If the White House Can Be Hijacked, Your Business Network Can Too

Published: November 8, 2026 · Last updated: November 8, 2026

Local Business VoIP is the small-business site of Carolina Digital Phone, Inc., a Greensboro company that has been putting business phones on networks since 2000. I am the founder, and this week's news gave me a reason to write something a little more personal than our usual how-to guide.

What happened at the White House?

A threat intelligence company called Layer3 Intel runs a system that maps residential proxy networks by sending test traffic through them and recording where it comes out. In early November they published something they did not go looking for. Their report showed their test traffic exiting through AS2650, the network registered to the Executive Office of the President, 236 times between October 5 and November 3. It came out through 28 different commercial proxy services, from six distinct White House IP addresses.

Think about what that means in plain English. Anyone with a credit card and a few dollars could buy proxy access and have their web traffic appear to originate inside the White House. Security reporter Brian Krebs put it bluntly in his headline: you could rent an internet address at the White House.

The pattern told the researchers something else. The traffic showed up mostly between late afternoon and midnight. That is not a guest Wi-Fi network full of tourists. That is a person who works late, whose personal device has proxy software on it. A second research group, Synthient, later pointed at Windows machines beaconing to a known proxy provider's software kit, and Help Net Security reported that several proxy providers were named, including Geonode, Infatica and Mellowtel. One likely delivery vehicle was a free watch-party app for streaming video with friends.

Let me be fair to the people involved. Nobody has reported evidence that this access was used to attack White House systems. The White House has not commented. For all we know, the device belonged to a contractor, an intern or a visitor who downloaded a free app years ago and forgot about it. That is exactly my point. This was not an attack. It was an accident, and accidents are far more common than attacks.

Why does a free app sell your internet connection?

Because somebody is paying for it. Residential proxy networks are a legitimate, if murky, business. Companies rent them for price comparison, ad verification and web scraping, because traffic from a real home address does not get blocked the way traffic from a data center does. Criminals rent them for the same reason: fraud, credential stuffing and account takeovers look like ordinary customers when they come from your IP address.

To get millions of real addresses, proxy companies pay app developers to bundle their software kit into free apps. The developer gets paid per device. The user gets a free VPN, a free game, a free wallpaper app or a $29 streaming box. The proxy company gets a rentable exit point sitting behind your firewall. The disclosure, when there is one, is buried in a terms-of-service page nobody reads.

The scale is hard to overstate. Google went to federal court in 2025 over the BadBox 2.0 botnet, a network of more than ten million uncertified Android devices, many of them cheap streaming boxes and tablets that arrived already compromised. Researchers at Synthient documented a separate botnet called Kimwolf that reached at least two million devices by riding through residential proxy networks. And the intelligence firm Spur has shown that proxy software kits live inside smart TV apps, the kind of apps that come preloaded on the TV hanging in your conference room.

Here is the part that should bother every business owner. Some of these proxy networks do not just send traffic out. Google's own threat researchers found that certain proxy kits also accept traffic coming in, aimed at the enrolled device. That gives a stranger a path to probe other devices on the same network. Your file server. Your point-of-sale terminal. Your phones.

What does 47 years in this business teach you about this?

I have been in technology since the late 1970s. I wrote COBOL on mainframes when security meant a locked door and a sign-in sheet. I opened the first Apple store in North Carolina, I built an early internet service provider, and for the past 26 years I have run Carolina Digital Phone. If you want the long version, it is on our history page. The short version is that I have watched the perimeter of a business network dissolve in slow motion.

In 1985, the network was the computer room. You could point at it. In 1995, it was the server closet and a row of desktop PCs that the company owned and controlled. In 2005, laptops started walking out the door and coming back. In 2015, every employee brought a phone that was more powerful than the servers I started on, and every one of them joined the Wi-Fi. Today the network includes the thermostat, the door lock, the security cameras, the printer, the break-room TV, the speaker on the receptionist's desk and whatever anyone plugged in during the last office party.

The lesson I keep relearning is that the weakest device on a network is the one nobody is responsible for. The White House has professional security staff, and even they were defeated by a consumer device running a consumer app. A dental practice in Burlington or a law office in High Point has no such staff. Most small businesses have a router the internet provider dropped off, a password written on a sticky note, and a dozen devices nobody has inventoried.

I do not say this to frighten anyone. I say it because the fix is not expensive or complicated. It is mostly discipline.

Why should a phone company care about your smart TV?

Because your business phones live on the same network as that TV, and I have spent a quarter century learning what happens when they share a lane.

Voice over IP is sensitive to congestion in a way that email and web browsing are not. If a proxy app is pushing a steady stream of somebody else's traffic out of your building, your calls are competing with it. The symptoms look like a phone problem: choppy audio, one-way audio, dropped calls. The cause is a device that has nothing to do with phones. We have written about what call quality actually needs from a network and what causes one-way audio, and a surprising share of the time the answer is a rogue device sharing the connection.

There is a second reason, and it is the more serious one. A compromised device inside your firewall is a path to everything else inside your firewall. That includes desk phones, which are small computers with their own web interfaces and default passwords. A business phone system carries conversations with your clients, your patients and your bank. It should not be reachable from the TV in the lobby.

That is why Carolina Digital Phone has always insisted on separating voice traffic from everything else. When our local engineers install a hosted phone system, phones go on their own network segment with their own quality-of-service rules. It is a step that national providers who ship phones in a box and wish you luck cannot take, because they never see your building. We do. That difference is a big part of why businesses across North Carolina choose a local provider.

How exposed is a typical small business?

More than its owner thinks, and the table below is why. Every row describes a device I have personally seen on a small-business network, and the right-hand column is the question nobody asked when it was installed.

If you cannot answer the right-hand column for every device in your building, you are in the same position the White House was in last month. The difference is that you have no team of researchers watching your traffic for you.

What should you do about it this week?

You do not need a security budget to close most of this gap. You need an afternoon and a willingness to be a little inconvenient to your staff. Here is what I would do in my own building, in order.

Build a guest lane and use it

Nearly every business router can run a second, isolated network. Put every personal phone, every tablet, every TV and every gadget on it. Company computers and phones stay on the main network. If a proxy app wakes up on somebody's phone, it is now renting out a dead-end lane that cannot reach your files or your phones.

Delete the free stuff

Walk through company-owned computers and the TVs you own and remove free VPNs, watch-party apps, screen-sharing utilities and anything whose business model you cannot explain. If a product is free and it is not open source or from a company you can name, you are the product, and lately the product is your bandwidth.

Change every default password

Cameras, printers, TVs, thermostats and desk phones all ship with a password printed in the manual. So does your router. Change them. Write the new ones down somewhere that is not a sticky note on the monitor.

Turn on automatic updates and retire what cannot update

A device that stopped receiving security updates is a device with known, unpatched holes. If the manufacturer has abandoned it, so should you. Cheap streaming boxes from brands you have never heard of fall into this category the day you buy them.

Check your own address

Layer3 Intel and GreyNoise both offer free lookups that will tell you whether your business IP address has been seen in a proxy pool. It takes two minutes and the answer is either reassuring or clarifying. The Cybersecurity and Infrastructure Security Agency also publishes free guidance for small businesses that is written for owners rather than engineers.

Ask your phone provider one question

Ask whether your voice traffic is isolated from the rest of your office network, and whether anyone has actually looked at your network. If the answer is a shrug, you are not getting what you are paying for. Our VoIP security checklist and our network readiness guide will tell you what a good answer sounds like.

Why does it matter that your provider is local?

The device that embarrassed the White House was not found by the people who run that network. It was found by outsiders who happened to be looking. Most small businesses will never have anyone looking.

Unless, that is, the people who installed your phones are the same people who drive past your office on the way to lunch. When our engineers put a phone system into a business, they see the TV in the lobby. They see the camera system with the default password. They ask the awkward questions, because they are going to be the ones taking the call when your audio turns to gravel in the middle of a client meeting. That is what it means to have a trusted communications partner rather than a shipping label.

I wrote down five things in 2004 that I try to do every day: laugh, learn, teach, pray and love. The news out of Washington this month reminded me why "teach" is on that list. The technology we all depend on has become invisible, and invisible things do not get maintained. Somebody has to keep pointing at the TV in the lobby and asking what it is doing at eleven o'clock at night. In our corner of North Carolina, that is us.

If the most protected address in America can have its internet connection rented out by strangers because of one free app, so can yours. The good news is that you can fix it before anyone notices. The better news is that you do not have to do it alone.

Frequently asked questions