SuperBox devices expose ADB port 5555 to 1,352 exploit attempts via Popanet proxies in three weeks

SuperBox units ship with ADB enabled on port 5555, root access, and preinstalled proxy applications. A single pm install command installs arbitrary APKs without signature checks, unknown-sources prompts, or Play Protect scans. This vector converts consumer streaming devices into residential proxy nodes and competing IoT bots on the same hardware and IP address.

Honeypot data captured two attack families: direct 0.0.0.0 addressing via nip.io wildcard DNS and 127.0.0.1 attempts that evade isLoopbackAddress checks. Popanet’s local-IP blocks proved ineffective once wildcard routing reached the Android loopback. These attempts occurred while the node appeared as ordinary residential traffic to the proxy operator.

Android TV boxes have carried open ADB exposures since at least 2018; the addition of monetized proxy services creates an economic incentive for persistence that earlier malware lacked. Multiple botnets now contend for the same CPU and bandwidth, degrading device performance and blacklisting the owner’s IP for downstream abuse.

No firmware update or Play Protect rule currently closes the ADB exposure on SuperBox hardware. Network operators can block outbound port 5555 at the gateway, but consumer remediation requires manual ADB disablement or device replacement.