SuperBox media players exploited via residential proxy networks to deliver malware and compromise home networks

As online services get better at blocking malicious traffic, the attackers and scammers behind them have been forced to find new ways to reach their targets. The alternative of choice is now what are known as residential proxy networks. These systems funnel millions of home Internet connections into a unified network, and the proxy operators allow attackers to route their malicious traffic through these connections for a fee. The online services see only IP addresses with good reputations and geolocations that don’t stand out.

More often than not, the home users have no idea that their connections are being used to facilitate crime and occasionally even nation-state attacks. Users who do know often don’t care much. In exchange for leasing out part of their unlimited bandwidth to others, many get free movie and TV show streaming. Several less tech-savvy people I know who own such digital media players have told me, after I explain how the media players piggyback off their connections, that the bonanza of content is worth it. They find the tangible benefits outweigh the abstract harm they pose.

Infecting already compromised devices

Research published Monday brings the threat into much clearer view. Security firm Plume cataloged a vast ecosystem of malware that preys squarely on users of SuperBox, just one of many media players offering pirated content. These malicious apps can be surreptitiously installed by remote attackers even when the devices are positioned behind a router. While Monday’s deep-dive analysis focused exclusively on SuperBox, Plume warned that dozens of similar streaming devices pose precisely the same threat.

“Our researchers found that these residential proxy networks are not simply monetization tools,” Plume researchers wrote. “They are actively being used as a target for additional malware delivery, enabling cybercriminals to infect already-compromised devices with entirely new malware families while remaining largely invisible to the device owner.”

The Android-based SuperBox is configured with almost all the OS-based security protections turned off. Apps that come pre-installed, or those that are available through the SuperBox app store, then run as root, meaning they have unfettered administrative system rights on the device. Paying proxynet customers can also gain root by issuing a handful of Linux commands. With that, either the app or the paying customer can install their own apps and surveil and join the local network the device is connected to, where they have the same system rights as any other connected device.

The SuperBox neuters default Android defenses, including signature verification, the “unknown sources” restriction, the permission-review dialog, and Play Protect scanning. As a result, the box’s ADB (Android Debug Bridge) is exposed to the Internet. Worse, the su binary—the code that provides the command-line interface allowing users with low-level system rights to temporarily gain administrator-level access—is set to grant root without any authentication. The combination of the ADB being exposed to the Internet and the lack of authentication for root access means that both apps and users of the proxy service can execute virtually any command they want on the device.

More often than not, users position their SuperBox behind their home router, where they may think their device is safe from Internet-connected remote attackers. In fact, that sense of security is completely false. The binary that provides proxy functions inside many SuperBox apps opens an outgoing connection to a proxy server and keeps it open as a communication channel indefinitely. Routers are unable to block the communications because the connections they rely on are outbound and encrypted between the SuperBox and the proxy server. Even users who are savvy enough to monitor traffic on their network never see anything that looks like an inbound connection to the ADB port.

“The open ADB port plays the central role,” Plume researcher Gergely Eberhardt wrote in an email. “Combined with root access, a single pm install command can silently install any APK. This bypasses every one of Android’s default protections at once: signature verification, the “unknown sources” restriction, the permission-review dialog, and Play Protect scanning.”

Intruders at gates

The open ADB, along with the default presence of apps that have built-in proxy functionality, creates a dangerous mix that makes SuperBox a potent threat.

“This combination results in further infections involving additional residential proxies or IoT botnets, and the attackers are often the very customers of the primary proxy network,” Plume wrote. “The device owners get multiple bots they never asked for and are not aware of, all competing for the same hardware, and an IP address whose reputation now reflects whatever those bots utilize it for.”

Some of the proxy networking services that make use of SuperBox take measures to prevent their customers from accessing the local networks of SuperBox users. The recently disrupted Popanet, for instance, blocks local IP address ranges from outside the local network. Even then, Popanet users can access local IPs by specifying the special wildcard address 0.0.0.0, which Android then routes to the SuperBox IP 127.0.0.1. From that vantage point, proxy users can access the rest of the local network.

Monday’s post also reported that even the Popanet network was facilitating live exploit attempts. Plume wrote:

The internal-network protection issue that we described in the previous part isn’t just a theoretical concern. To confirm whether anyone is actually exploiting it, we ran a controlled experiment. We joined the Popanet network as a residential exit node and instructed the host that any connection coming through the tunnel targeting either port 5555 or 5858 (these are the most common ADB ports) would be redirected to our local honeypot. From the operator’s perspective, our node looked like any other regular residential endpoint serving customer traffic; from the inside, every attempt aimed to reach an ADB port through our node was captured.

We let the node run for over three weeks; over that period, the honeypot recorded 1,352 distinct attempts at reaching the ADB through the gap we identified earlier. All the attacks could be split into two families of loopback addresses targeting the local machine. The first is 0.0.0.0, supplied either as a raw address or embedded in a hostname via a wildcard DNS service such as nip.io. The second is 127.0.0.1, which the proxy blocked via isLoopbackAddress() as we explained earlier.

An email sent to [email protected] seeking comment didn’t receive a response before this story’s publication.

Intruding traffic attempted to install multiple malicious apps that made SuperBoxes a node in yet another proxy network or join botnets for use in DDoS attacks. The three primary apps were CECbot, a variant of Mirai, and Maskify.

It’s hard to walk away from Monday’s report with anything other than the strong conviction that SuperBox—and virtually all of its peers—pose a tangible and imminent threat to the networks they’re connected to. Even savvy people who think they can be cordoned off from the Internet are at risk. If you’re using one, you should disconnect it and throw it away. If you find a family member using one, you should intervene. With the Popanet proxy service alone running through 2 million devices, according to Google, chances are good that a home network near you is, too.