Residential proxies turn media players into attack relays

Streaming devices that promise free movies in exchange for a slice of your bandwidth are nothing new, but new research from security firm Plume shows just how dangerous that trade-off has become. The devices, sold under brands like SuperBox, are effectively open doors to the home networks they sit on, letting remote attackers install malware and route criminal traffic through them — even when the box is tucked safely behind a router.

The hidden cost of free content

Plume's report, published Monday, cataloged a vast ecosystem of malware that preys specifically on users of SuperBox, one of many media players offering pirated content. These malicious apps can be surreptitiously installed by remote attackers even when the devices are positioned behind a router. While the analysis focused exclusively on SuperBox, Plume warned that dozens of similar streaming devices pose precisely the same threat.

“Our researchers found that these residential proxy networks are not simply monetization tools,” Plume researchers wrote. “They are actively being used as a target for additional malware delivery, enabling cybercriminals to infect already-compromised devices with entirely new malware families while remaining largely invisible to the device owner.”

Android defenses stripped away

The Android-based SuperBox is configured with almost all the OS-based security protections turned off. Apps that come pre-installed, or those that are available through the SuperBox app store, then run as root, meaning they have unfettered administrative system rights on the device. Paying proxy network customers can also gain root by issuing a handful of Linux commands. With that, either the app or the paying customer can install their own apps and surveil and join the local network the device is connected to, where they have the same system rights as any other connected device.

The SuperBox neuters default Android defenses, including signature verification, the “unknown sources” restriction, the permission-review dialog, and Play Protect scanning. As a result, the box’s ADB (Android Debug Bridge) is exposed to the Internet. Worse, the su binary—the code that provides the command-line interface allowing users with low-level system rights to temporarily gain administrator-level access—is set to grant root without any authentication. The combination of the ADB being exposed to the Internet and the lack of authentication for root access means that both apps and users of the proxy service can execute virtually any command they want on the device.

Router placement offers false comfort

More often than not, users position their SuperBox behind their home router, where they may think their device is safe from Internet-connected remote attackers. In fact, that sense of security is completely false. The binary that provides proxy functions inside many SuperBox apps opens an outgoing connection to a proxy server and keeps it open as a communication channel indefinitely. Routers are unable to block the communications because the connections they rely on are outbound and encrypted between the SuperBox and the proxy server. Even users who are savvy enough to monitor traffic on their network never see anything that looks like an inbound connection to the ADB port.

“The open ADB port plays the central role,” Plume researcher Gergely Eberhardt wrote in an email. “Combined with root access, a single pm install command can silently install any APK. This bypasses every one of Android’s default protections at once: signature verification, the “unknown sources” restriction, the permission-review dialog, and Play Protect scanning.”

Intruders at the gates

The open ADB, along with the default presence of apps that have built-in proxy functionality, creates a dangerous mix that makes SuperBox a potent threat.

“This combination results in further infections involving additional residential proxies or IoT botnets, and the attackers are often the very customers of the primary proxy network,” Plume wrote. “The device owners get multiple bots they never asked for and are not aware of, all competing for the same hardware, and an IP address whose reputation now reflects whatever those bots utilize it for.”

Some of the proxy networking services that make use of SuperBox take measures to prevent their customers from accessing the local networks of SuperBox users. The recently disrupted Popanet, for instance, blocks local IP address ranges from outside the local network. Even then, Popanet users can access local IPs by specifying the special wildcard address 0.0.0.0, which Android then routes to the SuperBox IP 127.0.0.1. From that vantage point, proxy users can access the rest of the local network.

Live exploit attempts confirmed

Monday’s post also reported that even the Popanet network was facilitating live exploit attempts. Plume wrote:

The internal-network protection issue that we described in the previous part isn’t just a theoretical concern. To confirm whether anyone is actually exploiting it, we ran a controlled experiment. We joined the Popanet network as a residential exit node and instructed the host that any connection coming through the tunnel targeting either port 5555 or 5858 (these are the most common ADB ports) would be redirected to our local honeypot. From the operator’s perspective, our node looked like any other regular residential endpoint serving customer traffic; from the inside, every attempt aimed to reach an ADB port through our node was captured.

We let the node run for over three weeks; over that period, the honeypot recorded 1,352 distinct attempts at reaching the ADB through the gap we identified earlier. All the attacks could be split into two families of loopback addresses targeting the local machine. The first is 0.0.0.0, supplied either as a raw address or embedded in a hostname via a wildcard DNS service such as nip.io. The second is 127.0.0.1, which the proxy blocked via isLoopbackAddress() as we explained earlier.

An email sent to info@mysuperboxtv.com seeking comment didn’t receive a response before this story’s publication.

Malware families and botnets uncovered

Intruding traffic attempted to install multiple malicious apps that made SuperBoxes a node in yet another proxy network or join botnets for use in DDoS attacks. The three primary apps were CECbot, a variant of Mirai, and Maskify.

The scale of the problem is staggering. With the Popanet proxy service alone running through 2 million devices, according to Google, chances are good that a home network near you is, too.

The stakes for home networks

It’s hard to walk away from Monday’s report with anything other than the strong conviction that SuperBox—and virtually all of its peers—pose a tangible and imminent threat to the networks they’re connected to. Even savvy people who think they can be cordoned off from the Internet are at risk. If you’re using one, you should disconnect it and throw it away. If you find a family member using one, you should intervene.

Why it matters

This research suggests that the trade-off many users make—tolerating sketchy hardware for free content—carries risks far beyond the device itself. The same connections that stream pirated movies also create a backdoor into your home network, where attackers can reach other devices, steal data, or launch attacks from your IP address. As proxy networks grow, the chance that an innocent-looking box in your living room is being used as a foothold for cybercrime becomes ever more likely. For anyone with one of these devices, the safest course is to unplug it now.