Researcher Reports SuperBox Security Flaws and Links to BadBox and Kimwolf Botnets
· 1:27:51 · Watch on YouTube ↗
Summary
Researcher D3ada55 describes unauthenticated root access, aggressive network probing and botnet infections involving SuperBox streaming devices. The interview also examines residential proxy abuse and an FBI warning about compromised IoT devices.
Key points
- D3ada55 says SuperBox devices repeatedly probed local devices and flooded them with ARP requests; the interview describes devices subsequently impersonating other hosts.
- She reports obtaining root shells on six devices through Android Debug Bridge without authentication and finding an outdated Android patch and preinstalled TeamViewer.
- The researcher links the investigated devices to BadBox 2.0 and says SuperBoxes were confirmed participants in the Kimwolf botnet. The host describes Kimwolf as a separate infection exploiting vulnerable devices.
- An FBI warning quoted in the interview describes criminals accessing home networks through IoT devices infected before purchase or during setup.
- D3ada55 reports unsolicited streaming boxes being mailed to oil and gas workers and a separate report of a box probing a corporate network through a remote employee's connection.
- The interview examines how reseller commissions, influencer promotion and third-party marketplaces encourage adoption despite security concerns.
- The operators behind the devices remain unidentified. Chinese government involvement, covert audio collection and cellular capabilities are discussed as speculation, not established findings.
Article Details
- Topics
- [06:03] Discovery of suspicious SuperBox behavior on a family network
- [07:37] Isolated testing, packet captures and aggressive ARP activity
- [14:57] Influencer promotion and reseller distribution
- [23:19] Reported links to BadBox and BadBox 2.0
- [25:19] Application analysis and unauthenticated Android Debug Bridge root access
- [31:02] FBI warning about compromised consumer IoT devices
- [43:26] Investigation of vSeeBox and related streaming devices
- [57:15] Kimwolf infections, DDoS activity and corporate network exposure
MITRE ATT&CK
T1046 · Network Service DiscoveryD3ada55 reports streaming boxes actively scanning and probing sacrificial Raspberry Pis and other devices on the local network.T1498 · Network Denial of ServiceThe interview describes Kimwolf directing infected devices to flood internet targets with traffic as a DDoS-for-hire service.
People
D3ada55Security practitioner and independent researcher who investigated SuperBox traffic, applications and firmware, reported unauthenticated root access, and supplied traffic captures and logs to authorities.Matt BrownIdentified in the interview as an IoT researcher whose SuperBox investigation and YouTube work drew attention to an exposed app-store repository.
Threat Actors
Malware
Aisuru-Kimwolf[59:10] for the year for 2025, and they said that the Aisuru-Kimwolf botnet was the busiest,BADBOX[23:30] we basically discovered that this thing was part of what's now referred to as the BadBox botnet.Badbox 2.0[24:11] we all came to the determination that it should just be — it's still BadBox, but it's BadBox 2.0Kimwolf[57:22] attack ever. It was the Kimwolf botnet, and it was launching attacks at 31 terabytes per second.
Vendors
Products
Android[19:27] learned that the operating system on this thing is just Android, and not Android TV, just Android.Magabox[46:30] I'm still looking, and in the beginning of last year, I found a third box called the Magabox.SuperBox[06:49] called the SuperBox. Immediately I'm like, okay, this already sounds weird, but keep going. So,SuperBox App Store[26:44] the Google Play Store and instead install something called the SuperBox App Store.vSeeBox[43:31] a bunch of sellers and folks on social media talking about the vSeeBox. [Music] So, again,
Tools
Android Debug Bridge[27:43] so, they're all running Android Debug Bridge, which makes sense if they're pretending to beCENSUS[05:33] Apple. I've already been kind of around the valley, as they say, and now I'm over at CENSUS.netcat[57:58] with all kinds of remote access features like TeamViewer, Netcat, and stuff. So,Packet Squirrels[08:17] D3ADA55: I got one of those Packet Squirrels from Hak5, and I had laughed to myself becausetcpdump[59:58] I didn't even name them anything interesting, but I'm looking; I've got tcpdump running on them,TeamViewer[19:59] through the apps. Like, there’s TeamViewer on it, right? Like, why does it have TeamViewer?