, I've had the same IPv4 address since 2018 on Spectrum despite rebooting at least 10 times.
prmoustache 17 hours ago [-]
This is simply called the dhcp lease time. Restarting has never forced a change of ip on a system using a dhcp client.
theGeatZhopa 19 hours ago [-]
It depends on the DHCP part and your provider lease time. When you access the Internet through a modem and landline, it's an highly dynamical system, where it's difficult to guarantee every caller/user gets its own IP. Especially when IP sharing is used among the clients. Even more difficult it is with the mobile Internet. It's a constant connection loosing/reconnecting. Actually resetting and freeing up IPs for new devices, the whole time. With cable Internet (the TV cable) one is having a kind of stationary access point. The network provider can see it's topology and it never changes once a leafe has joined the network. I typically have the same access creds over months. Even when I restart my cable modem, it's still the same IP. When I was on modem, I could get a new IP every second of I wanted. Now I have to think twice, because I just can't get a new IP, even if is forcedly, not.
proxyscore 1 days ago [-]
Doesn't work like that, only on mobile phones you can toggle airplane mode to get a new ip assigned and cgnat makes sure mobile ips are "trusted" , but they fingerprint you beyond ip address
TheDong 24 hours ago [-]
> I know some people will say "Good riddance" to the outcome and to what I did.
I will instead say "skill issue".
Using Playwright results in some very obvious and easy to detect fingerprints. I'd expect better of someone on hacker news.
Mine hasn't been detected as far as I can tell, so I know it's possible to do better.
DANmode 21 hours ago [-]
Weird to hide basic stuff like random mouse-paths, mouse wiggle.
lynx97 20 hours ago [-]
elitist nonesense. "Look I am soooo cool, and you are not as cool as me."
franga2000 20 hours ago [-]
1) The proxy isn't the scraper. There are plenty of scrapers not using residential proxies.
2) They're clearly talking from the perspective of the user and network admin. A residential proxy virus is in fact quite benign for both.
3) No matter what, DoS is quite a low priority in terms of security. And it's not even really DDoS, you'll know a real DDoS when you're on the receiving end.
account42 18 hours ago [-]
> A residential proxy virus is in fact quite benign for both.
That's only because it isn't being prosecuted appropriately.
franga2000 18 hours ago [-]
Let's not get ahead of ourselves... If someone plants a bomb under your car, you drive to work, then it blows up while you're out for lunch, should you be prosecuted?
I'm all for creating consequences for people who negligently don't secure their systems and people get hurt because of it, but people who installed a mobile game that has a proxy library in it? Please, chill.
cyanydeez 1 days ago [-]
Compared to, russian intel scraping beyond demented word of mouth.
miki123211 21 hours ago [-]
> The web is getting harder and harder to use
What are you doing to make this true?
I'm a screen reader user (which is as "weird and unusual" as it gets when fingerprinting mechanisms are concerned), and I am not really noticing much difference versus 2022 or so. Sure, there's little bits of anubis here or there, and a few sites (which I know for a fact are experiencing targeted DDoS attacks unrelated to AI scraping) having annoying Cloudflare verification screens, but that's about it.
My setup (other than the screen reader) is as vanilla as it gets. Safari, AdGuard for Ad blocking, no VPN except work VPN when necessary, no PiHole, no settings changed. If you're using something more esoteric, maybe try going mainstream and see if that improves your experience.
coke12 20 hours ago [-]
What do you mean by “anubis” here?
account42 20 hours ago [-]
It's a DRM middleware used to harass users of customized and privacy respecting browsers which is popular with many smaller websites.
Aldqueath 19 hours ago [-]
I am not sure what you are doing to get "harassed" by anubis but I use privacy respecting browsers with ad blockers and vpns myself, and anubis is by far the least annoying, almost invisible even.
In comparison I get cloudflare recaptcha on every site that uses it, sometimes multiple times per session and sometimes not even letting me pass at all due to "error".
And if the website uses Google recaptcha then I close the tab because I know it will just end up in endless recaptcha hell.
jacquesm 19 hours ago [-]
Google too. 'We are detecting unusual traffic from your address'. I don't know how often I've seen this and there isn't a byte that goes in or out on this connection without monitoring so if it really would be 'unusual' I would hope I would be on it before Google told me, especially not from a session that's been active for days or weeks.
account42 18 hours ago [-]
If you need to compare the project to Google and Cloudflare in order to look less bad that's not exactly a good sign.
andrepd 14 hours ago [-]
Come on... This thread has people saying their small website went from 1k requests a day to 100 requests per second. What would you have them do to mitigate this, I wonder? I would rather not have to have an anime girl picture stalling the website load for 1s, but I'd rather have the anime girl and see the website than no anime girl and no website.
barbafant 18 hours ago [-]
Is that the one that shows an anime figure holding a magnifyig glass while it is checking your browser?
notafox 12 hours ago [-]
You can remove the figure - here's uBlock Origin filter to block it from loading:
Yes, and at least in the past it did proof of work to verify that it wasn't a bot. Though apparently that is no longer effective against all bots.
19 hours ago [-]
tempfile 18 hours ago [-]
Please substantiate this claim. What do you think makes it DRM? What kind of browser are you using that results in "harassment"? I use tor browser and other oddball firefox forks all the time, Anubis never gave me any trouble. I think it just requires you to compute some hashes.
kasey_junk 17 hours ago [-]
It’s a software tool that specifically exists to allow content creators to enforce rules about how their content is used. It meets the dictionary definition of DRM.
It’s DRM that I think of as silly larping that doesn’t really bother me, but it’s clearly drm.
tempfile 15 hours ago [-]
> It’s a software tool that specifically exists to allow content creators to enforce rules about how their content is used.
This is what I would like substantiated. I can go to a site behind Anubis, download the content on it, and do whatever I want with it. It doesn't do any kind of attestation of hardware or software. So - what makes it DRM?
philipwhiuk 18 hours ago [-]
This is such a wild re-imagining of 'preventing uncountable AI crawlers perform DoS attacks on a whim to make line go up'
While your server handles that, what does your CPU do with the other 99% of available cycles?
I run https://bunnystomp.com on an Always Free VM from a major cloud provider. It handles 1,930 req/s at 33 ms latency with no tuning/optimization. It's literally just python behind cloudflare.
mzajc 1 days ago [-]
You seem to know a lot about my server. From what I could see, all cores were pinned to 100%, but maybe my budget AMD CPU is hiding fantastical amounts of compute from the kernel. I'd love to know how to make use of it.
I have no idea what the site you linked does, but it doesn't look like a cgit instance to me; that's what got hammered on my end, and when hosting it, one very quickly finds out that many git operations are CPU-bound.
NavinF 17 hours ago [-]
Funny. My site is a search engine and cgit is one of many tarpits that I block. Otherwise the index gets filled with garbage and the crawler hits TCP conn limits because the bytes trickle in too slowly.
fn-mote 1 days ago [-]
If you want credibility from the get-go, you need to be up front about your application. I certainly took it to be a generic host for an unpopular site in your first comment.
yard2010 20 hours ago [-]
Nah this is hn, just trust people upfront
_alternator_ 1 days ago [-]
I'll just note that "compromised" is perhaps too strong. These services often come from VPN plugins (eg Hola VPN) that lets users watch sports from different restricted geographic regions. There is a trade here that's in the TOs: you get someone else's IP address, they get yours.
jeremyjh 1 days ago [-]
Compromised describes exactly what you are talking about. Any free rider on a network that the operator is unaware of means the device is compromised.
nomel 1 days ago [-]
If I'm using one of these services while connected to a guest wifi network, with the usual configuration for guest access (like no intranet connections), is that guest wifi network compromised? What's the threat model?
autoexec 24 hours ago [-]
> is that guest wifi network compromised?
I'd say yes since you've allowed random people unauthorized use of the connection. It makes no difference if it's your connection or not. For example, if that proxy gets used as part of a DDoS attack, your device compromised that network.
thefounder 20 hours ago [-]
how is this different than Tor? You seem a bit on the surveillance side. The computer/network is compromised if someone gains unauthorized access to it not if you share it.
forgotaccount3 15 hours ago [-]
> The computer/network is compromised if someone gains unauthorized access to it not if you share it.
Yes. And someone did get unauthorized access to it. You don't have the permission to delegate authorization to a third party.
Did the third party connect to the guest wifi or did they connect to your computer and you have allowed them access to the guest wifi?
Did they agree to the ToS that the wifi network requires for people to use it?
Are you certain that the wifi network isn't intentionally limiting the area where it is broadcast, allowing only people within that geographic area the ability to connect to it?
If there is a purely 100% open wifi network who is only limited geographically due to technological constraints but would allow anyone in the world to connect to it if the technology allowed, then using your device to solve the technological constraint of limited wifi range would not fall under compromising the network IMO. Assuming again that the operator of the network publicized it as such and you aren't just making assumptions about their intentions.
thefounder 13 hours ago [-]
That's mind bending gimnastics. So if you connect a device(i.e. a TV) to WiFi and there is a Netflix app that's downloading movies in background then Netflix has gained unauthorized access to the network because somehow is not `directly` connected to the home router(like a kind of long cable from directly from netflix server into the home router ) ? Did Netflix agree to the ToS of the Wi-Fi network provider? What a stupid thing to say...I would expect more from this community.
autoexec 11 hours ago [-]
> So if you connect a device(i.e. a TV) to WiFi and there is a Netflix app that's downloading movies in background then Netflix has gained unauthorized access to the network
There are two main differences. Netflix is working on your behalf. Connections initiated from netflix are no different from connections initiated from your web browser or your email client. Your use of the internet, for you, is authorized. With a proxy you have no idea who is connected or what they are doing with that connection. That network activity uses you, but isn't by you, or for you.
Finally, netflix isn't likely to be hacking, attacking, spamming, or attempting to bypass bans or IP blacklists over that connection, but those are exactly the kinds of activities that shady residential proxies are used for. By using those kinds of apps you basically backdoor/bot your own computer, and now access to the internet through it is being sold to people who want to use it for things that they couldn't get away with when using a VPN or any other legitimate provider.
Depending on the sophistication of the wifi network you may be held liable and accountable for everything that takes place over that connection, including whatever nasty things the people who bought access to your proxy get up to.
If the wifi system isn't set up to keep careful track of who is using it and when (as is common in places like coffee shops), the liability will fall to the entity offering the wifi access, and if that connection is repeatedly used for activity in violation of the law, or the AUP of the ISP being used, that same entity will face the repercussions. Their internet connection may be temporarily suspended. They may have to start blocking certain ports and services, or deny access to specific websites. They may even be forced to stop providing wifi access to guests entirely unless they are willing/able to spend the money needed to log and monitor who is using their connection and respond to notifications of abuse over their network as well as legal requests.
Places like coffee shops that just want to offer free wifi to their customers without worrying about that kind of thing are only able to do that because a small number of local individuals are using their connection. Locals who presumably enjoy being able to the internet at that location and won't take advantage by abusing it. Individuals who are also typically on camera, in full view of employees and other customers.
That kind of very common set up is insecure by nature and those companies are putting themselves at risk by offering the service, but it mostly works because the access is time/location-gated and most people in the neighborhood are generally not criminals. Allowing criminals from all over the globe to access those kind of connections through your device is allowing unauthorized access, and is also being a dick, since you're basically shitting in the pool everybody wants to be able to swim in. It greatly increases the risk that the wifi gets shut down, gets more locked down, or the IP address gets blacklisted making it less useful for everybody who uses it, including you.
account42 18 hours ago [-]
TOR doesn't use unsuspecting participants as exit nodes, that's something you have to specificially enable.
shakna 18 hours ago [-]
If that guest WiFi network is running inside the White House? Yes, I'd say that is compromised. The threat model being that guests on that network may be diplomatic officials and staff.
nomel 7 hours ago [-]
You've confused intranet access with internet access. Guest networks rarely have intranet access, even between clients. They usually exist for "I don't trust this person on my network, but they want internet access".
jappgar 17 hours ago [-]
That's not how Hola
works. You're not sharing your IP with some other Hola user. You're sharing it with bots used for all sorts of good and bad things.
tclancy 1 days ago [-]
What part of that isn’t technically “compromised”? You can argue there’s no evidence of it currently being weaponized but I’d say some shitbird running a free vpn inside the White House is not a good look regardless.
cowlevel 1 days ago [-]
We'd need a pedantic definition of "compromised" to be sure
50208 1 days ago [-]
Why wouldn't an adversary be using it to conceal command and control traffic?
lesuorac 1 days ago [-]
> This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…
I mean politicians are so addicted to twitter the nsa makes special phones…
dylan604 1 days ago [-]
Not sure which direction you're intending this. The NSA is making special phones to protect politicians, or to make it easier to ensure they can read everything?
za_creature 1 days ago [-]
Por que no los dos?
It's always better to protect politicians from someone else
lesuorac 1 days ago [-]
Politicians bringing phones isn’t a scif isn’t necessarily a bad thing.
YeahThisIsMe 1 days ago [-]
[flagged]
senordevnyc 1 days ago [-]
Why would you assume everyone in the world gives a shit about this?
dylan604 1 days ago [-]
Why are you so surprised that the US gov't is being spied on? Of course they are. Why/how could you ever suspect they would not be? How Polyanna can one be to think this way?
hackernud3s 1 days ago [-]
Those are better than residential proxies. Those are White House proxies. I would pay $10/GB for those babies.
BLKNSLVR 1 days ago [-]
Those proxies are paid for in rubles, not dollars.
dmtroyer 13 hours ago [-]
More likely part of a blackmail agreement.
9dev 1 days ago [-]
They are (p)residential proxies really
mrefish 1 days ago [-]
Executive residential proxies
seethishat 1 days ago [-]
I have T-mobile 5g. My IP shows up as a residential proxy. I can't control the T-Mobile 5g device. It's a black-box. And, I only have one Linux desktop on the home network (so no Windows/Mac malware).
Not sure why my IP is listed as a residential proxy.
hetspookjee 1 days ago [-]
There’s only that many ipv4 addresses and I believe all 5G are shared ones. That’s why they’re among the most valuable ip ranges for scraping. You can’t just naively ban that IP or you’ll ban a large group of users
BLKNSLVR 1 days ago [-]
You certainly can ban that IP.
It should be a balancing act though, somewhere between what you said and my first sentence.
Rate limiting, or additional layers of input sanitisation for IP addresses known to have been malicious in the past.
It's unfortunate that good users will have to endure some difficulties because of bad users on the same network, but if security is the priority, then measures must be taken, you shouldn't just leave to door open to potentially known bad users / traffic.
IPv4 is a shared resource, but some ranges have worse reputations than others, and all are owned by organisations that have the ability to monitor and filter for malicious traffic. It gets into a fraught discussion about censorship, but it is possible for network owners to monitor for, and block / restrict traffic detected as 'bad'. It's just a matter of cost and scale, and those that put the effort in should have their users rewarded with fewer 'trust-issues' roadblocks.
skinfaxi 1 days ago [-]
> It's unfortunate that good users will have to endure some difficulties because of bad users on the same network, but if security is the priority, then measures must be taken, you shouldn't just leave to door open to potentially known bad users / traffic
Is this like a corporate support response? I legit can't tell. Try explaining to a retail consumer why they can't buy from your site because they have TMobile service.
what 1 days ago [-]
They’re saying T-Mobile should be monitoring traffic on their network and block traffic from bad actors that ruin it for everyone for everyone else? Or at least they do in the next paragraph.
skinfaxi 1 days ago [-]
When the bad actor is grandma who has an infected computer, T-Mobile will be dealing with a lot of support calls from objectively non-malicious actors.
Gigachad 1 days ago [-]
The blocking of residential proxies might be the thing that moves the world to ipv6. These days what we need is a dynamic map of all the IPs running proxies so servers can block them. If every device gets it's own v6 address, you could block just the TV running the proxy. Modern crowd sourced security products could identify the proxies and share their IP live so you can ban and unban addresses as the device moves.
The TV can just pick a different address when it notices that it is being blocked.
Gigachad 20 hours ago [-]
In that case you’d just block the whole subnet that the TV is using.
1 days ago [-]
neuroticnews25 20 hours ago [-]
>you shouldn't just leave to door open to potentially known bad users / traffic
Why not? If security is the priority, the worst that could happen from that is clutter in logs and higher resource use. Nobody wastes 0days spraying them on random hosts, and a real motivated attacker targeting your server will not be stopped by an ip blacklist.
sva_ 1 days ago [-]
Not sure about US but where I live I can manually set the access point of my phones mobile network and it gives me a unique ipv4 (new one each time in fact)
hod6654 23 hours ago [-]
Care to elaborate? Your mobile network operator gives you a long list of APNs that you can use?
sva_ 9 hours ago [-]
No, you have to manually enter it, and it isn't well known
hod6654 2 hours ago [-]
How did you find out? And how long is the list of working APNs?
ofcrpls 1 days ago [-]
You might just be experiencing T-Mobile's CGNAT on mobile broadband?
walrus01 1 days ago [-]
You're almost certainly behind a cgnat shared with a bunch of compromised/residential proxy running phones and other traffic.
cowlevel 1 days ago [-]
Or ones who are running it knowingly to make money. Can that even be called a compromise?
cannonpalms 1 days ago [-]
T-Mobile esp. their 5G network is behind CGNAT
jimz 13 hours ago [-]
And of course everyone downstream like Google Fi are carried with it.
1 days ago [-]
janoelze 17 hours ago [-]
How did nobody make a (p)residential proxy joke yet?
spiderfarmer 15 hours ago [-]
The proxy for Russian propaganda also runs a Russian proxy.
Georgelemental 15 hours ago [-]
Don't be ridiculous. It's obviously Israeli
baggachipz 14 hours ago [-]
whynotboth.jpg
partyficial 14 hours ago [-]
Russraeli
j2kun 1 days ago [-]
Out of curiosity, how would I check my own device for a residential proxy?
I pinged the web team, they will work on something to make this more legible. (Edit: they have started work on this; if you have any other feedback, please let me know) — Abdullah | DevRel, IPinfo
zahlman 1 days ago [-]
Freaky. They have a page explaining the concept (https://ipinfo.io/data/residential-proxy); when I checked it, there was a FOUC showing a full-screen, stretched image of what I think was Dario Amodei's face.
Retr0id 1 days ago [-]
Neat. I almost said "surely this will only detect if your internet connection is itself being routed through a residential proxy", and then I realised that's effectively the same thing!
advisedwang 1 days ago [-]
AFAIU that tells you if your access to ipinfo.io is thru a residential proxy, not if somebody else is using a residential proxy on your network.
reincoder 6 hours ago [-]
We do not run any kind of detection systems when you visit the page. What we do is reference our resproxy detection database, which has a schema like this:
We collect the residential proxy data continuously from independent systems; when you visit the page, we take your IP address and look it up in our database. Note the percent_day_seen field, which is frequency metadata. You can also complement it with our device count data to understand if you are on a NATed IP.
If you are on a static IP address and a single user, we flag your IP address as a residential proxy. I think you should install some DNS monitoring service and start uninstalling unnecessary apps from internet-connected devices.
— Abdullah | DevRel, IPinfo
Retr0id 1 days ago [-]
It's effectively the same thing. If a residential proxy is running on your network, your IP will soon become known as a residential proxy exit.
nostrademons 1 days ago [-]
It detects if your IP is a residential proxy, not if you are using a residential proxy. From the perspective of the outside Internet, they are the same thing, the only one who cares about the difference is you.
0cf8612b2e1e 1 days ago [-]
Fantastic question. There is so much IOT garbage out there that someone might slip into my network, what can I do to easily detect it?
I was aghast when my partner connected a pet watering bowl to the WiFi.
doublepg23 1 days ago [-]
My most worrisome IoT device I have on my network is a digital picture frame my wife connected, but I was surprised the company routinely updates it even though it's on Android 6 (!).
… TIL such things exist. I assume it's networking so that it can grab photos to display from "the cloud" somewhere, and periodically change?
itishappy 1 days ago [-]
Yes. Smart frames often provide an endpoint where friends or family can send photos that will be automatically added to the rotation.
Great gifts! (At least for those unconcerned with privacy or security, which is most people.)
rustyhancock 18 hours ago [-]
It's been some time since I ran this myself but I used to have an openwrt router sit behind my ISP modem/router (it was one unit).
Multiple times I caught unexpected traffic and was able to block it piecewise including a lightbulb(!) that was sending mb packets of god knows what home.
If they were ethernet based I reckon some smart VLAN capable switches would be nice even at home to keep them out of each others business.
I moved home a few years ago and now I'm back with the ISP router and do often feel a little in the dark about what my network is doing!
I suggest you just firewall it away from your important machines and then don't worry about it.
mrguyorama 12 hours ago [-]
Educate your partner.
I had to recently inform my sister and didn't realize just how unaware the general public was of how utterly terrible things have gotten, like with LG TVs or the Meta Quest's access to your family.
When someone tells you "I have nothing to hide, I don't care", let them know that companies like LG make 5x as much money selling your data as selling $1000 TVs, so clearly your data is valuable and you shouldn't be giving it away for free. That's a message normal people can understand.
Watch egress at the router for anything unaccounted for, tbh.
iandanforth 17 hours ago [-]
This article seems to cast residential proxies in a wholly negative light. In fact the company is openly antagonistic to anonymity. I find that perspective diminishes my trust in the rest of their claims.
jappgar 17 hours ago [-]
No one would agree to host a residential proxy if they knew what they were signing up for.
The whole industry is dirty.
deltoidmaximus 14 hours ago [-]
There was a recent DND episode about Android boxes sold on Amazon that came with access to pirates streaming services out of the box. Not surprisingly they were loaded with aggressive local network scanners for exfiltration among other things like being a botnet node. Despite this being proven and shown to people a lot of them just didn't care, many of the reviews just suggested turning it off when you wanted to do online banking or something!
This didn't particularly surprise me (unfortunately). Your average phone is loaded with spyware from "legit" American companies but plenty of them come with carrier spyware, adware or shady apps that auto install. Most people seem to be apathetic about this or have given up so the Chinese botnet device (that reliably delivers lots of illegal media) is just making the same kind of trade they're already making. Look at all the shit about smart TVs in the news recently that people have hardly stopped buying, those don't even come with free pirate NFL games. They've been told they were being spied on for years already and their response was that you're a tin foil hatter for bringing it up, they have nothing to hide or they don't care.
You almost can't blame them though. Even you put a lot of effort into protecting yourself from this stuff you're exposed anyway. Why should they do without their free streaming services when government agencies and companies that they don't even have a direct relationship with lose all their PII a dozen times a year and the DMV legally sells a dossier on them for 1.5cents?
awakeasleep 13 hours ago [-]
The industry is dirty but people would ABSOLUTELY host a residential proxy in exchange for free tv/movies.
It'd be an instant "yes" from everyone making under 80k a year and for many making more.
dgellow 17 hours ago [-]
Residential proxy is the industry euphemism. In most cases they aren’t set up willingly. Access is sold to various bad actors, for data collection, botnets, or for a clean residential exit IP
jimz 13 hours ago [-]
Since when is data collection uniformly bad? In an age where variable pricing is the norm for services and products all over the place, and Google is no longer an effective search engine even if one turns on the "verbatim" option and turns off the AI features, and most people are in a position where it's wise to be frugal thanks to the runaway debt and nonsensical application of tariffs have made everything from ground beef to sporting event tickets sometimes double in price compared to just a few years ago, but exactly how much more is entirely opaque. Also, no service is even particularly good at detecting proxies unless they are actually part of some large oversold ip pool, which isn't even close to the actual case in the wild.
Spur.us on purchasable IPs from a site that sells microtargeted IPs and not large IP pool packages:
Unlimited traffic, under a dollar a pop, what good is a service when it returns the same info as my own ip? It's just hucksters all the way down. The result is that whoever takes some time or already has the skills to appear inconspicuous to the arbitrary standards set by a few almost-literal gatekeepers will have fewer problems running automations compared to the average user who are liable to run into what's turning into a general enshittification of the internet writ large. It's not, after all, illegal to use a residential, or any, proxy service on its own. Although my guess is that the anti-bot measures are going to exacerbate the already flagging economy if it haven't already, it's always going to be the boogeyman du jour who gets the blame, and not the overzealous and mindless policing and gatekeeping who of course would never admit to being part of the problem, even though they are absolutely part of the problem.
stcg 21 hours ago [-]
"Residential proxies" are just botnets: it's mass-spread software under direct central control without the knowledge of the owners of the machines.
port11 21 hours ago [-]
Thanks for clarifying the language. I don’t understand why we softened ‘botnet’, it’s much clearer and powerful.
cryptonym 21 hours ago [-]
You resell a game, bundling a botnet proxy inside, and make it freemium: free if you accept T&C with a service allowing using your device connection for research purposes (or whatever wording could be even more confusing), or pay $20.
It's no longer a botnet, it's a "residential proxy" and you are doing clean business.
port11 20 hours ago [-]
I didn’t know this was a thing. Yikes. I’m gonna freak out now and find a way to prevent that in our home network.
And I’d argue that’s not clean business, the user doesn’t know what their connection is being used for :)
Definitely pretty crazy. This is probably have they’re in the White House, all it takes is a random smart device to install a seemingly benign wallpaper app
cryptonym 20 hours ago [-]
"User accepted T&C" is enough to get away with almost anything. It works very well for top IT companies. Upholding new business to higher standards would be unfair.
BLKNSLVR 18 hours ago [-]
In my head this is Joe Pesci saying "the money is now laundered" in Lethal Weapon 2.
weberer 13 hours ago [-]
Its to distinguish them from traffic that originates from someone spinning up a thousand VPS instances in a datacenter. Its very easy to block data center addresses, but hard to block residential addresses without impacting real customers.
port11 10 hours ago [-]
Then it’s a residential botnet.
oefrha 20 hours ago [-]
Trillion dollar AI companies use/used these to scrape the Internet. You don’t want to smear their good names do you?
krunck 14 hours ago [-]
Maybe. Make sure you aren't attacking valid uses of proxies like Tor.
Refreeze5224 13 hours ago [-]
No one is talking about the issue being proxies. The issue is that they are surreptitiously-created proxies, with the full extent of consent consisting of one sentence buried in a massive EULA that no can be expected to read, by design.
There is another word for a C2 channel being created within a device you own without your knowledge, and that word is malware. And it's most often used for botnets, which is the least malicious thing they are used for.
reactordev 1 days ago [-]
I fear this is just the tip of the iceberg. It's the WH's own TOR node for any paying customer. It's manchurian candidate. It makes Clinton's emails look like ice cream.
mongrelion 1 days ago [-]
What is a residential proxy?
ZoneZealot 1 days ago [-]
It's described at a high level in media often. Here's more detail though:
Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.
Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.
A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.
cpburns2009 1 days ago [-]
This isn't a theoretical problem either. My employer's website was being hammered by residential proxies a month ago. It wasn't until we setup WAF captcha rules that they mostly subsided. It wasn't even the typical exploit scanner. I don't know what the purpose was but it was effectively a DDoS.
cowlevel 1 days ago [-]
Everyone's is. Far as anyone can tell, it's probably AI companies.
cpburns2009 1 days ago [-]
It wasn't any sensible AI scraper. It kept requesting the same pages a thousand times over.
cowlevel 1 days ago [-]
Yep that's what AI scrapers do
cpburns2009 16 hours ago [-]
I thought AI scrapers were generally a little more intelligent than let's spam the same request 1k times (without any obvious permutations).
cowlevel 14 hours ago [-]
Nope
mrguyorama 12 hours ago [-]
These so called "Best of the best industry experts" don't understand what "Air gapped" means, and still don't even after 3 perfect examples.
They do not respect prior knowledge in any way, and think it has no value.
Of course they don't do standard, table stakes things like making their crawler smart. They don't have to. They're better than that or something.
superjan 1 days ago [-]
I was expecting that VPN’s (maybe not all) also use their own customers as relays, but you don’t mention them. Am I wrong?
rcxdude 1 days ago [-]
It's definitely not all VPNs (typically the ones you pay for will buy their own hardware and internet connections in the places you can route your traffic through), but it is a common situation for the shadier (especially 'free') ones, and in that case it's usually not just a peer-to-peer thing, they make money by selling your connection to people who pay because they want a large pool of relatively reputable and disconnected IPs to send traffic through.
ZoneZealot 1 days ago [-]
You're right, a lot of 'free VPN' software also uses your own internet as a residential proxy. It's often mentioned in the ToS but the users don't read that.
dylan604 1 days ago [-]
Honestly, I expect any of those free VPN services that require an app install to be doing precisely this. At this point, I just assume anything with "free" in it will cost me more than if I just paid for something instead.
rustyhancock 17 hours ago [-]
I'm surprised it doesn't cause more chaos, even as simple as people getting copyright infringement notices from their ISP?
deltoidmaximus 14 hours ago [-]
Or worse.
But most likely these residential proxy services are more valuable for scraping, DDoS and manipulation plays on social media so they might not actually be used for things that draw direct attention. Using them to download illegal materials would be a waste of resources when a VPN does the job just as well.
charcircuit 1 days ago [-]
That kind of VPN is considered a residential proxy.
1 days ago [-]
dormento 1 days ago [-]
It means some networked devices in there are being remotely piloted to tunnel network traffic to somewhere else. This scenario usually happens with more "unprofessional" ISPs, which sell bandwidth from their networked clients for people in need of such services.
Such as ignoring web scraping countermeasures, and DDoS.
georgel 1 days ago [-]
There are companies that provide proxy services for scraping services, and residential proxies route through consumer networks (like Comcast) which is flagged less than a datacenter IP.
Many questionable TV streaming boxes pretend to deliver you video, but in reality they are also piggy backing on your personal ISP to power those companies.
Some good answers in this thread. I had the same question but I'm still a tad confused:
* I initially thought this meant someone in the WH network was using commercial proxies to appear as if they were exiting from a different network (which would align with "some user is firing up a proxy on their phone to exit in a different location")
* But then the description of residential proxies seemed to align more with traffic hitting an endpoint in the White House, and _exiting_ from the network there. But this didn't explain the timing (why isn't it 24/7).
* Finally it sounds like some person, legitimately on the WH network, has a device (cell phone, TV, whatever) that, when activated, is proxying outside traffic into the WH network.
RKearney 1 days ago [-]
The 4th sentence in the article has a link to What is a Residential Proxy?[0]
> Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network.
hackernud3s 1 days ago [-]
They really should have said "botnet malware detected", it turns the White House into an exit IP for someone's else's botnet.
Essentially lets bad actors use your home network.
charcircuit 1 days ago [-]
Bad actors as defined by who. Why am I bad for not living in the right country to access a website.
derektank 1 days ago [-]
Because the person whose IP you’re using as an exit node probably hasn’t fully consented to it being used as such.
charcircuit 19 hours ago [-]
So what? Packets flowing through machines is just how the internet works. Stop believing all this propaganda that other peoples papers are EVIL and if you route them you are getting in BIG BIG trouble. This is harmful messaging that does not reflect reality.
cute_boi 1 days ago [-]
[dead]
whalesalad 1 days ago [-]
There are services you can pay for such that you can route internet traffic thru a specific IP in a specific part of the world. People (usually unwillingly and unknowingly) run software that effectively makes them part of a giant botnet. A computer running in Romania might have some kind of weather application or gambling/casino app that I could use to make an HTTP request as if I were on their network. So if you need access to 1,000 or 10,000 IP's to circumvent rate limits or perform crawling tasks, this is how you could do it.
Brightdata still sucks at disclosing to users that they're opted in to this and that their connection is being used for this. It's "on by default", not opt-in and often buried in an unskippable "Accept the terms" or dig-to-opt-out prompt.
bediger4000 44 minutes ago [-]
Why isn't this a 5-alarm fire for the National Security types? I mean, I've seen people fired on the spot for having their own WiFi access point plugged in to company networks, and that wasn't a particularly security paranoid company.
skinfaxi 1 days ago [-]
This site is barely a year old. Where is the data and proof? What is the methodology?
tgtweak 1 days ago [-]
vibe coded "black box" ie: probably shit.
anpat 1 days ago [-]
How would one detect this on their home network and protect themselves from?
blacksmith_tb 1 days ago [-]
Step one, find your public IP, I like ipinfo.io but there are many other services that will show it. Then pop it into a tool like the one that's hosting TFA[1]
In my experience, out of the two, iphunter.info has the more comprehensive database, I think the owner/operator frequents HN.
alam2000 1 days ago [-]
[flagged]
reincoder 6 hours ago [-]
Visit: ipinfo.io/my
If your IP address is part of a residential proxy network, it will be flagged.
Also, I recommend seeing the device count data we have for you. If you are on a NATed IP, you have virtually no control to remove the residential proxy SDK from your system. Let me know if you have any questions, as I work for IPinfo.
EvanAnderson 1 days ago [-]
Unexpected traffic would be the biggest gross red flag. If it constrains itself to moving traffic when it's otherwise perform its desired function (if it's one of those "free TV" boxes and it only proxies when you're playing video) it might be hard to tease-out the unwanted traffic purely looking at bytes in/out.
Beyond that gross metric you're getting into capturing traffic and decoding it.
tom1337 1 days ago [-]
Check network traffic from smart devices would be a good start. If your TV does gigabytes of traffic in the night when you don’t use it, it most likely is acting as a residential proxy.
reincoder 6 hours ago [-]
I work for IPinfo. Traffic data alone is not going to be a good indicator, to be honest. Last time I checked, we recognized 100 million resproxy IP addresses, and resproxy services charge by bandwidth. No single organization can or will want to run continuous operations from a single IP address, as it will get flagged by a non-IP-based bot detection check, and churning IPs generally indicate a standard web scraping operation.
I recommend folks just check our website: https://ipinfo.io/my and if they have questions, ask me, I will try to get to the bottom of this.
What we do is connect to residential proxy IP address and verify them before putting them in our database.
But DNS and traffic monitoring is a good practice. If you see gigabytes of traffic without explanation, you have more serious concerns than resproxy.
mrguyorama 12 hours ago [-]
Don't buy any gadget that connects to a network. None.
xbmcuser 1 days ago [-]
Google just banned a chinese Android tv manufacturer for backdooring and installing malware on their devices. This I think is such a device someone pirate sports or porn streaming device.
OJFord 1 days ago [-]
I've never heard the term 'residential proxy' before, but it seems like a Tailscale exit node would qualify for example? This doesn't seem necessarily malicious or even inadvertently dangerous to me?
oasisbob 1 days ago [-]
Residential IP addresses tend to have better reputations than datacenter networks, so there are providers who sell access to home internet connections. Oftentimes the people running the proxies have no idea they're running on their network, they're quasi malicious.
"Quasi" malicious? What's quasi about it? It sounds completely malicious and fraudulent to do this without the knowledge of the network owner.
oasisbob 13 hours ago [-]
"Quasi" just because the intent isn't necessarily to cause harm to the local network itself.
Residential proxies are a scourge on the internet as a whole, but it's generally in their best interests to be transparent and unnoticeable to the places where they're hosted.
mrguyorama 12 hours ago [-]
There is a semi-valid use case in that proxying your network usage through arbitrary hops is valid for anonymization and privacy.
Things like Apple Cloud relay and other corporate VPN services do make it more difficult for the services my company purchases to find your identity and track you. We are trying to find out how we can continue to prevent credit card fraud while supporting customers to continue using such services to protect their data and privacy.
Literally everything else is malicious though. The purpose is literally just a botnet. The point is to be able to get arbitrary packets stamped with arbitrary and diverse IP addresses to prevent IP address filtering and tracking from being able to block malicious activity.
It's ban evasion.
itishappy 1 days ago [-]
It's pretty much exactly a Tailscale exit node, just one that somebody else installed without your knowledge or consent.
rcxdude 1 days ago [-]
Generally not really. Residential proxies are services that can provide customers with the ability to send and receive traffic from a wide range of apparently legitimate networks (i.e. people's home internet connections). Almost always this is done without the informed consent of the person who owns the device that is used as a proxy, whether it be buried in some agreement somewhere or just outright malware.
The biggest danger is that said proxies can also allow access to internal networks, and as you might guess from how they are installed, are not usually operated by the most scrupulous of organizations.
O_H_E 1 days ago [-]
> whether it be buried in some agreement somewhere
is that actually a thing that was caught before?
debugnik 22 hours ago [-]
Yes, some of these companies offer libraries to turn your mobile app into an exit node and get paid for the traffic. You can find news about Google Play playing whac-a-mole against apps doing so silently, often involving law enforcement as well.
Also some free VPNs use their users as exit nodes for their actual paying customers, good luck finding a user who understands that. It's the obvious way to monetize such a service other than ads.
1 days ago [-]
TZubiri 1 days ago [-]
it’s a well known term in shady markets of the internet, they allow users and abusers to bypass bans and create multiple accounts that cannot be linked with each other by networking intel
cowlevel 1 days ago [-]
And bypass restrictions that are keeping data paywalled as well.
vonunov 1 days ago [-]
And use stolen credit card numbers while appearing to originate from the real cardholder's area to avoid triggering fraud detection
gesman 19 hours ago [-]
I was under the impression that actual ISP providers embed into their modems/routers ability to resell YOUR connection to proxy services and charge for that without customer's consent.
Same happens within cellphones - via native mobile apps pimped by ISP/Mobile providers.
Could it be the case?
deadbunny 14 hours ago [-]
Any evidence of this "impression"?
Good4boothee 19 hours ago [-]
Can anyone recommend home router that makes handling that threat easy for average Joe? As in a simple list, for TVs detected on my network, with streaming services they should be able to connect to, blocking all other traffic from it?
rustyhancock 18 hours ago [-]
Any router capable of being flashed with OpenWRT or their own router is a good start.
asdefghyk 21 hours ago [-]
If residential proxies detected on White House network, why have network admistrators blocked the device?
And
why have they not physically located the device OR at least vastly reduced its possible location , by determining the flow of the traffic from network elements ?
asdefghyk 21 hours ago [-]
Answer my own question - It was actually an outside entity that detected the problem. However , it gives the network admins a way to determine if this activity is happening on networks they are responsible for .....
hdgvhicv 21 hours ago [-]
Good luck turning this presidents kit off
asdefghyk 21 hours ago [-]
A person would think that ... security software running on the users PC would / could detect this problem .......
cowlevel 1 days ago [-]
Based. Can we turn every IP address that exists into a residential proxy, and then finally end this IP reputation stuff once and for all?
reincoder 5 hours ago [-]
I work for IPinfo, and we do not believe in the general-purpose "IP Reputation Scoring."
IP scoring is such a difficult product to do reliably. When someone says we provide IP scoring, you have to ask them based on what and what is your methodology. Now, IP reputation scoring can be good if both the vendor and the customer know what they are looking for very specifically.
For example, there are abusive IP databases. Now, some abusive IP databases run global honeypots, and they can say these IP addresses tried to exploit the CVE patterns. Sounds good, so when you buy their product, you can say the scoring they are providing can help with blocking IP addresses that run automated CVE exploits that match this pattern. Those services act as beacons, rather than a flat, generic, and everlasting database of bad IP addresses.
Now, do you take that score and try to use it as a baseline for protecting your login portal or credit card fraud? Of course not! You have to go to specialized vendors who provide specialized scoring.
We do not do IP reputation because we provide IP metadata that we can verify, and we can discuss methodologies publicly. If you ask us to do IP reputation scoring, we can easily do that, as we run a global honeypot ourselves as well. But that will involve us providing explanations and education to folks that the score you see fits a very specific pattern of attack that is not generic.
For example, we sell residential proxy detection data, and the database contains 100 million IP addresses. Are all 100 million IP addresses bad? Of course not. But this is not our call to make; our customers have to see the metadata we provide as well, such as percent days seen, last seen, etc. Now, if an IP address is flagged for being 100 percent seen and the last seen date is fairly new, it fits a certain threat model which can be categorized as concerning.
BLKNSLVR 1 days ago [-]
I'd still find a way to block your scrapers.
cowlevel 1 days ago [-]
Such as what? I've tried to block scrapers on my website, and only the low effort ones are easy.
BLKNSLVR 21 hours ago [-]
Pure speculation, I don't have any concrete answers. I'm fairly scorched-earth with my blocking, but I'm only protecting personal environments, so no one other than scatter-gun-everything AI-scraper-bots would even bother.
I'd be very interested in AI capabilities in detecting anomalous activity given that it should be very effective at pattern matching across large data sets. What would be required, however, is significant training with industry/application specific 'normal' browsing traffic patterns to determine acceptable tolerances, and then design escalating deterrence if and when tolerances are breached.
How is the scraper process stepping through the site? It must be programmatic, even if it's programmed to be random. What does that look like in traffic data in terms of timing and content requests?
What hazards can be put in place that a normal user would never go near, but a scraper is likely to trip over?
If scraping is being performed from multiple locations in parallel, what might that look like? ie. joining multiple sessions together that may show a more 'scraper' kind of behaviour.
Under IPv6 wouldn't detection start burning a lot of addresses? Yes, the pool is large, but that just means it's a scaling issue from IPv4 to IPv6, rather than a new problem requiring new thinking to solve? (assuming ways of detection were successful).
I'm being somewhat devil's advocate in my blocking rhetoric. The internet is in a weird confluence of wild-west and surveillance state. I like that there are ways and means of being anon-/pseudon-ymous; I like a bit of anarchaos, that's where the spirit of hacking lives. But I also don't want it sticking to my boots when I walk in the house. I'm also not fundamentally against scraping; there's definitely good scraping. There is an irony, though, in protecting scraped data or services that are built on scraped data (and I'm not accusing you, personally, just my general logical ideology of scraping). On residential proxies, I think they're 99% run by erstwhile criminals leveraging what were, until recently, referred to as botnets into a service they can launder their botnets through as 'I am legitimate business man'. I think most, basically all, residential proxies are run involuntarily or unwittingly and that blocking them would provide a greater society benefit than it would a drawback. Anything that promotes the sanitisation of end user devices can only be a good thing. The whole ecosystem is in a terrible state and regulation doesn't even seem to be on the distant horizon.
Maybe I'm hypocritical, or I'm trying to maintain mutually exclusive positions. This is where I'm at though.
cowlevel 14 hours ago [-]
The smart one opens a URL in real Chrome in a brand new profile through a residential proxy.
privacyishuman 1 days ago [-]
I was just thinking, what company's reviews could you trust the least than a residential proxy provider.
They’re too polite to say it explicitly, but when they say:
> Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.
There really aren’t very many candidates for who that person might be and it really seems like it would be someone who, I don’t know, maybe lives where the traffic is originating.
dpark 1 days ago [-]
A lot of people work at the White House. Many of them doubtless work a night shift. The set of candidates here is actually quite large.
mrandish 1 days ago [-]
> A lot of people work at the White House.
I'm no expert but even I've read that "Works at the White House" is bigger than the executive residence and oval office, including the West Wing and the big office building that's directly connected to it by basement walkways. The National Security Council maintains 24-hour watch operations in the Situation Room (which is more a 'complex' than 'room'), while regional desk officers routinely work late evenings to overlap with morning business hours in Europe and Asia.
I asked Gemini if my recollection was correct and got: "The EOP network (managed by the EOP Office of Administration in coordination with Presidential Information Technology Community entities like the White House Communications Agency) operates as a single campus enterprise network. Its high-speed backbone links the West Wing, the EEOB, the East Wing, and nearby administrative facilities such as the New Executive Office Building (NEOB) on 17th Street."
So, definitely an issue that there's a device with some rogue malware installed but the total workforce across all shifts at the White House Complex is roughly between 2,500 and 4,000.
HaZeust 1 days ago [-]
"and the big office building that's directly connected to it by basement walkways"
I ask in good faith, but why didn't you just say the Treasury Building?
praxulus 1 days ago [-]
Most people don't know that the Treasury Building is a big office building directly connected to the White House by basement walkways.
Wistar 23 hours ago [-]
I didn’t.
HaZeust 1 days ago [-]
Fair point!
KptMarchewa 19 hours ago [-]
Because it's about Eisenhower Executive Office Building
14u2c 22 hours ago [-]
Why is this omission of any note? I know the building and I can tell you that it is not particularly remarkable.
sailfast 17 hours ago [-]
Because it's not the treasury building lol. There are multiple buildings near the White House that are under this umbrella, and I wouldn't think Treasury is one of them since they need their own office space.
devindotcom 1 days ago [-]
the show that came out recently, The Residence, while obviously fiction, made me think about the white house as a semi-public event venue in near constant use by dozens if not hundreds of people. It made for an interesting setting for a whodunit.
CGMthrowaway 1 days ago [-]
Of course it is. It's "The People's House." Look up the Great Cheese Levy of 1837, Lincoln's Office Hours, Coolidge's reception on New Years 1927 or Jackie Kennedy literally giving an "MTV Cribs" on TV in 1962. Or consider, if you can remember, the outcry when they permanently closed Pennslvania Avenue in 1995. Or when they closed Lafayette Square in 2020.
samudrijan 1 days ago [-]
There used to be around the clock anti-nuclear vigils in Peace Park, with soup kitchens feeding folks who lived at their signs.
ethbr1 16 hours ago [-]
It's amazing thinking about Teddy Roosevelt following the New Year's Day tradition of shaking every single person's hand who showed up at the White House.
Which in the 1907 case meant 8,513 people's hands.
eloisius 1 days ago [-]
But if you’re the cleaning staff at the White House do you just get on the WiFi?
nomel 1 days ago [-]
Do you believe the availability of wifi for staff/guests is somehow unreasonable? Or, is there a belief that no internet (wifi or cellular) connected devices are allowed on premises? Is them using cellular data, rather than a guest network, somehow more secure?
RobotToaster 23 hours ago [-]
I'd hope the guest network is completly separate.
rightnutwingjob 22 hours ago [-]
I don’t understand. Is it not?
nomel 22 hours ago [-]
Maybe I'm confused.
Guest networks are configured to disallow intranet connectivity, so the "security" risk would be from the device having access to the internet, on a guest network IP. But a guest network exists for the purpose of giving untrusted devices access to the internet, without compromising the security of the intranet. My local library, the local airport, Home Depot, the movie theater, etc all have public wifi, yet nobody would claim they were directly compromised. I understand the connection could be used for receiving and sending packets over the internet, like a DDoS (which would trigger rate limits, even at Home Depot), but framing a guest network, giving an untrusted device access to the internet, as some security issue seems very odd. The isolation is the mitigation.
asdff 20 hours ago [-]
The difference is the home depot does not have spies applying for custodial roles. I’d expect nonessential staff to put their phone in a box at the security check. We also live in a world where israel can remotely explode telecom devices they rig in supply chain intercepts.
nomel 8 hours ago [-]
Again, why is it worse than a device with cellular access? Again, is the belief here that there are no internet connected devices on premises? We know this isn't true, from the twitter feeds of guests!
dpark 1 days ago [-]
[flagged]
viraptor 1 days ago [-]
You can see lots at wigle.net But it's a noise of quite a few meme submissions and lots of useless HP OfficeJet and DIRECTV entries...
nxobject 1 days ago [-]
Well, there's certainly still a DOGE Starlink terminal up on the roof. (The one they didn't demolish.)
mbreese 1 days ago [-]
Even if it was active, that wouldn’t be part of this network, would it?
OtherShrezzing 18 hours ago [-]
I can't imagine you'd need very many days of traffic to narrow it down to a very small group of people though. If a device is coming into and out of the campus, that should be fairly easy to reconcile with visitor records. Given that this is one of the most secure locations in the world, I'm reasonably sure a comprehensive list of "who is and isn't on campus" at any given time is available.
maccard 17 hours ago [-]
My prosumer ubiquiti gear will give me the MAC address and AP that the device is connected to, along with signal strength. WiFiman and a 5 minute walk will give me the mapping of where had that signal strength from that AP and at that point I could find the device with a physical search. There is no way that this device can’t be found in a few hours by anyone who is even vaguely paying attention.
cozzyd 1 days ago [-]
it is easy to correlate with known public travel...
rob74 19 hours ago [-]
Even if many sometimes work at night, you would expect them to also regularly work in the morning, which isn't the case here? So the fact that almost none of the traffic is in the early morning is a further clue pointing to a certain resident whose office hours start around 11 AM...
wtch98 19 hours ago [-]
Cleaner that comes in after normal office hours, with a phone which connects to guest wifi, which is segregated on the LAN side, but has public IPs from the Whitehouse AS
deskamess 1 days ago [-]
But countable.
gwbas1c 15 hours ago [-]
To know that, you'd have to know the pattern of days that it's active.
If it's someone who lives there, it would be different than a shift worker.
__MatrixMan__ 1 days ago [-]
Not if you exclude the ones who behave as if the rules apply to them.
typeofhuman 1 days ago [-]
[flagged]
lostlogin 1 days ago [-]
Cocaine in the White House would be be of the least concerning things that’s ever happened there in my view.
Libcat99 1 days ago [-]
Found in storage cubby #50, an area where tour groups and visitors leave phones and personal belongings before entering secure or guided spaces.
This almost certainly had nothing to do with the administration. A single search would show that, for those interested in taking that time.
This is why politicians keep repeating the same lies. Said often enough, people believe them.
Some visitor forgot their nearly empty baggie of coke and conservatives convinced you Hunter Biden was doing blow with Joe in the Oval Office.
rightnutwingjob 22 hours ago [-]
Likewise, if the nearly empty bag of cocaine was found* while Musk & Trump were working together, Progressive Liberals would be calling for their execution.
I mean, the nearly empty bag of cocaine isn’t necessary, Progressive Liberals do call* for their execution.
throwaway-blaze 1 days ago [-]
[flagged]
BLKNSLVR 1 days ago [-]
I like to be unipartisan (or is it panpartisan?), all politicians do bad things.
saaaaaam 23 hours ago [-]
Non partisan
dpark 24 hours ago [-]
This fake martyrdom is so tiresome. “No one lets us talk bad about Biden/Pelosi/Newsome/Whoever. You can only say bad stuff about Trump!”
Boo hoo. No one’s stopping you. No one’s cancelling you. If you have something you say, then say it. Otherwise stop crying fake tears about the mean liberals who are somehow censoring you.
But if it want to talk about the baggie of coke, maybe do any research at all instead of listening to lying politicians who claimed it belonged to Hunter Biden with zero evidence (and zero logic).
wtch98 19 hours ago [-]
Most people working shifts will work varied shifts, sometimes nights, sometimes days, sometimes they'll be missing for days or weeks on end
EA-3167 1 days ago [-]
If it keeps happening I think that at least suggests the source is someone or some people who are “above the rules” most people would be bound by. You can tell the cleaning crew to get off the damned WiFi, others not so much.
therein 1 days ago [-]
Could even be cleaning or security.
dpark 1 days ago [-]
As someone elsewhere in the thread noted, this could well be the press. Could also be that this isn’t the White House network at all despite that attribution.
xp84 1 days ago [-]
Right, we know the White House owns that public IP, but this could be as bad as an unsecured, unmanaged device that is joined to a private network that is supposed to be secured, OR, on the “all the way good” side, that IP could be the exit for a completely throwaway, untrusted, isolated LAN segment meant only for some iOT device and which has no route to any other peer on the LAN side, and some civilian who has access to that for work brought in his laptop with a “free VPN!” Plugin and joined it to that network because it’s all he had credentials for.
duskwuff 24 hours ago [-]
One would expect network activity related to the press to be concentrated during daytime hours, not between 5 PM and midnight.
ajcp 1 days ago [-]
Even at midnight I can't imagine there being less than 100 people working at the WH in various capacities. While it's probably not the duty/desk officers in the Situation Room/Security Council, there are plenty of maintenance staff that work at night. 5-midnight seems like it overlaps perfectly with a shift schedule.
jeremyjh 1 days ago [-]
But how many of them would risk their job by smuggling in a device that violates government policies? Every device in the White House should be accounted for and meeting a number of security criteria. There are really only two or three people there who would know that those rules don't apply to them.
jp_sc 1 days ago [-]
They are not saying that is _on purpose_, in fact they are saying the opposite: a compromised device, could be even an Android phone. It could also be as device planted on purpose, of course.
asdff 20 hours ago [-]
Given that, why are there so many loose phones at all? Here is one compromised that we know about, in the biggest target for espionage on planet earth.
tclancy 1 days ago [-]
You’re misreading what this says. It’s someone bringing in a device they managed to get infected.
Oh and also the part where no one has caught this internally which is possibly the bigger takeaway. It’s a zero-trust network made out of incompetence.
esikich 1 days ago [-]
There's nothing in the article that suggests it's not just the guest wifi. Which wouldn't be monitored. Why would you? The whole point is that it's segmented and can't actually interact with anything important.
skipkey 1 days ago [-]
Eh, I would not be surprised if they have a separate wifi that guests can use and you can hook up your private devices to. Basically every large company i have worked for, for the last two decades had that. I suspect deep in the bowels of the White House you don’t get good reception.
what 1 days ago [-]
Why are you assuming the person knows and is actively smuggling in the device? And why would you then assume that person is more significant than a shift worker there?
asdff 20 hours ago [-]
Probably because hegseth decided to actively use signal to discuss military planning instead of secure channels that don’t invite such screwups like adding random citizens to these discussions.
mikeweiss 1 days ago [-]
Actually sound like the opposite of someone who lives there...Sounds like a shift worker.
TheDong 24 hours ago [-]
That timing could also align with a device that is turned on and off at specific times, for example an insecure smart TV that is generally turned on to watch TV in the evening, and turned off around midnight.
Though the fact that it lines up with an 8 hour shift also makes it seem human-like, so I think I'd rank a human carrying an infected device as more likely than an infected periodically-active device.
gcollard- 1 days ago [-]
Or the cleaning or security staff working the night shift.
ggm 1 days ago [-]
If you regard 1,000 or less people as few, then this is true. If you regard 1,000 people as "too many" then you rate the national security of the USA at the cost of 1 in 1000 means it's not worth bothing to find out.
Is that really how national security works?
nomel 1 days ago [-]
What makes you believe this is related to national security?
ggm 1 days ago [-]
[dead]
what 1 days ago [-]
There’s a ton of people it could be. Any staffer that works 5-12, which wouldn’t be a particularly weird shift for cooks, cleaners, etc that bring their infected phone with them.
If it was someone who lived there it wouldn’t be exclusively that time period. Why wouldn’t it happen overnight or in the morning or any other time of day?
shrubble 1 days ago [-]
There’s at least 500 people on just the staff of the White House, not including many others who work nearby.
abofh 1 days ago [-]
With the authority to walk in with a streaming stick, plug it into a TV and connect to WiFi!
avodonosov 1 days ago [-]
Do you imply this residential proxy is also a Presidential proxy?
3RTB297 1 days ago [-]
The White House doesn't shut down at 5pm. There's whole books, TV series, and movies about the people that are working late every night at the White House. Likely dozens of people are on staff and work shifts that last until midnight every night of the week.
Service staff, including the storied hundred or so White House butlers, work whatever hours are needed. Then you have Secret Service, Kitchen staff, Natalie, house admin staff like the Chief Usher, maybe even NPS staff as the WH grounds are a national park as well, any of whom I would assume might be given access to the secure but unclassified WH wifi and likely a government-issued device. One device with a proxy among all of those people? Entirely unsurprising.
Maybe it's just the printer that Natalie carries around in her purse.
dofm 1 days ago [-]
Unless it is running on a government issued iPhone, it is not the Individual #1 you are alluding to.
He very famously does not know how to use computers and can only basically manage tweeting from his phone, which he is mostly not, actually, doing himself.
Now, there are two or three terminally online people around him. I would be more quick to point the finger at his foul-mouthed spokesman but it’s admittedly because I hate that guy and he seems rather stupid. But perhaps it could be the devoted portable printer lady, or the overpromoted unblinking former golf caddy guy.
All of them are around to help with the, er, modern day presidential communications.
duskwuff 24 hours ago [-]
[dead]
lostlogin 1 days ago [-]
> He very famously does not know how to use computers and can only basically manage tweeting from his phone, which he is mostly not, actually, doing himself.
Despite the constant negative press covfefe
dofm 24 hours ago [-]
Most of it is Harp or Scavino, as far as I have read.
xdavidliu 15 hours ago [-]
the politeness appears to be mutual?
redwood 18 hours ago [-]
Does it continue when the prez is in Florida? Seems a good test on the hypo
jachee 24 hours ago [-]
It’s probably Natalie.
poopiokaka 1 days ago [-]
[dead]
aaron695 24 hours ago [-]
[dead]
RockRobotRock 1 days ago [-]
Yeah dude you’re right Trump bought an android tv from banggood and got pwned. You’re a genius.
buildsjets 1 days ago [-]
He never buys what he can grift for free. Probably a gift from some autocrat in exchange for politcal favors. Much like the Great Seal bug.
pjc50 19 hours ago [-]
He got gifted an entire jet!
buildsjets 14 hours ago [-]
He sure did! And it’s most likely full of listening devices.
lakeviewterrace 1 days ago [-]
[flagged]
what 1 days ago [-]
[flagged]
lakeviewterrace 1 days ago [-]
With all the recent changes, they are actually encouraging each other to migrate here — I've seen the comments. It's no longer a myth.
tgtweak 1 days ago [-]
Not all residential proxy providers are seedy - but I only know of one that isn't out of probably 20 or so major players so I guess fair call out on "infected".
gdevenyi 1 days ago [-]
It would be really great to have some info about how to detect such things locally.
reincoder 5 hours ago [-]
I work for IPinfo. I recommend users use ipinfo.io/my as we do connect to residential IPs and verify.
Now, how to prevent this. If you are on a NATed connection, it is nearly impossible to prevent this from happening because you cannot control what apps people install who share the same IP address with you. If you have control over your network, then I suggest you install a DNS monitoring service. You can periodically monitor the DNS requests to find unusual patterns.
Good4boothee 19 hours ago [-]
It is tricky. Monitoring network traffic should be enough, the infected device has to connect to Command and Control, to receive orders and set up tunnels.
It got harder after malware creators started using Telegram, Discord or even good old IRC for those purposes - it will be asy to notice only if they use a service no one else uses in your network.
cowlevel 1 days ago [-]
Step 1: have you installed anything from an app store such as Google Play or Apple's app store?
Step 2: have you bought any devices made by large companies like LG or Samsung?
nullbyte808 13 hours ago [-]
I wonder if the smart TVs in the white house have been hacked.
reincoder 6 hours ago [-]
Resproxy SDKs do not require hacking. App developers can incorporate these SDKs for a second stream of income besides selling ads or subscriptions.
In legal terms, it is consented when you install an app that has the Resproxy SDK built into it.
Not sure why the text is all black, but it's there
EmX_3000 24 hours ago [-]
Why not? Cass Sunstein even suggested such an approach in his book in the 1990s, back when he was the Presidential Science Advisor. It's no different than the King of England going out among his people in disguise to get the lay of the land.
OTOH it could be a honeypot, OR possibly somebody was careless. But there is no reason it has to be suspicious.
wolvoleo 22 hours ago [-]
I didn't know that residential proxies were a thing. That sounds pretty handy because going online via a VPN gives constant nag popups from the likes of cloudflare :( I hate them.
It would be nice if the VPNs would integrate this option.
I don't need one from the white house though :)
threecheese 1 days ago [-]
"Infected with a proxy SDK" wouldn't be my first guess. Am I jaded? A realist?
IG_Semmelweiss 1 days ago [-]
Domain is feeling the HN hug
dgellow 17 hours ago [-]
The next administration needs to redo the whole infrastructure from scratch. They have to assume everything is compromised
1 days ago [-]
50208 1 days ago [-]
5:00 PM Eastern Standard Time (EST) is 6:00 AM the next day in Beijing.
opengrass 1 days ago [-]
NSA honeypots
geephroh 1 days ago [-]
I would actually feel better if this were the case, but given that we have "the very best people" currently running our cybersecurity infrastructure I doubt it.
Most likely scenario is a 20-something holdover from DOGE who accidentally had his phone p0wned while downloading groyper memes.
betterunix2 1 days ago [-]
Most likely scenario is a janitor who installed an app (I'm guessing it was called LegitWorldCupWatch420696969) on his phone (which might be connecting to the wifi network from whatever locker he leaves it in while he's on the clock, the WH is not a giant SCIF). Or any number of other mundane, easy to overlook employees who work outside of the actual secured areas of the building.
lakeviewterrace 1 days ago [-]
So they don't actually know what this network is, just who owns the IP space... time for a blog post to advertise our week-old service!
There is no evidence that physically ties this to the WH. It could be in a security lab for all they know. Or a guest network for the news media.
Terr_ 1 days ago [-]
> There is no evidence that physically ties this to the WH.
They don't need to be physically inside a specific building to be a networking security problem.
The core issue is whether an outsider has bypassed your firewall and can send+receive traffic from a node which is getting more trust than it deserves. If they've compromised the computer's microphone/camera/wifi-control that's an additional problem.
lakeviewterrace 1 days ago [-]
[flagged]
itishappy 1 days ago [-]
"We don't know where the devices that appear to have breached the WH network are located. For all we know, they could be in Beijing or Moscow."
That seems significantly worse.
nexus6 19 hours ago [-]
Is it some like like NordVPN? It has an option to act as a residential proxy (useful to evade VPN IP blocks)
1e1a 1 days ago [-]
Perhaps ping time measurements could help identify where the devices are physically located.
0cf8612b2e1e 1 days ago [-]
If you were really sneaky, could you add some small jitter to the network responses to make it more difficult to locate?
adyavanapalli 1 days ago [-]
You can only _add_ jitter. So presumably you make people think you're farther away than you really are. I guess if you're especially clever, you can manufacture responses to packets you haven't sent yet to throw people off.
fn-mote 1 days ago [-]
Jitter is not a defense against statistical analysis. Additional lag might be what you want.
1e1a 1 days ago [-]
Additional constant delay? Isn't that also easily defeated when you're measuring from multiple nodes?
Hnrobert42 18 hours ago [-]
Or just block inbound ICMP.
cowlevel 1 days ago [-]
No. You would need to add hundreds of milliseconds depending on the sender's location.
bronco21016 1 days ago [-]
Gotta have your SuperBox set up to watch 24 hr cable news working late into the night.
Tangurena2 1 days ago [-]
For those who don't know what this is, here's a decent podcast about it:
There's a transcript if you want to read, not listen. At the start, you'll be "hey! I gotta get me one!" and later you'll be like "burn it with fire!"
yard2010 20 hours ago [-]
> I get a hit in my vulnerability log, like in the threat log on my Palo Alto firewall, and it’s for a SCADA vulnerability. ... A SCADA vulnerability. This makes no sense. SCADA is the control systems used in large-scale industrial settings. Think pumps, valves, conveyor belts, compressors, elevators, railway switches. This is where SCADA systems live. Why in the world is this box that’s here to deliver TV and movies attempting to trigger a SCADA exploit on D3ada55’ network? This is very concerning.
Such things are threats to humanity imho. They can get us back to the times we couldn't exploit the internet to run a society.
mryijum 1 days ago [-]
Interesting! According to this, a lot more going on beyond the residential proxy element, which was the only bit I had considered (or heard about). I wish there was an accompanying article with some more specifics.
thenthenthen 1 days ago [-]
I aso would like a technical deepdive, the transcript comes out as not very well informed and borderline conspiratorial.
“ Most of the infected devices were manufactured in China. ” uh… most devices are manufactured in China period. Very strange article/podcast.
thenthenthen 13 hours ago [-]
So many downvotes. This is a technical forum. The transcript provides almost no technical insights but manages to mentions China 18x. Would be nice to have a discusion on that.
JTbane 1 days ago [-]
I have seen these at mall kiosks advertising "free cable", and today I learned they are proxying from your home network.
cowlevel 1 days ago [-]
That is the least bad thing they could do btw. Unless your internet is data restricted, go for it if you want free cable. If questioned by your ISP (extremely unlikely but theoretically possible) pretend you have no idea what they're talking about.
Firewall it from your local network if you want to - it'll still work - they're not after that.
drnick1 1 days ago [-]
Absolutely, and this is why I refuse to run connected devices on my network that do run software I can reasonably trust. This is also why every computer, phone or appliance I own runs Linux. This includes my TV box, which I recently migrated to an x86 port of Android with Claude's help.
thehodge 1 days ago [-]
That was the first thing I thought of!
ethagnawl 1 days ago [-]
A friend in Texas claims they recently bought one at Wal-Mart. I don't know anything about how these work but that can't be true ... right?
gaudystead 13 hours ago [-]
Yes. I've also seen them sold on other online retailers, including Amazon. They're pre-infected boxes, acting as a voluntary network implant under the guise of being a sneaky way to consume otherwise-paid-for content.
Good4boothee 20 hours ago [-]
There are plenty of people selling IPTV access on g2g, few bucks for a month, all TV channels from entire world. I am not sure if it is profitable to let such piracy boxes work forever, even with them being used as residential proxy, but I also don't know how low you can go if you skip middlemen.
mplewis 1 days ago [-]
It's absolutely true, these are sold all over the place
amai 16 hours ago [-]
So somebody likes to appear as if he/she works from the white house, but actually isn‘t there? Why not use a VPN for that?
rdco 16 hours ago [-]
There's no commercial server with an IP address at the White House.
The sheer bumbling incompetence of this current regime is almost akin to the plot of a "Hogan's Heroes" episode, with management style provided by Colonel Klink...
Roark66 14 hours ago [-]
>Residential proxies have infected every corner of the world, and it looks like there is no place they cannot reach. Layer3 Intel tracks residential proxy and anonymization infrastructure worldwide.
Seriously? Discovering proxies exist and actually finding the people that use them are two different things.
Trying to conflate those two things in an article meant for a technical audience is quite funny.
1 days ago [-]
jefurii 1 days ago [-]
But her e-mail server!
pak9rabid 1 days ago [-]
Love me some buttery males
KoftaBob 1 days ago [-]
The biggest operator of residential proxy networks (BrightData) is based in Israel, which I'm sure has no connection to this at all...
tablarasa 13 hours ago [-]
just let me buy a BYD then
isolay 1 days ago [-]
Is the first word in that headline missing a P at the beginning?
dools 1 days ago [-]
But … HER EMAILS!!
Bassiestroep 1 days ago [-]
I mean supply chain-attacks are everywhere. Smart-TV's with certain marketplace apps, IoT devices. Also, I'm surprised the white house's network is not monitored more.
thombat 1 days ago [-]
Monitoring is the easy part, remedying the problems has proved harder. From early in the first Trump administration:
That is not an environment for serious people anymore so that's expected.
JudahNyquist 1 days ago [-]
probably something IOT with a vulnerability, happens all the time.
Good4boothee 19 hours ago [-]
The joke that S in "IoT" stands for Security is as old as the term itself, but there were no such clear incentives for exploiting them before, beyond basic DDoS and more recently crypto mining.
budding2141 1 days ago [-]
[dead]
killjoywashere 1 days ago [-]
Let's assume the worst, that it's a VIP. Ok, now let's do some basic frequency statistics:
If you click the AS2650 link (1) in the article, you will learn that AS2650 is announcing 65,792 addresses in 5 prefixes. Roughly 40-70% of the IP addresses in a typical corporate ASN are associated with actual computers humans are using. Let's go with 40%. You're looking at 26,317 people. Assume they're all adults (please, dear lord, let them all be adults). 3-8% of the workforce is in IT. Let's go with 3%, that's 789 people. I'm guessing one of those 789 folks has thought this through and has a few VLANs set up to keep VIP and family-of-VIP, pattern of life stuff in a box.
As for the thesis that these are all window-licking low-IQ goons, that's just not how the US government cultivates its workforce. It's no accident that Harvard Business School characterizes themselves as "the West Point of capitalism." West Point isn't someone else's anything. The US Government is in it for the long haul and captures folks young with impossible-to-resist opportunities like the military academies, ROTC, SMART scholars, etc. Let's just stick with the academies: 12,000 people a year who were likely competitive for the Ivies, Division 1 athletics, or both, but chose their parents poorly. Free, top tier education and a job is very attractive for kids from fly-over states. Hell, in big states like California, New York, and Texas, it can actually be even more competitive. Something north of 60% of those graduates stick around for at least 20 years of service (because the high three pension + VA benefits is a pretty nice floor for retirement when your options back home are line supervisor at the cotton mill, the sugar mill, the coal mine, or ramp manager for United), usually addicted to the crazy level of mission. Sort of the opposite of finance where people really struggle mentally if they're not making pallets of money at an accelerating rate. Government service pays dogshit, but the work can super interesting, especially as you gain seniority.
Those folks then often loop back into other agencies and do another 20 years. Are there goombas in the Government? Oh, for sure. Absolutely. But it's roughly the same fraction as any other workforce in the rest of the economy.
But by the time you get to top tier stuff like the White House staff, the sorting function has been strong. To make the point: you also see top tier folks in other organizations with government stink on them. I can think of at least two directors at Google who are prior military. A fat pile of McKinsey folks. Something like 8% of Fortune 500 CEOs have served in the military, above the national average (6-7% of Americans have served in the military at some point).
And it's hilarious to watch people simultaneously assert the government is a bunch of idiots, and then get all excited about fighter pilots, the CIA, the CDC, ambassadors, the NIH. As though those people just appeared from the head of Zeus fully formed. Where do you think they worked when they were young? They were stamping visas for the Department of State in some embassy in central Asia. They were rolling blankets and digging wells in Gambia for the Peace Corps. Checking corporate filings for mostly unknown companies at SEC. Studying aerospace engineering at Embry Riddle and then flying cleared checks between clearing houses across the state overnight in a Cessna.
... and then Donald Trump as President, Stephen Miller as, whatever he is, and Peter Hegseth as Defense Secretary (he did serve in the military, if that's worth anything).
walrus01 18 hours ago [-]
I think it's pretty wild to make all these bold assertions about the absolute top tier of elite talent that the US federal gov recruits and retains, and then compare/contrast that with the current staffers of the present incarnation of the executive branch. It just doesn't jive. Seriously, do a deep dive into Hegseth's resume and background of the nonprofit he was the figurehead for. He's more qualified than some known 3/4-star generals? Seriously? Tulsi Gabbard was the most qualified person for DNI? Seriously?
m00dy 24 hours ago [-]
PS: I own proxybase.xyz, and I think we’re the most transparent residential proxy network in the industry.
I don’t think it’s fair to call all residential proxy networks shady. Not all of us run our businesses that way. Our code is open, we have nothing to hide, and we use US-based stablecoins for transactions. User consent is our number one priority. I haven’t seen anyone else in the industry match that level of transparency.
alpineman 20 hours ago [-]
Why do you use stablecoins and not credit cards like every other non-shady business on the internet?
m00dy 20 hours ago [-]
We have a no-KYC policy to protect our users’ privacy. If we accepted credit cards, we could link users to their real identities. We don't want that.
alpineman 19 hours ago [-]
Sounds pretty shady
dminik 19 hours ago [-]
Uhh, and what exactly is the benefit for end users to have their devices send out ddos and scraping traffic?
It should be made illegal.
m00dy 19 hours ago [-]
Hmm, all our proxy traffic goes through a centralized gateway, so we have security policies in place to help protect against DDoS attacks.
kevmo314 22 hours ago [-]
Do you really think your users aren’t installing onto every device they can break into to make a buck? Ignorance is bliss I guess.
m00dy 21 hours ago [-]
Burning a compromised host just to run a public proxy client for pennies would be the worst trade-off imaginable for an attacker. It is loud, easily caught.
LocalH 24 hours ago [-]
Typical modern government bullshit.
Root it out or let it rot us
charcircuit 1 days ago [-]
>that poorly secured proxy SDKs can allow internal network access and lateral movement.
Let me guess. The SDK being used does properly handle this and this whole article is anti residential proxy FUD.
avinash33 7 hours ago [-]
[flagged]
hafizmaaz 8 hours ago [-]
[flagged]
ravivarmat 23 hours ago [-]
[dead]
RemingtonDavies 1 days ago [-]
[dead]
bashhq_r 1 days ago [-]
[dead]
gjgtcbkj 1 days ago [-]
[dead]
tonetheman 1 days ago [-]
[dead]
cry0 19 hours ago [-]
[dead]
09712306130 1 days ago [-]
Seems like the president found a business opportunity and gave internal orders to rent out the network infrastructure to 'ethically sourced' providers :^) Jokes aside, might be some infected IoT crap.
I buy and use residential proxies, though.
vanyle 1 days ago [-]
Residential proxies are a very important part of the internet, they allow scraping for archiving, automation and can be used for extra anonymity.
While they have grown a bit too much, they are a natural response to the absurd amount of effort every website is pouring into anti-scraping tech.
10111001 1 days ago [-]
> Residential proxies are a very important part of the internet, they allow scraping for archiving, automation and can be used for extra anonymity.
Aren't they almost always run unknowingly, by people tricked into running them?
dabbz 1 days ago [-]
There exist services that will pay you a fraction of money to host their residential proxy service on a computer you own. But I do think the majority of residential proxies are hijacked.
kube-system 1 days ago [-]
There are providers who claim they are ethically sourced, and that users have consented. Although I guess many are users who don't know or care that it is happening.
Ethically, if someone just wants to play a free game and doesn't care about it, is it okay? How knowledgable does a user have to be in order to have informed consent?
10111001 1 days ago [-]
> There are providers who claim they are ethically sourced, and that users have consented. Although I guess many are users who don't know or care that it is happening.
Betcha that means there was "consent" language on page 55 of some click-through EULA.
Leveraging compromised devices is a very important part of the Internet??? This is an incredibly twisted perspective.
Help me understand. As far as I'm aware, these residential proxies are almost always malware.
OptionX 1 days ago [-]
And making DDoS-attacks nigh impossible to IP block.
Residential proxies are in many cases at least shady, both on the side of who uses them and for what and on providers that are often not above using dark pattern to hide them in some innocuous app for a smart-whatever that silently runs a proxy on a unaware user's connection. And in many places in the world if illegal stuff in done using your connection you are liable, regardless if you knew about it.
georgel 1 days ago [-]
I wouldn't call turning on CloudFlare's bot blocker an "absurd amount of effort" from the perspective of site owners.
But getting around it sure is annoying, sometimes I get flagged IP's from Comcast and can't visit sites like costco.com despite not doing any questionable stuff on my network.
mcmcmc 1 days ago [-]
Hard disagree. They are malware 99.9% of the time. The utility does not erase the fact they are abusive.
Bender 1 days ago [-]
Most tools can be dual-use. Residential proxies are also used by malevolent actors to hack infrastructure or financial institutions and let some other poor soul get investigated for it. This is why we can't have nice things.
kube-system 1 days ago [-]
They're also used by the good guys who are going after those exact same bad guys.
Bender 1 days ago [-]
True, though unfortunately people can not be trusted to declare their intentions so the residential proxies will ultimately have to be sacrificed and given they are fairly easy to identify by behavior I could foresee the feds now having a reason to round 'em up faster. They already took out NetNut, IPIDEA, SocksEscort, Doppellganger and the "Kim Wolf" Offshoots.
kube-system 1 days ago [-]
Some of the more legit providers have KYC in place, and do literally require you to declare you intentions to open an account, and block certain traffic proactively unless you can prove a legitimate use.
Bender 1 days ago [-]
How do I identify which residential proxies have gone through KYC and which are wanting to pour hot sauce in my under garments?
kube-system 1 days ago [-]
The ones that do KYC list it pretty prominently on their website.
Bender 1 days ago [-]
They list the IP addresses of all the residential proxies? Is there a link to the netsets of all the IPv4 addresses they are using I can download once a day? (preferably over rsync but git over https is fine too)
amritananda 1 days ago [-]
I don't think even the most "ethical" providers are going to volunteer that information, since that defeats the entire purpose of having a residential proxy in the first place.
kube-system 1 days ago [-]
No...? That's a completely different question than what we were talking about above? The customers of a residential proxy who would be subject to KYC are the people using the addresses -- this has nothing to do with the exit addresses of those who have joined the network.
Bender 1 days ago [-]
That's a completely different question than what we were talking about above?
In fairness to me, I did say "Most tools can be dual-use. Residential proxies are also used by malevolent actors to hack infrastructure or financial institutions and let some other poor soul get investigated for it. This is why we can't have nice things."
So it could be Alice. I know Alice has good intentions. It could be Bob, we know what Bob is up to but I will give him a pass regardless because Bob did nice things in the past. But then there is Mallory ... Mallory Malfoid is up to no good. I need to know which IP's are used by Alice and Bob so I can exclude them from my automated protections. Mallory will automatically get rate limited to 16kb/s, 1 HTTP request every 5 seconds and if they bounce around different residential proxies they get redirected to a bathtub regardless of which residential proxy they use.
kube-system 1 days ago [-]
Yes, but KYC is a process where the service provider is making that determination. Either to a legal standard and/or their own standards.
In no world does "KYC" mean "expose your customer list to the whole world", let alone undermine the entire purpose of the product you're selling.
"I want to dox all of the customers of a proxy provider" is just an unreasonable ask. We wouldn't expect or want ISPs or VPNs or telecoms to do this.
Bender 1 days ago [-]
In no world does "KYC" mean "expose your customer list to the whole world"
Agreed. Alice Rhodes, Bob Bojangle and Mallory Malfoid will all be treated equally.
This was a fun thread, I have always wanted to give them last names.
lakeviewterrace 1 days ago [-]
"Malware is an important part of the Internet"
> and can be used for extra anonymity
Great, so you can conduct illegal transactions and have some unsuspecting grandma take the blame and have her front door kicked in?
kube-system 1 days ago [-]
Just like Tor, encryption, VPNs, etc, there are tons of legal uses for these proxies as well.
lakeviewterrace 1 days ago [-]
People who run Tor exit nodes generally do so by choice, and know the risks implications involved.
They didn't just connect a coffee pot to their WiFi one day.
Huh, and I wonder why I've been getting tons of "you might be a bot" CAPTCHA challenges from Google lately.
mcmcmc 1 days ago [-]
Frontier lab training data “collector”
mikestew 1 days ago [-]
Residential proxies are a very important part of the internet
So important that we have to trick people into using them. Remember when folks were running SETI@Home? Of course you do, because it was widely thought to be a good thing, and folks willingly signed up.
How many would buy the "box" if the advertising were honest about what's actually in the box?
mzajc 1 days ago [-]
s/Residential proxies/DDoS networks/, then re-read your comment.
sparkling 1 days ago [-]
>absurd amount of effort every website is pouring into anti-scraping tech.
Maybe some people do not want to provide their entire website as free training material to [insert LLM lab here]?
ethin 1 days ago [-]
You... Do know that people scrape websites for non-AI reasons, right?
anonreplier 1 days ago [-]
Why should the site owners be interested in allowing them to do that?
ethin 16 hours ago [-]
Because it's legal to scrape websites? And, oh, I don't know, maybe people like me might want to archive those websites for historical reasons?
anonreplier 9 hours ago [-]
that's why you might want to do it, not why they would want to let you do it
squidmaster 1 days ago [-]
Virtually all of it is the product of malware. This is like you saying that robbery is very important because you like buying cheap tools at pawnshops.
sfmike 1 days ago [-]
Vibe coders really having fun on their side quests these days
This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…
On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.
How is DDOSing every site on the web benign?
A compromised device inside the White House network could presumably be doing something _much_ worse than participating in a DDOS against random websites.
> One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.
Surely a Russian company known for cyberattacks against the US having direct access to the White House network is far more serious than just DDOSing random websites. This is espionage at the highest level. (Again.)
A whitehouse network. It isn't like everything done in that building run through a single wifi router. It is likely an unprotected network for personal use with zero connecting to anything important.
Great, they have some isolated network.
What are the chances it _never_ touches a device with a path to an important computer (e.g., one core router or switch at some point)? Good thing there haven't been any Cisco/Juniper/etc vulnerabilities ever.
What are the chances no important device _ever_ touches this isolated network? No important person ever gets annoyed at the security/filtering on the secured network and decides to connect to the public one instead? The secured one has some sort of issue, so their phone decides to connect to the guest network?
Are they going to compromise the military C&C network in the underground bunker? Probably not.
But it's probably more realistically damaging if they were to compromise some high level staffer's phone and using it as a listening device in a bunch of mid-level Whitehouse meetings.
So you're looking at not just national security stuff, but the ability to get personal data like selfies of fucking goats or screenshots of Maltese & Azerbaijan bank transfers, etc. Makes it easy for nefarious parties to manipulate standing with POTUS and blackmail people. The only escape for many of these people is pardons.
https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...
Perhaps some of them annoyed the President's illegally-appointed mega-donor, if they spoke out against giving root access to all his unvetted junior flunkies.
https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...
> Berulis alleged in the affidavit that there attempted logins to NLRB systems from an IP address in Russia in the days after DOGE accessed the systems. He told Reuters Tuesday that the attempted logins apparently included correct username and password combinations but were rejected by location-related conditional access policies.
* https://www.reuters.com/technology/cybersecurity/whistleblow...
* https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...
You have one alleged example.
That sounds like being deliberately obtuse and arguing in bad-faith. Are you going to "nuh uh" all the journalists and lawyers until you are personally given raw TCP dumps?
Behold, from the sworn affidavit of the DevSecOps guy with the top-secret clearance, as included in a whistleblower disclosure to Congress [0]:
> There were more than 20 such attempts, and what is particularly concerning is that many of these login attempts occurred within 15 minutes of the accounts being created by DOGE engineers.
So there it is, now don't go moving the goalposts.
[0] https://whistlebloweraid.org/wp-content/uploads/2025/04/2025...
They are young and think they are very smart. What could go wrong?
It’s not just the pay, there’s a lot of structural elements that mean that the potential talent pool is less than desired.
Or let me sum it up for you. The government doesn't have the money to employ top security experts and top security experts don't actually want to work for the government.
To be fair, they had quite a number of security experts on payroll before the current administration laid them all off...
In fact avoiding therapy at all costs is a good sign of trouble.
Indeed. I recently set up a bot on my local machine that I can interact with via Telegram. I gave it the ability to retrieve the contents of a URL via Playwright (with modifications). Basic things like getting the Readability view and getting the site as Markdown with links.
I was essentially mimicking the feature OpenAI etc offer where it can do a web search for you and get you the answer you seek. I just didn't want to pay a company for that feature.
It's not autonomous. It only acts when I tell it to. The actual search is via the Kagi API, but the URL contents is via Playwright. I also ensured it can't do lots of requests at a time. There's a mandatory (random) sleep of between 1 and 5 seconds between two requests.
In less than a week, I've been flagged. When I do a Google search (as a human), I have to prove I'm human. Many sites have simply blocked me - I can't buy stuff from various vendors[1], I cannot access several news sites, etc.
The thing is, I didn't really access that many sites with the bot! At most it's the equivalent of someone mildly addicted to the web. Yet they caught me quickly.
Obviously, I disabled the bot's capability to get site content. I wonder how long my IP will be in the blacklist.
I know some people will say "Good riddance" to the outcome and to what I did. I'd love to have a real, serious discussion on whether what I did was immoral. But whatever your thoughts on the matter, do ponder over the fact that the system has made it hard for average Joes like you and me to have this "feature", but if you pay a giant tech company a monthly fee, you can have it.
[1] Thankfully, Amazon didn't block me. In the past I'd avoid them, but now I'm in the dilemma where I don't want to buy stuff from sites that make it difficult for me to buy stuff from them!
I normally use a VPN to access the Internet. It's an ordinary consumer-grade VPN, and I use it for pretty innocuous things like watching the international versions of Netflix or avoiding being geographically-profiled and charged more when I book travel. The VPN itself, I'm sure, is being used for all sorts of naughty stuff: when I look it up in whatismyip, it comes up as VPN, "abuse detected", and "residential proxy detected". I expect to get blocked occasionally on it and just pause the VPN then.
What I found surprising is that pausing the VPN doesn't always clear the CAPTCHAs. The next request will also fail, sometimes. For a while I was wondering if I have a residential proxy on my network, but I went hunting with lsof and bandwidth monitoring and a list of all the open connections through my router, and it seems clear. Yet even with VPN disabled, I'll get CAPTCHAs from Google and Cloudflare.
I suspect they're using browser/TLS fingerprinting and then smearing the results of that across bad IPs. If you connect to them through a known-bad IP, they not only will CAPTCHA you, but they will record a fingerprint of any data they can. Then if you connect again with that fingerprint, regardless of the IP, they block that too.
Ironically, if you are actually malicious, you can get around this pretty easily. Because you'll know not to use a fingerprintable browser, or to rotate fingerprints. So you have one completely separate identity on a given IP (that is not yours), and if it gets blocked, you roll up another completely separate identity on a different IP. But this is too much work for an ordinary consumer who just wants to keep their IP private. So you end up with this excluded middle where the only rational strategies are to either do exactly what the website expects you to do (with no funny business, even if it's innocuous), or to go whole-hog as the aggressor where you're determined to skirt their policies no matter what, and if you're doing that you might as well amortize the effort by extracting everything of value you can from them.
That modified Playwright was based on Firefox, and that's what I use for my regular browsing. So that didn't help.
I can actually launch Chrome and not deal with this - but I'm not going to. In fact, what surprises me is that I can create a new Firefox profile and not get those captchas. I don't know how my using that modified Playwright as a bot got them hooked on to my Firefox profile. I suspect they had my FF profile as a "suspicious" entity even before I made the bot (I use a number of privacy/anti-cookie extensions), and the bot pushed the score over the edge.
I'll probably start fiddling with my profile - disabling extensions, until things seem to work. Thankfully, no one else in the household is impacted.
For now, I got around all this by just paying for the Kagi extract API. It's not as good as my modified Playwright had been, though. I thought of a VPN, but I suspect that won't last long (not a residential proxy, etc), and I don't want an ongoing monthly fee. I like Kagi's pay as you go option.
But as I said, it's a weird world where suddenly Amazon is coming out the "better" site/vendor. It's funny - in the old days I was pretty anti-Walmart, but a few years ago I started preferring them over Amazon (and even several local stores) for a number of reasons (better collection than local stores, not having to deal with fakes for online orders, etc).
I've not been liking the state of the web for years prior to the advent of LLMs, but this is feeling like a final straw where I accept "the web is dead". We need a fundamentally different protocol - the model of "Set up a server anyone can reach, put content out there, and then put up a lot of sophisticated technology so your server isn't hammered" is not tenable. The protocol itself needs to manage the load.
I made my modifications at the network level and auto redirect a configurable set of sites to go to reader mode/paywall bypass by default with a MITM proxy and a custom CA cert I trust
I will instead say "skill issue".
Using Playwright results in some very obvious and easy to detect fingerprints. I'd expect better of someone on hacker news.
Mine hasn't been detected as far as I can tell, so I know it's possible to do better.
2) They're clearly talking from the perspective of the user and network admin. A residential proxy virus is in fact quite benign for both.
3) No matter what, DoS is quite a low priority in terms of security. And it's not even really DDoS, you'll know a real DDoS when you're on the receiving end.
That's only because it isn't being prosecuted appropriately.
I'm all for creating consequences for people who negligently don't secure their systems and people get hurt because of it, but people who installed a mobile game that has a proxy library in it? Please, chill.
What are you doing to make this true?
I'm a screen reader user (which is as "weird and unusual" as it gets when fingerprinting mechanisms are concerned), and I am not really noticing much difference versus 2022 or so. Sure, there's little bits of anubis here or there, and a few sites (which I know for a fact are experiencing targeted DDoS attacks unrelated to AI scraping) having annoying Cloudflare verification screens, but that's about it.
My setup (other than the screen reader) is as vanilla as it gets. Safari, AdGuard for Ad blocking, no VPN except work VPN when necessary, no PiHole, no settings changed. If you're using something more esoteric, maybe try going mainstream and see if that improves your experience.
In comparison I get cloudflare recaptcha on every site that uses it, sometimes multiple times per session and sometimes not even letting me pass at all due to "error".
And if the website uses Google recaptcha then I close the tab because I know it will just end up in endless recaptcha hell.
It’s DRM that I think of as silly larping that doesn’t really bother me, but it’s clearly drm.
This is what I would like substantiated. I can go to a site behind Anubis, download the content on it, and do whatever I want with it. It doesn't do any kind of attestation of hardware or software. So - what makes it DRM?
While your server handles that, what does your CPU do with the other 99% of available cycles?
I run https://bunnystomp.com on an Always Free VM from a major cloud provider. It handles 1,930 req/s at 33 ms latency with no tuning/optimization. It's literally just python behind cloudflare.
I have no idea what the site you linked does, but it doesn't look like a cgit instance to me; that's what got hammered on my end, and when hosting it, one very quickly finds out that many git operations are CPU-bound.
I'd say yes since you've allowed random people unauthorized use of the connection. It makes no difference if it's your connection or not. For example, if that proxy gets used as part of a DDoS attack, your device compromised that network.
Yes. And someone did get unauthorized access to it. You don't have the permission to delegate authorization to a third party.
Did the third party connect to the guest wifi or did they connect to your computer and you have allowed them access to the guest wifi?
Did they agree to the ToS that the wifi network requires for people to use it?
Are you certain that the wifi network isn't intentionally limiting the area where it is broadcast, allowing only people within that geographic area the ability to connect to it?
If there is a purely 100% open wifi network who is only limited geographically due to technological constraints but would allow anyone in the world to connect to it if the technology allowed, then using your device to solve the technological constraint of limited wifi range would not fall under compromising the network IMO. Assuming again that the operator of the network publicized it as such and you aren't just making assumptions about their intentions.
There are two main differences. Netflix is working on your behalf. Connections initiated from netflix are no different from connections initiated from your web browser or your email client. Your use of the internet, for you, is authorized. With a proxy you have no idea who is connected or what they are doing with that connection. That network activity uses you, but isn't by you, or for you.
Finally, netflix isn't likely to be hacking, attacking, spamming, or attempting to bypass bans or IP blacklists over that connection, but those are exactly the kinds of activities that shady residential proxies are used for. By using those kinds of apps you basically backdoor/bot your own computer, and now access to the internet through it is being sold to people who want to use it for things that they couldn't get away with when using a VPN or any other legitimate provider.
Depending on the sophistication of the wifi network you may be held liable and accountable for everything that takes place over that connection, including whatever nasty things the people who bought access to your proxy get up to.
If the wifi system isn't set up to keep careful track of who is using it and when (as is common in places like coffee shops), the liability will fall to the entity offering the wifi access, and if that connection is repeatedly used for activity in violation of the law, or the AUP of the ISP being used, that same entity will face the repercussions. Their internet connection may be temporarily suspended. They may have to start blocking certain ports and services, or deny access to specific websites. They may even be forced to stop providing wifi access to guests entirely unless they are willing/able to spend the money needed to log and monitor who is using their connection and respond to notifications of abuse over their network as well as legal requests.
Places like coffee shops that just want to offer free wifi to their customers without worrying about that kind of thing are only able to do that because a small number of local individuals are using their connection. Locals who presumably enjoy being able to the internet at that location and won't take advantage by abusing it. Individuals who are also typically on camera, in full view of employees and other customers.
That kind of very common set up is insecure by nature and those companies are putting themselves at risk by offering the service, but it mostly works because the access is time/location-gated and most people in the neighborhood are generally not criminals. Allowing criminals from all over the globe to access those kind of connections through your device is allowing unauthorized access, and is also being a dick, since you're basically shitting in the pool everybody wants to be able to swim in. It greatly increases the risk that the wifi gets shut down, gets more locked down, or the IP address gets blacklisted making it less useful for everybody who uses it, including you.
I mean politicians are so addicted to twitter the nsa makes special phones…
It's always better to protect politicians from someone else
Not sure why my IP is listed as a residential proxy.
It should be a balancing act though, somewhere between what you said and my first sentence.
Rate limiting, or additional layers of input sanitisation for IP addresses known to have been malicious in the past.
It's unfortunate that good users will have to endure some difficulties because of bad users on the same network, but if security is the priority, then measures must be taken, you shouldn't just leave to door open to potentially known bad users / traffic.
IPv4 is a shared resource, but some ranges have worse reputations than others, and all are owned by organisations that have the ability to monitor and filter for malicious traffic. It gets into a fraught discussion about censorship, but it is possible for network owners to monitor for, and block / restrict traffic detected as 'bad'. It's just a matter of cost and scale, and those that put the effort in should have their users rewarded with fewer 'trust-issues' roadblocks.
Is this like a corporate support response? I legit can't tell. Try explaining to a retail consumer why they can't buy from your site because they have TMobile service.
The lists generated by this tool can be useful as well: https://github.com/maximilianfeix/proxy-scraper (which point to here: https://github.com/maximilianfeix/free-proxy-list)
There is also this bot proxy IP list: https://github.com/antoinevastel/avastel-bot-ips-lists
Why not? If security is the priority, the worst that could happen from that is clutter in logs and higher resource use. Nobody wastes 0days spraying them on random hosts, and a real motivated attacker targeting your server will not be stopped by an ip blacklist.
If there's anything there, monitor your network to figure out exactly what
{
}We collect the residential proxy data continuously from independent systems; when you visit the page, we take your IP address and look it up in our database. Note the percent_day_seen field, which is frequency metadata. You can also complement it with our device count data to understand if you are on a NATed IP.
If you are on a static IP address and a single user, we flag your IP address as a residential proxy. I think you should install some DNS monitoring service and start uninstalling unnecessary apps from internet-connected devices.
— Abdullah | DevRel, IPinfo
I was aghast when my partner connected a pet watering bowl to the WiFi.
https://support.frameo.com/hc/en-us/articles/23433637149842-...
Great gifts! (At least for those unconcerned with privacy or security, which is most people.)
Multiple times I caught unexpected traffic and was able to block it piecewise including a lightbulb(!) that was sending mb packets of god knows what home.
If they were ethernet based I reckon some smart VLAN capable switches would be nice even at home to keep them out of each others business.
I moved home a few years ago and now I'm back with the ISP router and do often feel a little in the dark about what my network is doing!
https://openwrt.org/
I had to recently inform my sister and didn't realize just how unaware the general public was of how utterly terrible things have gotten, like with LG TVs or the Meta Quest's access to your family.
When someone tells you "I have nothing to hide, I don't care", let them know that companies like LG make 5x as much money selling your data as selling $1000 TVs, so clearly your data is valuable and you shouldn't be giving it away for free. That's a message normal people can understand.
The whole industry is dirty.
This didn't particularly surprise me (unfortunately). Your average phone is loaded with spyware from "legit" American companies but plenty of them come with carrier spyware, adware or shady apps that auto install. Most people seem to be apathetic about this or have given up so the Chinese botnet device (that reliably delivers lots of illegal media) is just making the same kind of trade they're already making. Look at all the shit about smart TVs in the news recently that people have hardly stopped buying, those don't even come with free pirate NFL games. They've been told they were being spied on for years already and their response was that you're a tin foil hatter for bringing it up, they have nothing to hide or they don't care.
You almost can't blame them though. Even you put a lot of effort into protecting yourself from this stuff you're exposed anyway. Why should they do without their free streaming services when government agencies and companies that they don't even have a direct relationship with lose all their PII a dozen times a year and the DMV legally sells a dossier on them for 1.5cents?
It'd be an instant "yes" from everyone making under 80k a year and for many making more.
Spur.us on purchasable IPs from a site that sells microtargeted IPs and not large IP pool packages:
https://cleanshot.com/share/0Dn5Bh9B
https://cleanshot.com/share/jRGrjxK8
Unlimited traffic, under a dollar a pop, what good is a service when it returns the same info as my own ip? It's just hucksters all the way down. The result is that whoever takes some time or already has the skills to appear inconspicuous to the arbitrary standards set by a few almost-literal gatekeepers will have fewer problems running automations compared to the average user who are liable to run into what's turning into a general enshittification of the internet writ large. It's not, after all, illegal to use a residential, or any, proxy service on its own. Although my guess is that the anti-bot measures are going to exacerbate the already flagging economy if it haven't already, it's always going to be the boogeyman du jour who gets the blame, and not the overzealous and mindless policing and gatekeeping who of course would never admit to being part of the problem, even though they are absolutely part of the problem.
It's no longer a botnet, it's a "residential proxy" and you are doing clean business.
And I’d argue that’s not clean business, the user doesn’t know what their connection is being used for :)
Definitely pretty crazy. This is probably have they’re in the White House, all it takes is a random smart device to install a seemingly benign wallpaper app
There is another word for a C2 channel being created within a device you own without your knowledge, and that word is malware. And it's most often used for botnets, which is the least malicious thing they are used for.
Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.
Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.
A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.
They do not respect prior knowledge in any way, and think it has no value.
Of course they don't do standard, table stakes things like making their crawler smart. They don't have to. They're better than that or something.
But most likely these residential proxy services are more valuable for scraping, DDoS and manipulation plays on social media so they might not actually be used for things that draw direct attention. Using them to download illegal materials would be a waste of resources when a VPN does the job just as well.
Such as ignoring web scraping countermeasures, and DDoS.
Many questionable TV streaming boxes pretend to deliver you video, but in reality they are also piggy backing on your personal ISP to power those companies.
+ Sketchy Apps
+ Malware
+ Weird Android Variants
* I initially thought this meant someone in the WH network was using commercial proxies to appear as if they were exiting from a different network (which would align with "some user is firing up a proxy on their phone to exit in a different location")
* But then the description of residential proxies seemed to align more with traffic hitting an endpoint in the White House, and _exiting_ from the network there. But this didn't explain the timing (why isn't it 24/7).
* Finally it sounds like some person, legitimately on the WH network, has a device (cell phone, TV, whatever) that, when activated, is proxying outside traffic into the WH network.
[0]: https://layer3intel.com/what-is-a-residential-proxy
> Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network.
Thankfully security researchers exist to fill the gaps that lawmakers haven't gotten to / won't get to: https://blog.includesecurity.com/2026/06/the-smart-tv-in-you...
These are the specific URLs mentioned:
I use these regular expressions to block any connections to the domains or subdomains: No idea if this actually prevents proxy functionality altogether, but prevents some phoning home if you're infected.https://spur.us/blog/smart-tv-apps-residential-proxy-sdks
1: https://layer3intel.com/context
In my experience, out of the two, iphunter.info has the more comprehensive database, I think the owner/operator frequents HN.
If your IP address is part of a residential proxy network, it will be flagged.
Also, I recommend seeing the device count data we have for you. If you are on a NATed IP, you have virtually no control to remove the residential proxy SDK from your system. Let me know if you have any questions, as I work for IPinfo.
Beyond that gross metric you're getting into capturing traffic and decoding it.
I recommend folks just check our website: https://ipinfo.io/my and if they have questions, ask me, I will try to get to the bottom of this.
What we do is connect to residential proxy IP address and verify them before putting them in our database.
But DNS and traffic monitoring is a good practice. If you see gigabytes of traffic without explanation, you have more serious concerns than resproxy.
https://cloud.google.com/blog/topics/threat-intelligence/goo...
Residential proxies are a scourge on the internet as a whole, but it's generally in their best interests to be transparent and unnoticeable to the places where they're hosted.
Things like Apple Cloud relay and other corporate VPN services do make it more difficult for the services my company purchases to find your identity and track you. We are trying to find out how we can continue to prevent credit card fraud while supporting customers to continue using such services to protect their data and privacy.
Literally everything else is malicious though. The purpose is literally just a botnet. The point is to be able to get arbitrary packets stamped with arbitrary and diverse IP addresses to prevent IP address filtering and tracking from being able to block malicious activity.
It's ban evasion.
The biggest danger is that said proxies can also allow access to internal networks, and as you might guess from how they are installed, are not usually operated by the most scrupulous of organizations.
is that actually a thing that was caught before?
Also some free VPNs use their users as exit nodes for their actual paying customers, good luck finding a user who understands that. It's the obvious way to monetize such a service other than ads.
Same happens within cellphones - via native mobile apps pimped by ISP/Mobile providers.
Could it be the case?
And why have they not physically located the device OR at least vastly reduced its possible location , by determining the flow of the traffic from network elements ?
IP scoring is such a difficult product to do reliably. When someone says we provide IP scoring, you have to ask them based on what and what is your methodology. Now, IP reputation scoring can be good if both the vendor and the customer know what they are looking for very specifically.
For example, there are abusive IP databases. Now, some abusive IP databases run global honeypots, and they can say these IP addresses tried to exploit the CVE patterns. Sounds good, so when you buy their product, you can say the scoring they are providing can help with blocking IP addresses that run automated CVE exploits that match this pattern. Those services act as beacons, rather than a flat, generic, and everlasting database of bad IP addresses.
Now, do you take that score and try to use it as a baseline for protecting your login portal or credit card fraud? Of course not! You have to go to specialized vendors who provide specialized scoring.
We do not do IP reputation because we provide IP metadata that we can verify, and we can discuss methodologies publicly. If you ask us to do IP reputation scoring, we can easily do that, as we run a global honeypot ourselves as well. But that will involve us providing explanations and education to folks that the score you see fits a very specific pattern of attack that is not generic.
For example, we sell residential proxy detection data, and the database contains 100 million IP addresses. Are all 100 million IP addresses bad? Of course not. But this is not our call to make; our customers have to see the metadata we provide as well, such as percent days seen, last seen, etc. Now, if an IP address is flagged for being 100 percent seen and the last seen date is fairly new, it fits a certain threat model which can be categorized as concerning.
I'd be very interested in AI capabilities in detecting anomalous activity given that it should be very effective at pattern matching across large data sets. What would be required, however, is significant training with industry/application specific 'normal' browsing traffic patterns to determine acceptable tolerances, and then design escalating deterrence if and when tolerances are breached.
How is the scraper process stepping through the site? It must be programmatic, even if it's programmed to be random. What does that look like in traffic data in terms of timing and content requests?
What hazards can be put in place that a normal user would never go near, but a scraper is likely to trip over?
If scraping is being performed from multiple locations in parallel, what might that look like? ie. joining multiple sessions together that may show a more 'scraper' kind of behaviour.
Under IPv6 wouldn't detection start burning a lot of addresses? Yes, the pool is large, but that just means it's a scaling issue from IPv4 to IPv6, rather than a new problem requiring new thinking to solve? (assuming ways of detection were successful).
I'm being somewhat devil's advocate in my blocking rhetoric. The internet is in a weird confluence of wild-west and surveillance state. I like that there are ways and means of being anon-/pseudon-ymous; I like a bit of anarchaos, that's where the spirit of hacking lives. But I also don't want it sticking to my boots when I walk in the house. I'm also not fundamentally against scraping; there's definitely good scraping. There is an irony, though, in protecting scraped data or services that are built on scraped data (and I'm not accusing you, personally, just my general logical ideology of scraping). On residential proxies, I think they're 99% run by erstwhile criminals leveraging what were, until recently, referred to as botnets into a service they can launder their botnets through as 'I am legitimate business man'. I think most, basically all, residential proxies are run involuntarily or unwittingly and that blocking them would provide a greater society benefit than it would a drawback. Anything that promotes the sanitisation of end user devices can only be a good thing. The whole ecosystem is in a terrible state and regulation doesn't even seem to be on the distant horizon.
Maybe I'm hypocritical, or I'm trying to maintain mutually exclusive positions. This is where I'm at though.
https://www.trustpilot.com/review/myxproxy.com?languages=all
> Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.
There really aren’t very many candidates for who that person might be and it really seems like it would be someone who, I don’t know, maybe lives where the traffic is originating.
I'm no expert but even I've read that "Works at the White House" is bigger than the executive residence and oval office, including the West Wing and the big office building that's directly connected to it by basement walkways. The National Security Council maintains 24-hour watch operations in the Situation Room (which is more a 'complex' than 'room'), while regional desk officers routinely work late evenings to overlap with morning business hours in Europe and Asia.
I asked Gemini if my recollection was correct and got: "The EOP network (managed by the EOP Office of Administration in coordination with Presidential Information Technology Community entities like the White House Communications Agency) operates as a single campus enterprise network. Its high-speed backbone links the West Wing, the EEOB, the East Wing, and nearby administrative facilities such as the New Executive Office Building (NEOB) on 17th Street."
So, definitely an issue that there's a device with some rogue malware installed but the total workforce across all shifts at the White House Complex is roughly between 2,500 and 4,000.
I ask in good faith, but why didn't you just say the Treasury Building?
Which in the 1907 case meant 8,513 people's hands.
Guest networks are configured to disallow intranet connectivity, so the "security" risk would be from the device having access to the internet, on a guest network IP. But a guest network exists for the purpose of giving untrusted devices access to the internet, without compromising the security of the intranet. My local library, the local airport, Home Depot, the movie theater, etc all have public wifi, yet nobody would claim they were directly compromised. I understand the connection could be used for receiving and sending packets over the internet, like a DDoS (which would trigger rate limits, even at Home Depot), but framing a guest network, giving an untrusted device access to the internet, as some security issue seems very odd. The isolation is the mitigation.
If it's someone who lives there, it would be different than a shift worker.
This almost certainly had nothing to do with the administration. A single search would show that, for those interested in taking that time.
https://en.wikipedia.org/wiki/2023_White_House_cocaine_incid...
Some visitor forgot their nearly empty baggie of coke and conservatives convinced you Hunter Biden was doing blow with Joe in the Oval Office.
I mean, the nearly empty bag of cocaine isn’t necessary, Progressive Liberals do call* for their execution.
Boo hoo. No one’s stopping you. No one’s cancelling you. If you have something you say, then say it. Otherwise stop crying fake tears about the mean liberals who are somehow censoring you.
But if it want to talk about the baggie of coke, maybe do any research at all instead of listening to lying politicians who claimed it belonged to Hunter Biden with zero evidence (and zero logic).
Oh and also the part where no one has caught this internally which is possibly the bigger takeaway. It’s a zero-trust network made out of incompetence.
Though the fact that it lines up with an 8 hour shift also makes it seem human-like, so I think I'd rank a human carrying an infected device as more likely than an infected periodically-active device.
Is that really how national security works?
If it was someone who lived there it wouldn’t be exclusively that time period. Why wouldn’t it happen overnight or in the morning or any other time of day?
Service staff, including the storied hundred or so White House butlers, work whatever hours are needed. Then you have Secret Service, Kitchen staff, Natalie, house admin staff like the Chief Usher, maybe even NPS staff as the WH grounds are a national park as well, any of whom I would assume might be given access to the secure but unclassified WH wifi and likely a government-issued device. One device with a proxy among all of those people? Entirely unsurprising.
Maybe it's just the printer that Natalie carries around in her purse.
He very famously does not know how to use computers and can only basically manage tweeting from his phone, which he is mostly not, actually, doing himself.
Now, there are two or three terminally online people around him. I would be more quick to point the finger at his foul-mouthed spokesman but it’s admittedly because I hate that guy and he seems rather stupid. But perhaps it could be the devoted portable printer lady, or the overpromoted unblinking former golf caddy guy.
All of them are around to help with the, er, modern day presidential communications.
Despite the constant negative press covfefe
Now, how to prevent this. If you are on a NATed connection, it is nearly impossible to prevent this from happening because you cannot control what apps people install who share the same IP address with you. If you have control over your network, then I suggest you install a DNS monitoring service. You can periodically monitor the DNS requests to find unusual patterns.
Step 2: have you bought any devices made by large companies like LG or Samsung?
In legal terms, it is consented when you install an app that has the Resproxy SDK built into it.
Not sure why the text is all black, but it's there
OTOH it could be a honeypot, OR possibly somebody was careless. But there is no reason it has to be suspicious.
It would be nice if the VPNs would integrate this option.
I don't need one from the white house though :)
Most likely scenario is a 20-something holdover from DOGE who accidentally had his phone p0wned while downloading groyper memes.
There is no evidence that physically ties this to the WH. It could be in a security lab for all they know. Or a guest network for the news media.
They don't need to be physically inside a specific building to be a networking security problem.
The core issue is whether an outsider has bypassed your firewall and can send+receive traffic from a node which is getting more trust than it deserves. If they've compromised the computer's microphone/camera/wifi-control that's an additional problem.
That seems significantly worse.
https://darknetdiaries.com/episode/172/
There's a transcript if you want to read, not listen. At the start, you'll be "hey! I gotta get me one!" and later you'll be like "burn it with fire!"
Such things are threats to humanity imho. They can get us back to the times we couldn't exploit the internet to run a society.
“ Most of the infected devices were manufactured in China. ” uh… most devices are manufactured in China period. Very strange article/podcast.
Firewall it from your local network if you want to - it'll still work - they're not after that.
https://layer3intel.com/what-is-a-residential-proxy
https://hn.algolia.com/?q=starlink+whitehouse
The sheer bumbling incompetence of this current regime is almost akin to the plot of a "Hogan's Heroes" episode, with management style provided by Colonel Klink...
Seriously? Discovering proxies exist and actually finding the people that use them are two different things.
Trying to conflate those two things in an article meant for a technical audience is quite funny.
https://lieu.house.gov/media-center/in-the-news/what-can-we-...
If you click the AS2650 link (1) in the article, you will learn that AS2650 is announcing 65,792 addresses in 5 prefixes. Roughly 40-70% of the IP addresses in a typical corporate ASN are associated with actual computers humans are using. Let's go with 40%. You're looking at 26,317 people. Assume they're all adults (please, dear lord, let them all be adults). 3-8% of the workforce is in IT. Let's go with 3%, that's 789 people. I'm guessing one of those 789 folks has thought this through and has a few VLANs set up to keep VIP and family-of-VIP, pattern of life stuff in a box.
As for the thesis that these are all window-licking low-IQ goons, that's just not how the US government cultivates its workforce. It's no accident that Harvard Business School characterizes themselves as "the West Point of capitalism." West Point isn't someone else's anything. The US Government is in it for the long haul and captures folks young with impossible-to-resist opportunities like the military academies, ROTC, SMART scholars, etc. Let's just stick with the academies: 12,000 people a year who were likely competitive for the Ivies, Division 1 athletics, or both, but chose their parents poorly. Free, top tier education and a job is very attractive for kids from fly-over states. Hell, in big states like California, New York, and Texas, it can actually be even more competitive. Something north of 60% of those graduates stick around for at least 20 years of service (because the high three pension + VA benefits is a pretty nice floor for retirement when your options back home are line supervisor at the cotton mill, the sugar mill, the coal mine, or ramp manager for United), usually addicted to the crazy level of mission. Sort of the opposite of finance where people really struggle mentally if they're not making pallets of money at an accelerating rate. Government service pays dogshit, but the work can super interesting, especially as you gain seniority.
Those folks then often loop back into other agencies and do another 20 years. Are there goombas in the Government? Oh, for sure. Absolutely. But it's roughly the same fraction as any other workforce in the rest of the economy.
But by the time you get to top tier stuff like the White House staff, the sorting function has been strong. To make the point: you also see top tier folks in other organizations with government stink on them. I can think of at least two directors at Google who are prior military. A fat pile of McKinsey folks. Something like 8% of Fortune 500 CEOs have served in the military, above the national average (6-7% of Americans have served in the military at some point).
And it's hilarious to watch people simultaneously assert the government is a bunch of idiots, and then get all excited about fighter pilots, the CIA, the CDC, ambassadors, the NIH. As though those people just appeared from the head of Zeus fully formed. Where do you think they worked when they were young? They were stamping visas for the Department of State in some embassy in central Asia. They were rolling blankets and digging wells in Gambia for the Peace Corps. Checking corporate filings for mostly unknown companies at SEC. Studying aerospace engineering at Embry Riddle and then flying cleared checks between clearing houses across the state overnight in a Cessna.
(1) https://layer3intel.com/context/AS2650
I don’t think it’s fair to call all residential proxy networks shady. Not all of us run our businesses that way. Our code is open, we have nothing to hide, and we use US-based stablecoins for transactions. User consent is our number one priority. I haven’t seen anyone else in the industry match that level of transparency.
It should be made illegal.
Root it out or let it rot us
Let me guess. The SDK being used does properly handle this and this whole article is anti residential proxy FUD.
I buy and use residential proxies, though.
While they have grown a bit too much, they are a natural response to the absurd amount of effort every website is pouring into anti-scraping tech.
Aren't they almost always run unknowingly, by people tricked into running them?
Ethically, if someone just wants to play a free game and doesn't care about it, is it okay? How knowledgable does a user have to be in order to have informed consent?
Betcha that means there was "consent" language on page 55 of some click-through EULA.
Help me understand. As far as I'm aware, these residential proxies are almost always malware.
Residential proxies are in many cases at least shady, both on the side of who uses them and for what and on providers that are often not above using dark pattern to hide them in some innocuous app for a smart-whatever that silently runs a proxy on a unaware user's connection. And in many places in the world if illegal stuff in done using your connection you are liable, regardless if you knew about it.
But getting around it sure is annoying, sometimes I get flagged IP's from Comcast and can't visit sites like costco.com despite not doing any questionable stuff on my network.
In fairness to me, I did say "Most tools can be dual-use. Residential proxies are also used by malevolent actors to hack infrastructure or financial institutions and let some other poor soul get investigated for it. This is why we can't have nice things."
So it could be Alice. I know Alice has good intentions. It could be Bob, we know what Bob is up to but I will give him a pass regardless because Bob did nice things in the past. But then there is Mallory ... Mallory Malfoid is up to no good. I need to know which IP's are used by Alice and Bob so I can exclude them from my automated protections. Mallory will automatically get rate limited to 16kb/s, 1 HTTP request every 5 seconds and if they bounce around different residential proxies they get redirected to a bathtub regardless of which residential proxy they use.
In no world does "KYC" mean "expose your customer list to the whole world", let alone undermine the entire purpose of the product you're selling.
"I want to dox all of the customers of a proxy provider" is just an unreasonable ask. We wouldn't expect or want ISPs or VPNs or telecoms to do this.
Agreed. Alice Rhodes, Bob Bojangle and Mallory Malfoid will all be treated equally.
This was a fun thread, I have always wanted to give them last names.
> and can be used for extra anonymity
Great, so you can conduct illegal transactions and have some unsuspecting grandma take the blame and have her front door kicked in?
They didn't just connect a coffee pot to their WiFi one day.
e.g. https://packetstream.io/share-bandwidth/
Technically correct statement though
So important that we have to trick people into using them. Remember when folks were running SETI@Home? Of course you do, because it was widely thought to be a good thing, and folks willingly signed up.
How many would buy the "box" if the advertising were honest about what's actually in the box?
Maybe some people do not want to provide their entire website as free training material to [insert LLM lab here]?