172: SuperBox

Episode Summary

Executive Summary: The episode investigates allegedly malicious streaming boxes (Superbox, VC Box, MAGA Box) sold through major marketplaces and reseller networks. Deadass describes reverse engineering them and finding suspicious Android builds, TeamViewer, aggressive network scanning, and ties to Tencent and a botnet. The story argues these devices are not just piracy tools but potential home-network surveillance and attack platforms with wider geopolitical and consumer-security implications.

Main Topics: How the investigation began (Priority: 4/5): Jack frames the story through a comparison to product recalls, then introduces Deadass and her curiosity about whether dangerous computers or devices ever get recalled like defective consumer goods. Discovery of malicious streaming boxes (Priority: 5/5): Deadass recounts finding the Superbox at her father’s house and testing it in a quarantined lab network, uncovering suspicious behavior including external callbacks, scanning, and aggressive probing of local devices. Distribution, marketing, and marketplace abuse (Priority: 5/5): The boxes are sold through Amazon, Best Buy, Walmart, eBay, TikTok, YouTube influencers, and reseller networks, creating a quasi-MLM distribution model that normalizes piracy and hides the risk. Security risks and botnet behavior (Priority: 5/5): The devices reportedly run outdated Android, include TeamViewer and other tools, beacon to Tencent, attempt SCADA-related exploit traffic, and were later confirmed to be part of the Kim Wolf botnet. Consumer psychology and propaganda (Priority: 4/5): The episode emphasizes how economic pressure, fragmented streaming subscriptions, and social proof make consumers vulnerable to propaganda-style marketing and normalize buying suspicious hardware. Law enforcement, ISP, and regulatory response (Priority: 4/5): The discussion highlights FBI warnings, third-party marketplace enforcement limits, ISP bandwidth anomalies, and the difficulty of removing the boxes once they are in homes and workplaces. Broader implications for hostile home networks (Priority: 4/5): Jack and Deadass argue that consumer spaces—homes, cafes, hotels, offices—can become hostile networks when infected devices are brought inside, changing how people should think about trust and hygiene.

Key Arguments: These boxes are more than piracy devices; they appear to be engineered or compromised for reconnaissance, exfiltration, and remote access. The products exploit frustration with expensive, fragmented streaming services and use influencer/reseller marketing to seem legitimate. Major marketplaces do not reliably prevent recurrence because third-party sellers can relist the same device under new accounts. Outdated Android, TeamViewer, Netcat-like tooling, and aggressive ARP behavior indicate a real attack surface, not a benign media player. The devices can be used as residential proxies and botnet nodes, giving attackers bandwidth and access to home and possibly corporate networks. Consumer trust in retailers like Best Buy, Walmart, and Amazon creates a false sense of safety that these sellers exploit. The investigation suggests the same model could be used in other sectors: if cheap, convenient products are paired with malicious infrastructure, consumers may unknowingly help build attack platforms.

Data Points: Injuries from recalled garlic press: 10 people - Jack opens by comparing the concept of a recall for dangerous kitchen tools to whether computers or tech devices should ever be recalled. Superbox price: $300 - Deadass’s father bought multiple Superboxes because they were inexpensive and promised lots of content. Timeframe of device activity: 2019-2020 initial timeline - Deadass says the suspicious Superbox activity and related online promotion appears to begin around this period. Android patch age: 2021 patch on a 2023-era device - Deadass found the operating system was just Android with an old patch level, leaving many holes. Superbox models observed: S5 to S7 - Deadass tracked successive hardware revisions as the product line continued to evolve. Botnet scale: 31 terabits per second - Jack references the Kim Wolf botnet as the largest DDoS attack ever observed at that point. Botnet device count: 2 million devices - The botnet allegedly controlled millions of devices, including confirmed Superboxes. Cloudflare mitigations: Over 2,000 attacks - Cloudflare’s report is cited as showing the botnet was extremely active in 2025. DDoS on Deadass’s home: About 15 minutes - Deadass describes a short but severe DDoS attack against her home network after public discussion of her research. Energy/data use complaint: 4,000 gigabytes in a single day - An ISP report described a customer whose usage was wildly higher than normal and later linked to a Superbox. YouTube influencer payout: 50% of proceeds - One influencer reportedly said the company offered half of each sale if they promoted the device.

Pivotal Quotes: "This is what they mean when they say like, it's gonna be plain as day in your face, and you're not gonna understand that like, again, an average everyday person's gonna read that and be like, oh, well, these people don't care." — Deadass: On how The Verge’s framing appeared to normalize or soft-pedal the risks of the boxes. "The whole picture is somebody ... getting influencers ... there's an entire distribution network of distributors and resellers." — Deadass: Her summary of how the operation spreads the devices through social and retail channels. "Do we want cheap, easy cable or do we want to continue to have, basically, back doors plugged into all of our networks?" — Jack Recider: The episode’s central tradeoff between convenience and security.

Implications: Listeners are warned that consumer gadgets can be covert attack infrastructure. The episode suggests stronger marketplace policing, better home network segmentation, and skepticism toward “too-good-to-be-true” tech deals, because hostile devices may already be inside ordinary homes and workplaces.