from the completely-compromised dept

Foreign Intelligence Has Easy Access To White House IT Systems Thanks To Dodgy Russian Proxy Software

Whether it’s DOGE bros stealing massive datasets and uploading them god-knows-where from Starlink terminals duct-taped to the roof of the White House, to Trump officials and family members having terrible OpSec resulting in their phones being consistently compromised by foreign actors, the total cybersecurity failures of this administration have been wildly under-stated by the press.

Another recent story that’s floating below the mainstream press’ attention threshold: Brian Krebs points out that security firm Layer3 Intel found that numerous White House staffers have been using phones and devices embedded with residential proxy services that render their internet address available for others to rent from inside the walls of the White House.

One of the proxy services detected by the firm is a Russian company whose founder’s web hosting business was foundational for cyberattacks against election systems in Arizona and Illinois in 2016:

“The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into “free” mobile and desktop applications. Infatica’s founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in Arizona and Illinois in 2016.”

Layer3 Intel indicates that the proxy exit nodes in use from inside the White House came from six internet addresses, on 26 of the 30 days they monitored, with most of the transfer activity happening between 5 p.m. and midnight, after normal office hours. From the Layer3 Intel write up:

“Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.”

Some of these proxy services sell bandwidth for as low as 60 cents a Gigabyte, meaning that for far less than a cup of coffee outside actors can theoretically gain access to some of the most confidential and trusted U.S. government networks. And this is the incompetence we know about.

Historically, White House IT staffers should have caught this sort of thing long before a third-party security firm (which stumbled into this largely by chance). But this is the Trump administration, whose incompetence has been endlessly downplayed by a press that has historically been obsessed with normalizing and sane-washing the most corrupt administration in history.

This sort of stuff is happening endlessly in concert with numerous other warning signs that U.S. cybersecurity integrity has been deeply compromised, from recent revelations that NVIDIA CEO Jensen Huang having an affair with a Chinese spy, to Jared Kushner having his personal smartphone easily compromised, revealing his numerous dodgy dealings.

Trump’s use of personal, unsecured phones has been an ongoing concern since the first administration. As has his staff’s use of private email services and platforms for government business. You also have Trump’s rushed demolition and rebuild of the White House east wing, the rushed rebuild of which surely adhered to all of the traditional security screening procedures, right? Right? And it’s still not clear what data Musk’s DOGE bros stole from the government using unauthorized on-site Starlink terminals.

We’ve also apparently memory holed the Chinese Salt Typhoon hack, in which Chinese-government linked hackers gained historic access to U.S. telecoms to spy on all manner of government officials. The scope of that intrusion was so massive telecom lawyers told their IT staff to stop looking for additional evidence of intrusion for fear of incurring liability in the years to come.

Trump officials are genuinely too ignorant to believe in stuff like multi-factor authentication (MFA) or Common Access Cards (CAC) / PIV verification. And they haven’t much cared for the kind of strict Defense Information Systems Agency (DISA) and Secret Service controls required to maintain IT integrity. And this is before you even get to Trump illegally storing classified documents in his personal bathroom.

It is absolutely guaranteed that Russian, Chinese, Iranian, Israeli, and other major security services have been having a field day over the last decade. Hopefully the midterm shakeups result in some meaningful oversight for the first time, but it still seems likely that U.S. government IT infrastructure is going to need a massive auditing and potentially… a total rebuild.

This being America, I suspect a lot of the same companies that helped bring Trump to office will be rewarded with massive IT contracts to help fix the damage they directly contributed to.