Free TV set-top boxes carry significant risks
The SuperBox type set-top boxes that offer free viewing come with serious vulnerabilities. They can be exploited by hackers to set up a home proxy network, install malware, and pose a threat to the security of the entire home network.
The price of free movie viewing: Your home network is being secretly exploited.
Many affordable Android set-top boxes on the market offer free access to a wide range of online movies and TV shows, attracting a large number of ordinary users. Many users believe that by spending a little money, they can enjoy unlimited free TV shows without having to pay a membership fee, and the cost-benefit is extremely high. However, few people know that behind the guise of free content, these devices hide huge network security risks.
Nowadays, various legitimate video platforms have become increasingly strict in risk control. Malicious traffic and cyber attacks are difficult to be carried out through conventional channels. Hackers have thus turned their attention to the massive home broadband resources and created a large-scale home proxy network. In simple terms, they hijack the network IP of ordinary households to disguise themselves and attack with traffic, avoiding the platform's risk control and traceability tracking.
SuperBox is a typical representative of such problem devices and is currently the model with the most thorough risk exposure. After users install the device, it seems that they are just watching free movies, but in fact, their own network bandwidth and home IP will be secretly requisitioned by the background and connected to a commercial proxy network. Hackers and black market practitioners can pay to rent these home IPs to carry out various illegal and even criminal network operations.
The system protection completely failed, and the device's backdoor was fully exposed.
The latest research by cybersecurity company Plume has thoroughly exposed the underlying security vulnerabilities of SuperBox. This set-top box based on the Android system was deliberately designed to disable almost all of the native security mechanisms of Android at the factory, equivalent to a bare machine connected to the internet without any protection capabilities. All four core security protections of the device were disabled. The ADB debugging port of the device was directly exposed to the outside world and accessible to the entire network. This is a dedicated port for developers to debug the device, and after being opened to the public, it effectively opened the control gate of the device to the entire network of hackers.
What's even more dangerous is the permission settings of the device. The core permission files of the system do not require any verification to directly grant the highest root administrator permissions, allowing attackers to obtain the highest control rights of the entire device with one click. Ordinary Android devices require manual unlocking and strict verification for root permissions, while SuperBox has no review or reminder throughout the process. Once the permissions are obtained, attackers can freely install software, tamper with the system, and even penetrate the entire home local area network.
The router is completely unable to block it.
Many users believe that by connecting the device behind the router, there is a network barrier providing protection, and it will not be attacked by the external network. However, the background operation mechanism of SuperBox bypasses all the protection rules of the home router. Unlike the common external network active intrusion, this set of risky traffic is actively connected by the device to the external network. Even if users monitor the network data, they can only see the regular internet usage records and completely fail to detect the hidden proxy traffic and backdoor channels.
To verify the real harm of the vulnerability, the Plume team set up an exclusive honeypot system to simulate the connection of an ordinary SuperBox device to the well-known Popanet proxy network, and monitored all external attack behaviors throughout the process. During the over three-week experimental period, the honeypot captured a cumulative total of 1,352 independent attempts of ADB port attacks. These attacks were clearly targeted, all aiming at the system vulnerabilities of SuperBox, attempting to invade the device and implant Trojan programs.
The attacks mainly fall into two paths. The first type exploits the local loopback address vulnerability, through special addresses and DNS wildcard services, bypassing the protection to access the device's background. The second type evades the basic protection rules of the proxy platform, breaking through the restrictions to achieve remote intrusion. Even though some proxy platforms have made basic protection optimizations, they still can not completely eliminate the attack behavior.
Deriving multiple network security risks.
After hackers breach devices through vulnerabilities, they will install malicious programs on a large scale. Some Trojans will convert the devices into brand-new proxy nodes, continuing to provide IP rental services externally and expanding the scale of the illegal network. Some Trojans will form botnets, ready to respond to instructions at any time and launch large-scale DDoS network attacks to paralyze websites, servers and online services.
The Plume team emphasizes that security risks are not unique to SuperBox. Dozens of similar free TV set-top boxes on the market all adopt the same underlying architecture and operation mode, and have exactly the same security vulnerabilities. Many users mistakenly believe that as long as they do not install software randomly, they can avoid risks. However, the risks of these devices are the native vulnerabilities pre-installed when they are manufactured, and they will be compromised as soon as they are connected to the internet.