SuperBox Security Risk: Open ADB Ports Could Enable Android Malware Infections

“The open ADB port plays a central role,” Plume researcher Gergely Eberhardt wrote in an email. “When combined with root access, attackers can silently install any APK using a single pm install command. This bypasses Android’s default security protections, including signature verification, unknown-source restrictions, permission prompts, and Play Protect scanning.”

An Open Door for Attackers

An exposed Android Debug Bridge (ADB) port, combined with preinstalled apps that offer proxy functionality, creates a dangerous security risk. Together, these features can turn SuperBox devices into powerful tools for malware distribution, residential proxy networks, and IoT botnets.

“This combination can lead to additional infections involving residential proxies and IoT botnets, with the attackers often being the same customers using the primary proxy network,” Plume wrote. “Device owners may end up with multiple bots they neither requested nor know about, all competing for the same hardware and internet connection. The device’s IP reputation can then be affected by whatever activity those bots perform.”

Some proxy services that use SuperBox devices attempt to prevent customers from accessing users’ local networks. For example, Popanet blocks local IP address ranges when traffic originates outside the local network. However, Popanet users can still access local addresses by entering the special wildcard address 0.0.0.0. Android routes that address to the SuperBox device’s loopback address, 127.0.0.1, potentially allowing proxy users to reach other devices on the local network.

In a post published Monday, we reported that the Popanet network was facilitating live exploitation attempts. Plume described the findings as follows:

The internal network protection issue discussed in the previous section is not merely theoretical. I conducted a controlled experiment to determine whether attackers were actively exploiting it. We joined the Popanet network as a residential exit node and configured the host so that connections through the tunnel targeting ports 5555 or 5858—the most commonly used ADB ports—would be redirected to a local honeypot. From the operator’s perspective, our node appeared to be an ordinary residential endpoint handling customer traffic. Internally, however, every attempt to reach the ADB service through the node was captured.

Our nodes remained active for more than three weeks. During that time, the honeypot recorded 1,352 separate attempts to access ADB through the previously identified security gap. The attacks fell into two groups of loopback addresses targeting local devices. The first used 0.0.0.0, either as a direct address or embedded in a hostname through a wildcard DNS service such as nip.io. The second used 127.0.0.1, which the proxy blocked through isLoopbackAddress(), as described earlier.

We contacted [email protected] for comment before publication but had not received a response.