Plume Security Labs Uncovers "SuperProxy" Threat in Streaming Devices
Plume, a leader in home Wi-Fi optimization and ISP operational services, has exposed a critical security flaw in a class of "SuperBox" streaming media devices through its newly established Security Labs. The investigation revealed that these devices can be covertly hijacked to function as nodes in a commercial residential proxy network dubbed "SuperProxy" without users' knowledge.
The issue was first detected by Plume’s Network Operations Center (NOC) due to unusual uplink traffic patterns, prompting a deeper analysis. According to Plume CTO Chris Griffiths, the devices depending on installed apps can accept unauthenticated connections, creating tunnels to remote command servers. This behavior mirrors commercial proxyware schemes, where consumer devices are monetized by routing third-party traffic, potentially degrading ISP services and overwhelming network infrastructure.
Plume’s large-scale management of hundreds of millions of home broadband devices enables early detection of such threats. The company’s integrated security approach, powered by AI-driven telemetry data, allows for rapid identification and mitigation before issues spread widely. Affected ISP clients receive immediate support to isolate and remove compromised devices, minimizing service disruptions.
In a separate development, Plume’s security measures have earned recognition from Singapore’s Cyber Security Agency, which certified a Plume-integrated customer premises equipment (CPE) at the highest tier (Level 4) of its Cybersecurity Labelling Scheme. The certification confirms that the hardware meets rigorous security standards, including third-party penetration testing.
The full research paper detailing the SuperProxy findings is available [here].
Plume cybersecurity rating report: https://www.rankiteo.com/company/plume-wifi
SuperBox Media Technology cybersecurity rating report: https://www.rankiteo.com/company/superbox-media
"id": "PLUSUP1779971493",
"linkid": "plume-wifi, superbox-media",
"type": "Vulnerability",
"date": "5/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Consumer Electronics',
'name': 'SuperBox streaming media devices',
'type': 'Consumer IoT/Streaming Device'}],
'attack_vector': 'Unauthenticated connections to remote command servers',
'description': 'Plume Security Labs uncovered a critical security flaw in '
"'SuperBox' streaming media devices, which can be hijacked to "
'function as nodes in a commercial residential proxy network '
"('SuperProxy') without users' knowledge. The devices accept "
'unauthenticated connections, creating tunnels to remote '
'command servers, degrading ISP services, and overwhelming '
'network infrastructure.',
'impact': {'operational_impact': 'Degradation of ISP services, overwhelming '
'network infrastructure',
'systems_affected': 'Streaming media devices (SuperBox)'},
'initial_access_broker': {'backdoors_established': 'Tunnels to remote command '
'servers',
'entry_point': 'Unauthenticated connections via '
'installed apps on streaming '
'devices'},
'investigation_status': 'Completed',
'lessons_learned': 'Early detection of threats through large-scale device '
'management and AI-driven telemetry is critical to '
'mitigating widespread issues. Unauthenticated access in '
'consumer devices can lead to exploitation for proxy '
'networks.',
'motivation': 'Monetization through commercial proxyware schemes',
'post_incident_analysis': {'corrective_actions': 'Isolation and removal of '
'compromised devices; '
'enhanced monitoring for '
'affected ISP clients',
'root_causes': 'Unauthenticated access in '
'streaming devices allowed '
'hijacking for proxy networks'},
'recommendations': 'Implement rigorous security standards for consumer IoT '
'devices, including third-party penetration testing. '
'Enhance monitoring for unusual traffic patterns to detect '
'proxyware schemes early.',
'references': [{'source': 'Plume Security Labs Research Paper',
'url': 'https://www.plume.com/superproxy-research'}],
'response': {'containment_measures': 'Isolation and removal of compromised '
'devices for affected ISP clients',
'enhanced_monitoring': 'AI-driven telemetry data for rapid '
'identification and mitigation',
'incident_response_plan_activated': 'Plume’s Network Operations '
'Center (NOC) detected '
'unusual uplink traffic '
'patterns and initiated '
'analysis'},
'stakeholder_advisories': 'Affected ISP clients received immediate support to '
'isolate and remove compromised devices.',
'title': 'SuperProxy Threat in Streaming Devices',
'type': 'Unauthorized Proxy Network',
'vulnerability_exploited': 'Unauthenticated access via installed apps on '
'streaming devices'}