Residential proxies detected on White House network
Residential proxies detected on White House network
Our Residential Proxy Observatory, launched earlier this week, is a first-of-its-kind interface that gives researchers a global view of residential proxy and anonymized internet activity.
本周早些时候推出的“住宅代理观测台”（Residential Proxy Observatory）是一个首创的界面，旨在为研究人员提供全球住宅代理和匿名互联网活动的概览。
While our team was looking through it, we noticed residential proxy exit activity on AS2650. AS2650 is registered to the Executive Office of the President, the federal agency that hosts the White House network. Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device’s network.
当我们的团队对其进行检查时，注意到 AS2650 上存在住宅代理出口活动。AS2650 注册于总统行政办公室，即负责管理白宫网络的联邦机构。住宅代理服务通过出售对日常设备的访问权限，让客户能够通过这些设备发送流量，从而使其看起来像是来自该设备的网络。
From October 5 to November 3:
从 10 月 5 日到 11 月 3 日：
To make sure this was not a fluke, we checked these addresses against other residential proxy detection services, such as Spur and Synthient. Their public IP context pages independently identify these addresses as residential proxy exits.
为了确保这不是偶然现象，我们将这些地址与 Spur 和 Synthient 等其他住宅代理检测服务进行了比对。它们的公共 IP 上下文页面独立地将这些地址识别为住宅代理出口。
This is public access. Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services.
这属于公共访问权限。任何人只需注册公共住宅代理服务，支付几美元，并通过其发送请求即可获得。我们并未有针对性地瞄准该网络，也没有试图让我们的探测器从该网络出口。我们只是在通过这些服务请求全球轮换访问时，偶然发现了这一点。
Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.
大部分活动发生在东部时间的傍晚：约有一半的活动集中在下午 5 点到午夜之间，而清晨几乎没有活动。这种模式表明这更像是一个人的行为，而非公共访客 Wi-Fi 网络：有人在深夜仍频繁使用白宫网络，且其设备感染了代理 SDK。我们的数据仅显示出口，并未显示设备本身或其背后的使用者。
Past research has shown that poorly secured proxy SDKs can allow internal network access and lateral movement. This is how past botnets have spread. In A Broken System Fueling Botnets, the researchers at Synthient documented how the Kimwolf botnet reached at least 2 million devices, mostly Android devices with an exposed ADB service, through residential proxy networks. If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems.
过去的研究表明，安全性较差的代理 SDK 可能允许内部网络访问和横向移动。这就是过去僵尸网络传播的方式。在《助长僵尸网络的破碎系统》（A Broken System Fueling Botnets）一文中，Synthient 的研究人员记录了 Kimwolf 僵尸网络如何通过住宅代理网络感染了至少 200 万台设备，其中大部分是暴露了 ADB 服务的安卓设备。如果该网络上的某个 SDK 存在类似缺陷，任何购买代理访问权限的人都可能利用它访问内部系统。
The White House is not the only surprise in the observatory. Residential proxies also reach some of the most isolated places on the planet.
白宫并不是该观测台中唯一的意外发现。住宅代理还触及了地球上一些最偏远的地区。
Saint Helena, Ascension and Tristan da Cunha is the South Atlantic territory that includes the most remote inhabited island in the world. We recorded 413 addresses and more than 32,000 observations there, split between Starlink and the island’s local internet provider, Sure Saint Helena.
圣赫勒拿、阿森松和特里斯坦-达库尼亚是南大西洋领地，其中包括世界上最偏远的有人居住岛屿。我们在那里记录了 413 个地址和超过 32,000 次观测，这些观测分布在星链（Starlink）和该岛当地互联网服务提供商 Sure Saint Helena 之间。
We also recorded three observations from Antarctica. All of them come from a Cloudflare WARP address that points to McMurdo Station.
我们还记录了来自南极洲的三次观测。它们全部来自指向麦克默多站（McMurdo Station）的 Cloudflare WARP 地址。
Other remote places with activity:
其他有活动的偏远地区：
Residential proxies have infected every corner of the world, and it looks like there is no place they cannot reach. Layer3 Intel tracks residential proxy and anonymization infrastructure worldwide. Even when the proxies hide in networks on the farthest corners of the planet, we can still observe them, leaving threat actors no place to hide.
住宅代理已经感染了世界的每一个角落，看起来没有它们无法触及的地方。Layer3 Intel 在全球范围内追踪住宅代理和匿名化基础设施。即使代理隐藏在地球最偏远角落的网络中，我们仍然可以观察到它们，让威胁行为者无处遁形。