无论是通过恶意软件还是其他手段，与白宫网络相关的设备似乎正被用作住宅代理出口节点，这可能对全球最敏感的网络之一构成安全风险。
Whether through malware or other means, devices associated with the White House network appear to be serving as residential proxy exit nodes, potentially posing security risks to one of the world's most sensitive networks.
这一安全失误的消息来自安全公司Layer3 Intel，该公司本周报告称，由于其最近推出的住宅代理观测站（Residential Proxy Observatory），它发现了这一可能的非法活动。Layer3创始人谢尔吉·乌萨蒂uk（Sergiy Usatyuk）表示，如果不是这款新工具，白宫的住宅代理活动可能不会被注意到。
News of the security snafu comes from security firm Layer3 Intel, which reported this week that it discovered the likely illicit activity thanks to its recently launched Residential Proxy Observatory. According to Layer3 founder Sergiy Usatyuk, the White House residential proxy activity might have gone unnoticed if not for the new tool.
“该观测站只是一个公开界面，用于探索我们过去一年收集的数据，”乌萨蒂uk在给《The》的一封电子邮件中表示。
“The observatory is just a public interface to explore the data we've been collecting for the past year,” Usatyuk told The in an email.
对于不熟悉住宅代理的人来说，它们就像任何掩盖用户位置的旧代理网络一样，不同之处在于它们的出口节点使用的是与住宅互联网连接相关的IP地址，而不是数据中心。虽然许多代理是合法的，但正如联邦调查局（FBI）今年早些时候警告的那样，其他代理遭到威胁行为者的利用并被用于实施网络犯罪。
For those unfamiliar with residential proxies, they're like any old proxy network that obfuscates the location of a user, except in this case their exit nodes use IP addresses associated with residential internet connections, as opposed to datacenters. While many are legitimate, others are exploited by threat actors and used in the commission of cybercrimes, as the FBI warned earlier this year.
FBI于3月发布的安全公告警告用户保护其系统免受恶意软件劫持、非法SDK合作、带有隐藏服务条款的VPN（这些服务条款会将用户的计算机重新用作出口节点）以及其他用于在未经同意的情况下将受害者变成节点的威胁。
The FBI bulletin, put out in March, warns users to protect their systems against hijacking via malware, illicit SDK partnerships, VPNs with hidden service terms that repurpose user computers as exit nodes, and other threats used to turn victims into nodes without their consent.
FBI解释说，威胁行为者通常使用住宅代理来隐藏命令与控制（C2）基础设施、实施网络钓鱼攻击、发送垃圾邮件、伪装恶意流量等。
Residential proxies are commonly used by threat actors to conceal command-and-control (C2) infrastructure, conduct phishing attacks, send spam, disguise malicious traffic, and the like, the FBI explained.
Layer3表示，其数据显示，在10月5日至11月3日期间，几乎每天都有236个不同的住宅代理服务在白宫网络中进出，期间共有236个独立出口。Layer3称，其他住宅代理检测服务也记录了相同的信息。
According to Layer3, its data shows 28 distinct residential proxy services exiting into the White House network nearly every day between October 5 and November 3, with 236 separate exits in that period. Other residential proxy detection services logged the same information, Layer3 said.
大部分活动发生在白宫时间的晚间，即下午5点到午夜之间。Layer3表示，这表明白宫里的某个人——而不是访客——拥有一个被感染的设备，该设备正充当出口，很可能是通过被感染的代理SDK。如果属实，这就成了一个问题。
Most of the activity was happening in the evening, White House time, between 5 pm and midnight. That, Layer3 said, suggests someone at the White House - not a guest - has an infected device that’s serving as an exit, likely via an infected proxy SDK. If correct, that’s a problem.
Layer3解释说：“过去的研究表明，安全性差的代理SDK可能会允许内部网络访问和横向移动。如果该网络上的SDK具有同类缺陷，任何购买代理访问权限的人都可以利用它来接触内部系统。”
“Past research has shown that poorly secured proxy SDKs can allow internal network access and lateral movement,” Layer3 explained. “If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems.”
换句话说，这是一个严重的安全风险，乌萨蒂uk告诉我们，这个问题可能已经存在一段时间了。
In other words, this is a serious security risk, and one Usatyuk tells us could have been a problem for a while.
这位Layer3创始人解释说：“我们的数据保留期可以追溯到7月10日。鉴于有连续几个月的持续活动，并且其他住宅代理检测服务独立验证了数据，白宫IP很可能在一段时间内一直被住宅代理网络用于各种活动。”
“Our data retention period goes back to July 10,” the Layer3 founder explained. “Given that there was continuous activity for a matter of months and other res proxy detection services independently verified the data, it's likely that White House IPs have been used by res proxy networks for all sorts of activity for some time now.”
乌萨蒂uk表示，他公司的的数据还不够详细，无法知道白宫网络内部有多少台机器正被用作出口节点。他向我们指出安全公司Synthient在X平台上的一篇帖子，该帖子称其认为白宫网络上有多个Windows 10和11设备可能安装了Infatica SDK。
Usatyuk said his firm’s data isn’t detailed enough to know how many machines are being used as exit nodes inside the White House network. He pointed us to an X post from security firm Synthient, which said it believes there are multiple Windows 10 and 11 devices on the White House network that likely have the Infatica SDK installed on them.
Infatica提供了一个软件开发工具包（SDK），允许应用开发者通过将用户的设备变成住宅代理出口节点来将其互联网连接变现。
Infatica offers a software development kit (SDK) that allows app developers to monetize users' internet connections by turning their devices into residential proxy exit nodes.
该软件可能在与白宫网络相关的设备上运行的可能性引发了严重的的安全担忧：脆弱的代理软件可能会为攻击者提供一条通往内部系统的途径。
The possibility that this software is running on devices associated with the White House network raises serious security concerns: Vulnerable proxy software could potentially provide attackers with a route into internal systems.
乌萨蒂uk告诉我们，白宫网络上最近一次住宅代理活动发生在周三晚上，“在博客上线几小时后”，但此后已经停止。
Usatyuk told us that the most recent residential proxy activity on the White House network occurred Wednesday night, “hours after the blog went live,” but has since stopped.
美国国务院于周四上午联系了Layer3，索取该公司日志的副本，乌萨蒂uk告诉我们他已经将其发送过去。
The US State Department contacted Layer3 Thursday morning to request a copy of the company’s logs, which Usatyuk tells us he’s sent over.
乌萨蒂uk补充道：“希望他们已经搞清楚了状况，”并且希望在任何政府机密泄露之前做到这一点。白宫没有回复针对本篇报道的置评请求。
“Hopefully they've figured out the situation,” Usatyuk added - and hopefully before any government secrets have been exposed. The White House didn't respond to questions for this story.®