Hardware
hardware:superbox
Also: SuperBoxes
Android-based streaming device marketed as providing access to large numbers of television channels and pirated content; the episode presents it as a potentially malicious device.
Android-based streaming device marketed as providing access to large numbers of television channels and pirated content; the episode presents it as a potentially malicious device.
“It’s called the SuperBox.”
“I have root access to the six that I have in my house”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DISCOVERED_BY | D3ada55 | Derived | 172 |
| outgoing | ASSOCIATED_WITH | Tencent | Explicit | 172 |
| outgoing | ASSOCIATED_WITH | Explicit | 172 | |
| outgoing | EXPLOITS | SCADA vulnerability | Explicit | 172 |
| outgoing | USES | ARP denial-of-service | Explicit | 172 |
| outgoing | USES | Address Resolution Protocol | Explicit | 172 |
| outgoing | USES | network scanning | Explicit | 172 |
| outgoing | USES | Residential proxy network | Explicit | 172 |
| outgoing | USES | Android | Explicit | 172 |
| outgoing | USES | TeamViewer | Explicit | 172 |
| outgoing | USES | Android Debug Bridge | Explicit | 172 |
| outgoing | USES | SuperBox App Store | Explicit | 172 |
| outgoing | ASSOCIATED_WITH | BadBox 2.0 | Explicit | 172 |
| outgoing | ASSOCIATED_WITH | Kimwolf | Explicit | 172 |
| outgoing | ASSOCIATED_WITH | Pre-positioning | Uncertain | 172 |
| incoming | ASSOCIATED_WITH | vSeeBox | Explicit | 172 |
| incoming | ASSOCIATED_WITH | Magabox | Explicit | 172 |
SuperBox DISCOVERED_BY D3ada55
D3ada55 investigated and discovered suspicious behavior in a SuperBox taken from her father’s house.
Derived Confidence 92% · Jack Rhysider EP 172 Details
“D3ada55 discovered something that was like discovering something you weren’t supposed to see”
SuperBox ASSOCIATED_WITH Tencent
The SuperBox was observed communicating with Tencent infrastructure.
Explicit Confidence 99% · D3ada55 EP 172 Details
“The first thing it does is call out to Tencent.”
D3ada55 identifies the Tencent communication as involving QQ/qq.com.
Explicit Confidence 98% · D3ada55 EP 172 Details
“Like, in China, yeah, like qq.com.”
SuperBox EXPLOITS SCADA vulnerability
The SuperBox triggered an alert for a SCADA vulnerability, which the episode presents as an attempted SCADA exploit.
Explicit Direction flagged Confidence 93% · D3ada55 EP 172 Details
“I get a hit in my vulnerability log, like in the threat log on my Palo Alto firewall, and it’s for a SCADA vulnerability.”
SuperBox USES ARP denial-of-service
The SuperBox generated enough ARP traffic to overwhelm devices and cause them to lose their IP address reservations.
Explicit Confidence 99% · D3ada55 EP 172 Details
“it was almost more of like an ARP DOS, because it was arping at things so hard that they would freak out and lose their IP address reservation.”
SuperBox USES Address Resolution Protocol
The SuperBox sent ARP requests to every IP address on the local network.
Explicit Confidence 99% · Jack Rhysider EP 172 Details
“this SuperBox was arping out to every IP in D3ada55’ network.”
SuperBox USES network scanning
The SuperBox actively scanned and probed other devices on the local network.
Explicit Confidence 99% · D3ada55 EP 172 Details
“they’re doing that discovery when they get on a network to see what’s on the network.”
SuperBox USES Residential proxy network
D3ada55 links the boxes’ large bandwidth consumption to residential proxy activity.
Explicit Confidence 97% · D3ada55 EP 172 Details
“Then when you factor in the residential proxy stuff, that’s a lot of bandwidth.”
The SuperBox runs Android rather than Android TV.
Explicit Confidence 99% · Jack Rhysider EP 172 Details
“the operating system on this thing is just Android, and not Android TV, just Android.”
SuperBox USES TeamViewer
The SuperBox contains TeamViewer, providing a possible remote-management capability.
Explicit Confidence 99% · D3ada55 EP 172 Details
“there’s TeamViewer on it, right? Like, why does it have TeamViewer?”
SuperBox USES Android Debug Bridge
The SuperBox exposes Android Debug Bridge without authentication and allowed a root shell.
Explicit Confidence 99% · D3ada55 EP 172 Details
“there’s no authentication on it. I was able to connect just straight across the Android Debug Bridge”
“it gave me a root shell.”
SuperBox USES SuperBox App Store
The SuperBox requires its own app store instead of the Google Play Store to access its streaming applications.
Explicit Confidence 99% · Jack Rhysider EP 172 Details
“install something called the SuperBox App Store.”
SuperBox ASSOCIATED_WITH BadBox 2.0
D3ada55 identifies the SuperBox as part of what was being called the BadBox botnet, specifically in the BadBox 2.0 context.
Explicit Confidence 97% · D3ada55 EP 172 Details
“this thing was part of what’s now referred to as the BadBox botnet.”
SuperBox ASSOCIATED_WITH Kimwolf
D3ada55 confirms that SuperBoxes were part of the Kimwolf botnet.
Explicit Confidence 99% · D3ada55 EP 172 Details
“They were confirmed as part of that botnet.”
vSeeBox ASSOCIATED_WITH SuperBox
The vSeeBox exhibited similar characteristics to the SuperBox and communicated with Tencent infrastructure; the episode presents the devices as related.
Explicit Confidence 96% · D3ada55 EP 172 Details
“it’s also beaconing straight to China via Tencent infrastructure.”
“they all start talking to each other.”
Magabox ASSOCIATED_WITH SuperBox
The Magabox looked and behaved like the SuperBox, including using a similar app-store and video-app arrangement.
Explicit Confidence 96% · D3ada55 EP 172 Details
“it looked just like the SuperBox.”
“it worked like the other two.”
SuperBox ASSOCIATED_WITH Pre-positioning
Jack speculates that the boxes may be a pre-positioning move, while acknowledging that the final intent is unknown.
Uncertain Confidence 78% · Jack Rhysider EP 172 Details
“It’s possible that all this is just some pre-positioning move of some kind”