SuperBox streaming devices that promise free movies and TV shows are quietly turning home networks into launchpads for cybercrime, according to new research published this week by security firm Plume. The findings highlight how cheap media players advertising pirated content can leave users exposed to remote attackers and additional malware.
The core problem lies in what researchers call residential proxy networks. These systems pool millions of home Internet connections into a single network, then let attackers route malicious traffic through those connections for a fee. To the online services on the receiving end, the traffic appears to come from IP addresses with clean reputations and ordinary geolocations, making it far harder to block.
In many cases, homeowners have no idea their connections are being used to enable crime, and sometimes even nation-state activity. Others are aware but accept the tradeoff: in exchange for leasing out a portion of their bandwidth, they gain access to a steady stream of free movies and television shows.
How SuperBox Opens the Door
Plume cataloged a broad ecosystem of malware targeting users of SuperBox, one of many media players that distribute pirated content. The malicious apps can be installed remotely by attackers even when a device sits behind a home router. While the analysis focused on SuperBox, Plume warned that dozens of similar streaming boxes carry the same risk.
“Our researchers found that these residential proxy networks are not simply monetization tools,” Plume wrote. “They are actively being used as a target for additional malware delivery, enabling cybercriminals to infect already-compromised devices with entirely new malware families while remaining largely invisible to the device owner.”
Security Protections Turned Off by Default
The Android-based SuperBox ships with nearly all built-in operating system protections disabled. Pre-installed apps, along with those offered through the SuperBox app store, run as root, giving them full administrative control over the device. Paying proxy network customers can also gain root access by entering a few Linux commands. From there, an app or a paying customer can install additional apps and monitor or join the local network, with the same system rights as any other connected device.
SuperBox disables core Android defenses, including signature verification, the “unknown sources” restriction, the permission-review dialog, and Play Protect scanning. As a result, the device’s ADB (Android Debug Bridge) is exposed to the Internet.
Compounding the danger, the su binary, which provides the command-line interface for gaining temporary administrator access, is configured to grant root without any authentication. With ADB exposed online and no authentication required for root, both apps and proxy service users can execute virtually any command they choose on the device.
Source
Image: arstechnica.com
