The open ADB port on Super Box devices plays a central role in a critical security vulnerability, according to Plume researcher Gergely Eberhardt. Combined with root access, a single pm install command can silently install any APK, bypassing Android’s default protections including signature verification, unknown sources restrictions, permission-review dialogs, and Play Protect scanning. This creates a dangerous mix with built-in proxy apps, enabling attackers to turn devices into residential proxies or IoT botnets without user knowledge.

Plume noted that device owners often become unwitting hosts for multiple bots competing for hardware resources, damaging their IP reputation. Some proxy services like Popanet attempt to block local network access but can be circumvented using wildcard addresses like 0.0.0.0, which routes to 127.0.0.1, allowing access to local networks. In a controlled experiment, Plume joined Popanet as a residential exit node and monitored ADB port targeting over three weeks, recording 1,352 distinct exploit attempts.

All attacks used loopback addresses—either 0.0.0.0 via wildcard DNS or 127.0.0.1—highlighting active exploitation. An email to [email protected] for comment went unanswered before publication.