// ARS TECHNICA — CYBERSECURITY
Think twice before installing this device promising free movies
In exchange for free stuff, devices make home connections part of a proxy network.
As online services get better at blocking malicious traffic, the attackers and scammers behind them have been forced to find new ways to reach their targets. The alternative of choice is now what are known as residential proxy networks. These systems funnel millions of home Internet connections into a unified network, and the proxy operators allow attackers to route their malicious traffic through these connections for a fee. The online services see only IP addresses with good reputations and geolocations that don’t stand out.
More often than not, the home users have no idea that their connections are being used to facilitate crime and occasionally even nation-state attacks. Users who do know often don’t care much. In exchange for leasing out part of their unlimited bandwidth to others, many get free movie and TV show streaming. Several less tech-savvy people I know who own such digital media players have told me, after I explain how the media players piggyback off their connections, that the bonanza of content is worth it. They find the tangible benefits outweigh the abstract harm they pose.
Research published Monday brings the threat into much clearer view. Security firm Plume cataloged a vast ecosystem of malware that preys squarely on users of SuperBox, just one of many media players offering pirated content. These malicious apps can be surreptitiously installed by remote attackers even when the devices are positioned behind a router. While Monday’s deep-dive analysis focused exclusively on SuperBox, Plume warned that dozens of similar streaming devices pose precisely the same threat.
“Our researchers found that these residential proxy networks are not simply monetization tools,” Plume researchers wrote. “They are actively being used as a target for additional malware delivery, enabling cybercriminals to infect already-compromised devices with entirely new malware families while remaining largely invisible to the device owner.”
The Android-based SuperBox is configured with almost all the OS-based security protections turned off. Apps that come pre-installed, or those that are available through the SuperBox app store, then run as root, meaning they have unfettered administrative system rights on the device. Paying proxynet customers can also gain root by issuing a handful of Linux commands. With that, either the app or the paying customer can install their own apps and surveil and join the local network the device is connected to, where they have the same system rights as any other connected device.
The SuperBox neuters default Android defenses, including signature verification, the “unknown sources” restriction, the permission-review dialog, and Play Protect scanning. As a result, the box’s ADB (Android Debug Bridge) is exposed to the Internet. Worse, the su binary—the code that provides the command-line interface allowing users with low-level system rights to temporarily gain administrator-level access—is set to grant root without any authentication. The combination of the ADB being exposed to the Internet and the lack of authentication for root access means that both apps and users of the proxy service can execute virtually any command they want on the device.
More often than not, users position their SuperBox behind their home router, where they may think their device is safe from Internet-connected remote attackers. In fact, that sense of security is completely false. The binary that provides proxy functions inside many SuperBox apps opens an outgoing connection to a proxy server and keeps it open as a communication channel indefinitely. Routers are unable to block the communications because the connections they rely on are outbound and encrypted between the SuperBox and the proxy server. Even users who are savvy enough to monitor traffic on their network never see anything that looks like an inbound connection to the ADB port.
“