Hacker News new | past | comments | ask | show | jobs | submit
btown | on: Residential proxies detected on White House network
The danger here, of course, is that while these compromised devices are currently being monetized in a relatively benign way (other than bandwidth costs to the user, which to be sure can be nontrivial)… it would be naive to assume that there isn't a Command and Control capability that can assign less benign tasking - or can be compromised to do so.

This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…

mzajc | parent | next
> benign

On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.

How is DDOSing every site on the web benign?

nucleardog | root | parent | next
Relatively benign.

A compromised device inside the White House network could presumably be doing something _much_ worse than participating in a DDOS against random websites.

mcv | root | parent | next
And it's right there in the second line of the article:

> One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.

Surely a Russian company known for cyberattacks against the US having direct access to the White House network is far more serious than just DDOSing random websites. This is espionage at the highest level. (Again.)

KaiserPro | root | parent
The owner of the proxy is not great, but the fact that its an open door to snoop on everything else on the entire network is the realy fucker there.
loading story #50378394
lakeviewterrace | root | parent
[flagged]
hackernud3s | root | parent | next
Apparently they do not though.
Terr_ | root | parent
There were experts but the Republican White House fired them:

https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...

Perhaps some of them annoyed the President's illegally-appointed mega-donor, if they spoke out against giving root access to all his unvetted junior flunkies.

FireBeyond | root | parent
The same junior flunkies who would do things like go to government agencies, create administrative accounts, which would then, often with minutes, be seen connecting from Russia and Eastern Europe with the correct credentials.
10111001 | root | parent | next
> The same junior flunkies who would do things like go to government agencies, create administrative accounts, which would then, often with minutes, be seen connecting from Russia and Eastern Europe with the correct credentials.

They are young and think they are very smart. What could go wrong?

brador | root | parent
For anyone new, the above are talking about trump and Elons DOGE gov department.
trismus | root | parent
Source?
adzm | root | parent | next
> Daniel J. Berulis, a cybersecurity architect with the NLRB, filed a whistleblower complaint alleging that within 15 minutes of DOGE team members creating new user credentials and demanding administrative access, multiple login attempts using those exact credentials originated from a Russian IP address

https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...

Terr_ | root | parent
Oh come on, search-engines have gone downhill, but not that far downhill! You already know it involves "DOGE" and "Russia" and "credentials", that ought to be enough:

> Berulis alleged in the affidavit that there attempted logins to NLRB systems from an IP address in Russia in the days after DOGE accessed the systems. He told Reuters Tuesday that the attempted logins apparently included correct username and password combinations but were rejected by location-related conditional access policies.

* https://www.reuters.com/technology/cybersecurity/whistleblow...

* https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...

trismus | root | parent | next
I could have this entire conversation with ai too.
lukan | root | parent
You literally asked for a source and when provide by a human it was not enough? Maybe you should rather engage with AI completely then?
trismus | root | parent
It was enough and I appreciated it with the context, and conversation ensued. Not sure why I was scolded for doing so, that's what I meant by being able to have the conversation with AI - this whole interaction is defunct if we're going by the logic that it could be had another way.. I didn't want to go research it myself, I wanted to know where my peers are sourcing this novel-to-me information from.
what | root | parent
> often

You have one alleged example.

Terr_ | root | parent
> You have one alleged example.

That sounds like being deliberately obtuse and arguing in bad-faith. Are you going to "nuh uh" all the journalists and lawyers until you are personally given raw TCP dumps?

Behold, from the sworn affidavit of the DevSecOps guy with the top-secret clearance, as included in a whistleblower disclosure to Congress [0]:

> There were more than 20 such attempts, and what is particularly concerning is that many of these login attempts occurred within 15 minutes of the accounts being created by DOGE engineers.

So there it is, now don't go moving the goalposts.

[0] https://whistlebloweraid.org/wp-content/uploads/2025/04/2025...

2III7 | root | parent | next
Read "This is how they tell me the world ends".

Or let me sum it up for you. The government doesn't have the money to employ top security experts and top security experts don't actually want to work for the government.

altairprime | root | parent | next
Sometimes, top security experts often can’t work for the U.S. government even if they do want to due to being ineligible for security clearance from checks notes gender and sexuality mistrust, non-zero drug usage lifetime to date, formerly grayhats, have ever sought mental health care, and/or anti-authoritarian viewpoints.
| root | parent | next
{"deleted":true,"id":50372594,"parent":50372252,"time":1793832807,"type":"comment"}
lakeviewterrace | root | parent
To be fair, the track record for mentally unwell people in positions of trust isn't great.
dylan604 | root | parent | next
Before the most recent elections, people voted for an unwell person to lead the country. So it's not just someone can obtain the position, but that people actually chose to put one in office. Twice. Although, it was less well known on the first one.
StilesCrisis | root | parent | next
"Saw a therapist once" =/= "unwell."

In fact avoiding therapy at all costs is a good sign of trouble.

maxbond | root | parent | next
The track record for preventing people in positions of trust from seeking out mental health care is terrible. It's just brushing problems under the rug and waiting for them to turn rancid. Don't interpret not seeking help as the nonexistence of a problem, especially if their career depends on it.
altairprime | root | parent
Does the Department of Defense still have a clearance disqual for ADHD?
swiftcoder | root | parent
> The government doesn't have the money to employ top security experts and top security experts don't actually want to work for the

To be fair, they had quite a number of security experts on payroll before the current administration laid them all off...

manyatoms | root | parent | next
I'd be stunned if they're paying anywhere near enough to attract top talent
dhosek | root | parent | next
I applied to USDS in 2023, the process took nearly a year and ended with them just ghosting me after two interview rounds. Pay was capped (by law) below my target salary but at a level that I would accept as it would have been fully remote, but there was also a term limit on the job which meant I would have at most two years in the position.

It’s not just the pay, there’s a lot of structural elements that mean that the potential talent pool is less than desired.

vlan0 | root | parent | next
Th best folks I know wouldn't touch a government job, no matter the pay.
fhub | root | parent
There was a period of time where it seemed (as an outsider) that they were attracting good talent. This was when Megan Smith was CTO. https://en.wikipedia.org/wiki/Megan_Smith.
alt227 | root | parent
Dont they usually bargain work against jailtime for domestic cyber criminals?
| root | parent | next
{"deleted":true,"id":50372186,"parent":50372085,"time":1793829935,"type":"comment"}
vlan0 | root | parent
Bruh do you remember snowden? The government is HEAVILY sub-contracted. Accenture? Really? My guy...
miki123211 | root | parent | next
> The web is getting harder and harder to use

What are you doing to make this true?

I'm a screen reader user (which is as "weird and unusual" as it gets when fingerprinting mechanisms are concerned), and I am not really noticing much difference versus 2022 or so. Sure, there's little bits of anubis here or there, and a few sites (which I know for a fact are experiencing targeted DDoS attacks unrelated to AI scraping) having annoying Cloudflare verification screens, but that's about it.

My setup (other than the screen reader) is as vanilla as it gets. Safari, AdGuard for Ad blocking, no VPN except work VPN when necessary, no PiHole, no settings changed. If you're using something more esoteric, maybe try going mainstream and see if that improves your experience.

coke12 | root | parent
What do you mean by “anubis” here?
account42 | root | parent | next
It's a DRM middleware used to harass users of customized and privacy respecting browsers which is popular with many smaller websites.
Aldqueath | root | parent | next
I am not sure what you are doing to get "harassed" by anubis but I use privacy respecting browsers with ad blockers and vpns myself, and anubis is by far the least annoying, almost invisible even.

In comparison I get cloudflare recaptcha on every site that uses it, sometimes multiple times per session and sometimes not even letting me pass at all due to "error".

And if the website uses Google recaptcha then I close the tab because I know it will just end up in endless recaptcha hell.

account42 | root | parent | next
If you need to compare the project to Google and Cloudflare in order to look less bad that's not exactly a good sign.
jacquesm | root | parent
Google too. 'We are detecting unusual traffic from your address'. I don't know how often I've seen this and there isn't a byte that goes in or out on this connection without monitoring so if it really would be 'unusual' I would hope I would be on it before Google told me, especially not from a session that's been active for days or weeks.
barbafant | root | parent | next
Is that the one that shows an anime figure holding a magnifyig glass while it is checking your browser?
VorpalWay | root | parent
Yes, and at least in the past it did proof of work to verify that it wasn't a bot. Though apparently that is no longer effective against all bots.
tempfile | root | parent | next
Please substantiate this claim. What do you think makes it DRM? What kind of browser are you using that results in "harassment"? I use tor browser and other oddball firefox forks all the time, Anubis never gave me any trouble. I think it just requires you to compute some hashes.
kasey_junk | root | parent
It’s a software tool that specifically exists to allow content creators to enforce rules about how their content is used. It meets the dictionary definition of DRM.

It’s DRM that I think of as silly larping that doesn’t really bother me, but it’s clearly drm.

| root | parent | next
{"deleted":true,"id":50377184,"parent":50376758,"time":1793871692,"type":"comment"}
philipwhiuk | root | parent
This is such a wild re-imagining of 'preventing uncountable AI crawlers perform DoS attacks on a whim to make line go up'
franga2000 | root | parent | next
1) The proxy isn't the scraper. There are plenty of scrapers not using residential proxies.

2) They're clearly talking from the perspective of the user and network admin. A residential proxy virus is in fact quite benign for both.

3) No matter what, DoS is quite a low priority in terms of security. And it's not even really DDoS, you'll know a real DDoS when you're on the receiving end.

account42 | root | parent
> A residential proxy virus is in fact quite benign for both.

That's only because it isn't being prosecuted appropriately.

loading story #50377769
BeetleB | root | parent | next
> The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.

Indeed. I recently set up a bot on my local machine that I can interact with via Telegram. I gave it the ability to retrieve the contents of a URL via Playwright (with modifications). Basic things like getting the Readability view and getting the site as Markdown with links.

I was essentially mimicking the feature OpenAI etc offer where it can do a web search for you and get you the answer you seek. I just didn't want to pay a company for that feature.

It's not autonomous. It only acts when I tell it to. The actual search is via the Kagi API, but the URL contents is via Playwright. I also ensured it can't do lots of requests at a time. There's a mandatory (random) sleep of between 1 and 5 seconds between two requests.

In less than a week, I've been flagged. When I do a Google search (as a human), I have to prove I'm human. Many sites have simply blocked me - I can't buy stuff from various vendors[1], I cannot access several news sites, etc.

The thing is, I didn't really access that many sites with the bot! At most it's the equivalent of someone mildly addicted to the web. Yet they caught me quickly.

Obviously, I disabled the bot's capability to get site content. I wonder how long my IP will be in the blacklist.

I know some people will say "Good riddance" to the outcome and to what I did. I'd love to have a real, serious discussion on whether what I did was immoral. But whatever your thoughts on the matter, do ponder over the fact that the system has made it hard for average Joes like you and me to have this "feature", but if you pay a giant tech company a monthly fee, you can have it.

[1] Thankfully, Amazon didn't block me. In the past I'd avoid them, but now I'm in the dilemma where I don't want to buy stuff from sites that make it difficult for me to buy stuff from them!

nostrademons | root | parent | next
I think that major gateways like Google and Cloudflare and Akamai are doing things like TLS-fingerprinting and smearing.

I normally use a VPN to access the Internet. It's an ordinary consumer-grade VPN, and I use it for pretty innocuous things like watching the international versions of Netflix or avoiding being geographically-profiled and charged more when I book travel. The VPN itself, I'm sure, is being used for all sorts of naughty stuff: when I look it up in whatismyip, it comes up as VPN, "abuse detected", and "residential proxy detected". I expect to get blocked occasionally on it and just pause the VPN then.

What I found surprising is that pausing the VPN doesn't always clear the CAPTCHAs. The next request will also fail, sometimes. For a while I was wondering if I have a residential proxy on my network, but I went hunting with lsof and bandwidth monitoring and a list of all the open connections through my router, and it seems clear. Yet even with VPN disabled, I'll get CAPTCHAs from Google and Cloudflare.

I suspect they're using browser/TLS fingerprinting and then smearing the results of that across bad IPs. If you connect to them through a known-bad IP, they not only will CAPTCHA you, but they will record a fingerprint of any data they can. Then if you connect again with that fingerprint, regardless of the IP, they block that too.

Ironically, if you are actually malicious, you can get around this pretty easily. Because you'll know not to use a fingerprintable browser, or to rotate fingerprints. So you have one completely separate identity on a given IP (that is not yours), and if it gets blocked, you roll up another completely separate identity on a different IP. But this is too much work for an ordinary consumer who just wants to keep their IP private. So you end up with this excluded middle where the only rational strategies are to either do exactly what the website expects you to do (with no funny business, even if it's innocuous), or to go whole-hog as the aggressor where you're determined to skirt their policies no matter what, and if you're doing that you might as well amortize the effort by extracting everything of value you can from them.

proxyscore | root | parent | next
Expect to remain blocked, that's how defense works, some services plenty use will have is bot or known proxy exit node set to true, and some websites use the same defense services, request velocity is just one factor, if you don't have random human like scrolling and jitter with a bot, it's a dead profile walking, metaphorically speaking
itishappy | root | parent | next
I don't think this is an immoral application at all from your description, but would that be clear on the receiving end?
| root | parent | next
{"deleted":true,"id":50376523,"parent":50372903,"time":1793866437,"type":"comment"}
cowlevel | root | parent | next
Just restart your home router to rotate your IP address.
theGeatZhopa | root | parent | next
It depends on the DHCP part and your provider lease time. When you access the Internet through a modem and landline, it's an highly dynamical system, where it's difficult to guarantee every caller/user gets its own IP. Especially when IP sharing is used among the clients. Even more difficult it is with the mobile Internet. It's a constant connection loosing/reconnecting. Actually resetting and freeing up IPs for new devices, the whole time. With cable Internet (the TV cable) one is having a kind of stationary access point. The network provider can see it's topology and it never changes once a leafe has joined the network. I typically have the same access creds over months. Even when I restart my cable modem, it's still the same IP. When I was on modem, I could get a new IP every second of I wanted. Now I have to think twice, because I just can't get a new IP, even if is forcedly, not.
qlte | root | parent | next
That is entirely ISP dependent and many don't actually work like that. Your cable modem gets a specific IP for as long as Comcast or whoever sees fit, restarting does nothing on the WAN side.
prmoustache | root | parent | next
This is simply called the dhcp lease time. Restarting has never forced a change of ip on a system using a dhcp client.
consp | root | parent | next
In my case a downtime of over 4 hours will switch it. Might just be lease time doing its job.
drewnick | root | parent
True, I've had the same IPv4 address since 2018 on Spectrum despite rebooting at least 10 times.
proxyscore | root | parent
Doesn't work like that, only on mobile phones you can toggle airplane mode to get a new ip assigned and cgnat makes sure mobile ips are "trusted" , but they fingerprint you beyond ip address
TheDong | root | parent
> I know some people will say "Good riddance" to the outcome and to what I did.

I will instead say "skill issue".

Using Playwright results in some very obvious and easy to detect fingerprints. I'd expect better of someone on hacker news.

Mine hasn't been detected as far as I can tell, so I know it's possible to do better.

lynx97 | root | parent | next
elitist nonesense. "Look I am soooo cool, and you are not as cool as me."
DANmode | root | parent
Weird to hide basic stuff like random mouse-paths, mouse wiggle.
cyanydeez | root | parent | next
Compared to, russian intel scraping beyond demented word of mouth.
NavinF | root | parent
> 100req/s

While your server handles that, what does your CPU do with the other 99% of available cycles?

I run https://bunnystomp.com on an Always Free VM from a major cloud provider. It handles 1,930 req/s at 33 ms latency with no tuning/optimization. It's literally just python behind cloudflare.

mzajc | root | parent
You seem to know a lot about my server. From what I could see, all cores were pinned to 100%, but maybe my budget AMD CPU is hiding fantastical amounts of compute from the kernel. I'd love to know how to make use of it.

I have no idea what the site you linked does, but it doesn't look like a cgit instance to me; that's what got hammered on my end, and when hosting it, one very quickly finds out that many git operations are CPU-bound.

fn-mote | root | parent
If you want credibility from the get-go, you need to be up front about your application. I certainly took it to be a generic host for an unpopular site in your first comment.
yard2010 | root | parent
Nah this is hn, just trust people upfront
_alternator_ | parent | next
I'll just note that "compromised" is perhaps too strong. These services often come from VPN plugins (eg Hola VPN) that lets users watch sports from different restricted geographic regions. There is a trade here that's in the TOs: you get someone else's IP address, they get yours.
loading story #50378223
jeremyjh | root | parent | next
Compromised describes exactly what you are talking about. Any free rider on a network that the operator is unaware of means the device is compromised.
nomel | root | parent
If I'm using one of these services while connected to a guest wifi network, with the usual configuration for guest access (like no intranet connections), is that guest wifi network compromised? What's the threat model?
shakna | root | parent | next
If that guest WiFi network is running inside the White House? Yes, I'd say that is compromised. The threat model being that guests on that network may be diplomatic officials and staff.
autoexec | root | parent
> is that guest wifi network compromised?

I'd say yes since you've allowed random people unauthorized use of the connection. It makes no difference if it's your connection or not. For example, if that proxy gets used as part of a DDoS attack, your device compromised that network.

thefounder | root | parent
how is this different than Tor? You seem a bit on the surveillance side. The computer/network is compromised if someone gains unauthorized access to it not if you share it.
account42 | root | parent
TOR doesn't use unsuspecting participants as exit nodes, that's something you have to specificially enable.
tclancy | root | parent
What part of that isn’t technically “compromised”? You can argue there’s no evidence of it currently being weaponized but I’d say some shitbird running a free vpn inside the White House is not a good look regardless.
cowlevel | root | parent
We'd need a pedantic definition of "compromised" to be sure
50208 | parent | next
Why wouldn't an adversary be using it to conceal command and control traffic?
lesuorac | parent | next
> This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…

I mean politicians are so addicted to twitter the nsa makes special phones…

dylan604 | root | parent
Not sure which direction you're intending this. The NSA is making special phones to protect politicians, or to make it easier to ensure they can read everything?
za_creature | root | parent | next
Por que no los dos?

It's always better to protect politicians from someone else

lesuorac | root | parent
Politicians bringing phones isn’t a scif isn’t necessarily a bad thing.
YeahThisIsMe | parent
[flagged]
dylan604 | root | parent | next
Why are you so surprised that the US gov't is being spied on? Of course they are. Why/how could you ever suspect they would not be? How Polyanna can one be to think this way?
senordevnyc | root | parent
Why would you assume everyone in the world gives a shit about this?