[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRMUlEc5IljYjwByg9fG4fFHwEX-WZBI3V9mxx9l7gwI":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"787b3a90-d0d7-47e0-8a87-9bc766edb49c","Researchers Discover White House Network IP Available for Rent Through 28 Proxy Services","researchers-discover-white-house-network-ip-available-for-rent-through-28-proxy-bab417","Researchers at Layer3 Intel found that 28 residential proxy services rent addresses on the White House network. Anyone with a few dollars could send web traffic through them. The activity ran from October 5 to November 3, 2026. The team spotted the activity while browsing its new Residential Proxy Observatory, a tool that shows proxy […] The post Researchers Discover White House Network IP Available for Rent Through 28 Proxy Services appeared first on Cyber Security News.","Researchers discovered that 28 residential proxy services were renting IP addresses belonging to the White House network, allowing anyone to route web traffic through them. This activity, observed between October 5 and November 3, 2026, originated from AS2650, a network block registered to the Executive Office of the President. The findings suggest a personal device on the network may be running proxy software without the owner's knowledge, posing a security risk.","White House network IPs were found available for rent via 28 residential proxy services.","https:\u002F\u002Fcybersecuritynews.com\u002Fwhite-house-network-ip-for-rent\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FWhite-House-Network-IP-for-Rent.webp","2026-11-05T13:31:43+00:00","2026-11-05T14:00:30.385081+00:00",7,[17,20],{"name":18,"type":19},"Layer3 Intel","vendor",{"name":21,"type":22},"Residential Proxy","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},[],[18],{"controls":44,"vendors":123},[45,73,94],{"slug":46,"name":47,"problem":48,"products":49},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[50,57,65],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":52,"url":55,"description":56},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":74,"name":75,"problem":76,"products":77},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[78,86],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":95,"name":96,"problem":97,"products":98},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":136},"white-house-network-ips-rented-out-via-proxy-services-due-to-unauthorized-device","White House Network IPs Rented Out via Proxy Services Due to Unauthorized Device","A personal device connected to the Executive Office of the President's network appears to have been running proxy software — likely without the user's knowledge — allowing 28 commercial proxy services to rent out White House IP addresses to anonymous third parties. This represents a serious configuration and security awareness failure: an unmanaged or insufficiently monitored endpoint became an unwitting exit node for potentially adversarial traffic. The risk is twofold — sensitive government IP space was commoditized for anonymous browsing, and inbound\u002Foutbound traffic patterns associated with the White House network could be manipulated or observed. This incident underscores that even the most sensitive networks can be compromised by a single uninspected personal device, making endpoint visibility and user awareness non-negotiable.",[129,130,131,132,133,134,135],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1090: Proxy",{"MITRE ATT&CK T1090: Proxy":137,"NIST SP 800-53 SI-2: Flaw Remediation":138,"CIS Control 14: Security Awareness and Skills Training":139,"CIS Control 1: Inventory and Control of Enterprise Assets":140,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":141,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":142,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":143},"This incident directly maps to the Proxy technique, where adversaries or unwitting users route traffic through intermediary systems — defenders should monitor for and block internal hosts acting as proxy nodes.","While not a software flaw per se, unauthorized software running unchecked reflects a failure to identify and remediate configuration deviations — a gap SI-2 addresses through continuous system monitoring and correction.","The device owner likely did not realize their machine was running proxy software, highlighting a gap in user education about unauthorized software and the risks of connecting personal devices to sensitive networks.","The unauthorized proxy software ran on a personal device that was apparently untracked; a complete, enforced asset inventory would have flagged the unmanaged endpoint before it became a risk.","Regularly scanning endpoints for unauthorized or vulnerable software installations would have surfaced the proxy agent running on the internal device before external researchers discovered it.","Hardened device configurations and application allowlisting would have prevented proxy software from being installed or executed on any network-connected device.","Stricter controls on which devices are permitted to connect to the network — enforced via device identity and authentication — would have prevented an unmanaged personal device from gaining network access."]