[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9BiO3aRBPohay_oH8rMGjh0S8ahmifyaKsCAjgd-QhY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"fb67ece4-74cf-4924-8483-892c3d6ea0ed","white-house-network-ips-rented-out-via-proxy-services-due-to-unauthorized-device","787b3a90-d0d7-47e0-8a87-9bc766edb49c","White House Network IPs Rented Out via Proxy Services Due to Unauthorized Device","A personal device connected to the Executive Office of the President's network appears to have been running proxy software — likely without the user's knowledge — allowing 28 commercial proxy services to rent out White House IP addresses to anonymous third parties. This represents a serious configuration and security awareness failure: an unmanaged or insufficiently monitored endpoint became an unwitting exit node for potentially adversarial traffic. The risk is twofold — sensitive government IP space was commoditized for anonymous browsing, and inbound\u002Foutbound traffic patterns associated with the White House network could be manipulated or observed. This incident underscores that even the most sensitive networks can be compromised by a single uninspected personal device, making endpoint visibility and user awareness non-negotiable.","**Immediate actions:**\n- Audit all devices connected to AS2650 and the Executive Office of the President network to identify any running proxy or tunneling software.\n- Block outbound connections to known residential proxy service infrastructure at the network perimeter.\n- Isolate or quarantine any personal or unmanaged devices pending a full security review.\n\n**Long-term improvements:**\n- Enforce a strict bring-your-own-device (BYOD) policy or ban personal devices from sensitive government network segments entirely.\n- Implement application allowlisting on all endpoints to prevent unauthorized software — including proxy agents — from executing.\n- Maintain a continuously updated asset inventory so that any unrecognized device on the network is flagged automatically.\n\n**Detection measures:**\n- Deploy network traffic analysis tools to detect anomalous outbound connection patterns, such as large volumes of proxied traffic from internal hosts.\n- Establish alerts for any internal IP appearing in external threat intelligence feeds, proxy service databases, or OSINT sources.\n- Conduct periodic OSINT sweeps of government-registered IP ranges to detect unauthorized exposure or misuse in the public domain.",[12,13,14,15,16,17,18],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1090: Proxy",{"MITRE ATT&CK T1090: Proxy":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"CIS Control 14: Security Awareness and Skills Training":22,"CIS Control 1: Inventory and Control of Enterprise Assets":23,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":24,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"This incident directly maps to the Proxy technique, where adversaries or unwitting users route traffic through intermediary systems — defenders should monitor for and block internal hosts acting as proxy nodes.","While not a software flaw per se, unauthorized software running unchecked reflects a failure to identify and remediate configuration deviations — a gap SI-2 addresses through continuous system monitoring and correction.","The device owner likely did not realize their machine was running proxy software, highlighting a gap in user education about unauthorized software and the risks of connecting personal devices to sensitive networks.","The unauthorized proxy software ran on a personal device that was apparently untracked; a complete, enforced asset inventory would have flagged the unmanaged endpoint before it became a risk.","Regularly scanning endpoints for unauthorized or vulnerable software installations would have surfaced the proxy agent running on the internal device before external researchers discovered it.","Hardened device configurations and application allowlisting would have prevented proxy software from being installed or executed on any network-connected device.","Stricter controls on which devices are permitted to connect to the network — enforced via device identity and authentication — would have prevented an unmanaged personal device from gaining network access.","published","2026-11-05T14:21:28.847098+00:00","2026-11-05T14:21:28.833+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Fwhite-house-network-ip-for-rent\u002F","researchers-discover-white-house-network-ip-available-for-rent-through-28-proxy-bab417","Researchers Discover White House Network IP Available for Rent Through 28 Proxy Services",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[49,53,57],{"slug":50,"name":51,"problem":52},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":54,"name":55,"problem":56},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":58,"name":59,"problem":60},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen."]