172: SuperBox

What if there was a device which gave you endless movies and TV shows without ads? Ok great sign me up! In this episode we interview “D3ada55”, who found such a device, but as she gazed into it, she discovered it gazing back at her. SponsorsSupport for this show comes from ThreatLocker® https://www.threatlocker.com/. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com https://www.threatlocker.com/. This episode is sponsored by Meter https://www.meter.com/, the company building networks from the ground up. Meter delivers a complete networking stack - wired, wireless, and cellular - in one solution that’s built for performance and scale. Alongside their partners, Meter designs the hardware, writes the firmware, builds the software, manages deployments, and runs support. Learn more at meter.com https://www.meter.com/. This episode is sponsored by Exaforce https://exaforce.com/darknet-diaries. Exaforce was created to handle the complete security operations workflow - detect, triage, investigate, respond. Exabots autonomously manage every stage, eliminating gaps between alert and action that slow down traditional security operations. And how it works is simple too: the exabots ingest all security data and then semantically connects it to understand the full context of security events and how they relate to each other. Learn more at exaforce.com/darknet-diaries https://exaforce.com/darknet-diaries.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:01Jack Rhysider?

  Hey, hey, it's Jack, host of the show. I went to Ikea the other day to buy lamp and when I went in, I saw that they had a recall notice on the bulletin board. Their garlic press was getting recalled. They said that 10 people got injured using it. And I think little metal bits would fall off and cut some fingers. So they stopped selling it and were issuing full refunds to anyone who bought one. And it made me think, hold on, has this ever happened with computers? Like, has a store ever recalled a computer because it was dangerous? And what does dangerous mean? There was a story that came out a few years back, which was about a super cheap gaming computer that was being sold on Amazon.

• 0:42Jack Rhysider?

  But little did anyone know, the computer came with malware on it. People who bought it would get their crypto wallets drained, their Steam accounts taken over, and their email compromised. The computers were made in China and came shipped with Windows 11. But the thing is, the company didn't want to pay for Windows keys so that they could sell the computers cheaper. So they found a hacked version of Windows 11 installer, which would bypass the whole license key thing. But the problem is, the installer would embed malware into the Windows install. So the seller didn't even know it had malware on it. Amazon reviews started showing up. "This computer is unsafe. Don't buy it." One star. And more reports came in about people saying that their computers came with malware on it.

• 1:27Jack Rhysider?

  And I mean, if you got a new gaming PC and during the time you were setting it up, it stole your cryptocurrency, took over your email, and stole your Steam account, how much would that hurt you? How dangerous is that? Would it hurt more than getting a metal sliver in your finger from a garlic press? I think so. Yet, as far as I know, computer shops such as Best Buy, Amazon, or wherever, never issue recall notices for computers or tech which are malicious. Retailers who sell defective items that are unsafe typically issue recall notices to buy back faulty items that are dangerous. But I just wonder if a computer, riddled with malware, doing enormous amount of harm

• 2:11Jack Rhysider?

  to users, will ever fall into the category of dangerous, or faulty, or harmful to retailers.

• 2:23Jack Rhysider?

  These are true stories from the dark side of the internet.

• 2:30Jack Rhysider?

  I'm Jack Reisider. This is Darknet Diaries.

• 2:51Jack Rhysider?

  This episode is sponsored by ShipStation. During Black Friday and Cyber Monday, things can get a bit hectic. Millions of people scrambling to find the lowest price online and then all clicking "Buy" multiple times within a 72-hour period. Now, retailers all over have to somehow ship those orders out on time, and that seems like a whole new level of hectic. One that ShipStation is built to help businesses manage. ShipStation is an end-to-end order fulfillment platform, built to handle the order surge of peak season and bring all your orders into one place so your team isn't scrambling when volume spikes. Over 1 million businesses have learned on ShipStation to get through peak season, scaling fulfillment up to 40x while cutting costs up to 30%. If I needed to ship a lot of stuff, I would definitely be using ShipStation.

• 3:36Jack Rhysider?

  Peak season doesn't wait, and neither should you. Get ahead of it today with ShipStation. Get 60 days free at shipstation.com and use code DARKNET. That's shipstation.com code DARKNET. Taxes and fees apply.

• 3:56Jack Rhysider?

  This episode is sponsored by DeleteMe. Have you ever thought, "I should really be doing something to protect myself from stalkers, scammers, and hackers"? But you're not sure what? Here's what you do. Go to joindelete.me/darknetdiaries and enter code DD20, and you'll get 20% off DeleteMe. A few years ago, I signed up, and ever since then, DeleteMe has been busy scouring the internet for my name and giving me reports on what they found and deleted stuff.

• 4:21Jack Rhysider?

  Take control of your data and keep your private life private by signing up for Delete Me now at a special discount just for my listeners. Get 20% off your Delete Me plan when you go to www.joindelete.me/darknetdiaries and use promo code DD20 at checkout. The only way to get 20% off is to go to www.joindelete.me/darknetdiaries and enter code DD20 at checkout. That's www.joindelete.me/darknetdiaries code DD20.

• 4:58Jack Rhysider?

  Today, I'm so excited because I finally get to talk with Deadass. It's good to see you again.

• 5:03Speaker 02

  I know.

• 5:04Jack Rhysider?

  So, we started, we start, I met you at DEF CON like five, six years ago.

• 5:09Speaker 02

  Like, one of my first, like, ever DEF CONs, yeah.

• 5:11Jack Rhysider?

  It was your first DEF CON, and you messaged me like, "Hey, you wanna meet? Where, where, can we meet somewhere? I got something to tell you." I was like, "Yeah, where?" And this was back in the days where I actually checked my DMs at DEF CON. Now, like, it's impossible for me to do that. And so, I was like, "Okay, go to the child zone. This is what I'm wearing. Okay, cool." And then we sat down at, like, a couch. And you're like, "Okay, I got something." And it was still hush, hush. I was like, "What is going on here?" And you had, you had, I won't give names here, but you had a contact with somebody who you knew had a good story. You're like, "I can, I can connect you with this person." I was like, "Great." And, and we did. We connected and we, we had conversations. So, uh, thank you for that.

• 5:50Speaker 02

  Yeah.

• 5:51Jack Rhysider?

  And so, that's where we first met. But then, I just watched you have talk after talk. And I learned more about you. Like, at the time, you told me your name was Deadass. And over time, I've just learned that your name, you really should be called Badass. Because you're, you're really, like, I think even back then, you were working on all kinds of really cool projects. Do you want to give us a background of just, like, your tech career?

• 6:19Speaker 02

  Yeah, I mean, it's kind of, I'm very much the textbook definition of non-traditional background as far as technology is concerned. Like, I have an English degree. I went to Berkeley for rhetoric and propaganda. Like, it wasn't.

• 6:34Jack Rhysider?

  Okay, so I heard that today. Yeah. Because we're here at CactusCon and I just heard your talk, but you did say that you have a degree in rhetoric and propaganda.

• 6:42Speaker 02

  Mm-hmm.

• 6:43Jack Rhysider?

  Is that true or was that a joke?

• 6:44Speaker 02

  That's like legitimately basically what the degree was in. It was all about like, understanding argument, understanding like the rhetorical devices and tools. And so I hyper-focused on the efficacy of propaganda from that. And that actually is what informed when I started looking at the topic of my talk, why I knew there was something weird about it. Like, it kind of like touched that part of my brain and I hadn't really seen anything like this yet.

• 7:09Jack Rhysider?

  So you, that was a career path for you? I want to go into propaganda?

• 7:13Speaker 02

  Well, more so I want to go to law school, or at least I thought I wanted to go to law school at one point. And then like, you know, the Bay is expensive, life is expensive. And then I, you know, built my first computer and I was like, oh wait, I can do this for like a job?

• 7:26Jack Rhysider?

  Yeah.

• 7:27Speaker 02

  What, why, why was I not just doing that? Like?

• 7:30Jack Rhysider?

  So you got into tech?

• 7:31Speaker 02

  Mm-hmm.

• 7:32Jack Rhysider?

  And then give us kind of a potted summary of some of the tech roles you've had.

• 7:36Speaker 02

  Yeah, so I've worked at some of the biggest names in security, so Palo Alto, Google, Apple. I've already been kind of around the valley as they say. And now I'm over at Census.

• 7:48Jack Rhysider?

  Oh, yeah. What, what do you do at Census?

• 7:51Speaker 02

  I'm a senior sales engineer, so not even like a researcher. I just do research for fun.

• 7:57Jack Rhysider?

  But the thing is, a few years back, Deadass discovered something that was like discovering something you weren't supposed to see. A discovery which would send her down a rabbit hole that would take her years of research to get to the bottom of. And it all started at her dad's house.

• 8:12Speaker 02

  Without giving away too much, he's uh one of the senior people at his oil and gas company.

• 8:18Jack Rhysider?

  Okay, and so you go to visit him and?

• 8:21Speaker 02

  Yeah, so my dad is very uh, I don't wanna say nonchalant, but he's like, he's chill, right? Like, he's a very chill kind of person. So for him to be excited, I was like, oh, well, what? What are you excited about? Like, you're, you're very deadpan. Like, you don't get excited.

• 8:37Jack Rhysider?

  Her dad was excited about all the channels and shows and movies that he could get on his TV now. He's like, look at this, I got hundreds of movies, full series of all the latest TV shows, thousands of channels, sports, even pay-per-view wrestling matches. You like wrestling, deadass? You would love this thing.

• 8:54Speaker 02

  And he's telling me about it, and he's like, yeah, it's just 300 bucks, it just works, it's called the SuperBox. And immediately, I'm like, okay, this already sounds weird, but keep going. So I ask like, well, how does it work? And he says, oh, it just works. That's not what I asked you, I asked you, how does it work? And so uh my younger sister was also studying cybersecurity. She comes in and she says, oh yeah, the network's been really slow at the house ever since those boxes came home. So that was kind of my final red flag to be like, I'm gonna get one just to see what it's doing.

• 9:28Jack Rhysider?

  Boxes?

• 9:28Speaker 02

  Yeah, boxes.

• 9:30Jack Rhysider?

  What?

• 9:31Speaker 02

  Multi- more than three.

• 9:32Jack Rhysider?

  What? Why does he have so many?

• 9:33Speaker 02

  Because they're convenient. That's, that's how they get you. Yeah, for each TV.

• 9:38Jack Rhysider?

  How did he get it?

• 9:39Speaker 02

  Um, somebody at his job told him he needed to get one really, really bad, so he got one.

• 9:47Jack Rhysider?

  She takes one home to look at it. She's not a researcher, so she's not sure where to start. She knows enough that she should quarantine this thing, though. So she put it in a separate network, so it doesn't learn about her home network, or try to bother any of her other devices, and she puts it behind a firewall. Then she starts Googling where to start.

• 10:04Speaker 02

  It was the weirdest question I've ever asked out loud. How do I get PCAPs at the house? Because I had to figure out how to get packet captures off the thing, and I'm like, how do you do PCAPs?

• 10:14Jack Rhysider?

  The idea was that when she turns it on, she wanted to see where it would try to talk out to. Who does this thing communicate with? How does it send those packets? And so she learned how to do packet captures in order to watch this.

• 10:26Speaker 02

  I got one of those packet scrolls from Hack 5, and I had laughed to myself because I remember when I first came into security and thought I was going to be like a badass hacker. I was like, oh, I'm going to get all this stuff off Hack 5. So I had one, and I hadn't ever opened it, and I learned how to use it. And that was my kind of inline packet captures.

• 10:45Jack Rhysider?

  So she gets it all set up, turns it on, and just lets it do its thing. And she watches what it talks to.

• 10:51Speaker 02

  The first thing it does is call out to Tencent, like just straight into it. Like in China, yeah, like qq.com.

• 10:57Jack Rhysider?

  Tencent is a massive tech company that owns QQ in China. And it's not entirely unusual for something to be talking to it.

• 11:04Speaker 02

  So at first, I was like, OK, maybe this isn't that bad. But then, when you apply the rest of it, like, oh, you're an oil and gas executive. Somebody new told you to get this. The network's running really slow, and this thing is talking out to China. Right? Like, it's all of that, right? Individually, those things don't mean anything. But when we're looking at this strategically or in a big picture, you're like, oh, I see.

• 11:31Jack Rhysider?

  But maybe she's connecting dots that aren't there. So she keeps looking for traffic logs.

• 11:36Speaker 02

  I'm kind of just watching the traffic, watching the traffic. I would like turn them on for like a day, turn them off. I'm looking at logs. I'm kind of just trying to get a feel for what they're trying to do. And then I get a hit in my vulnerability log, like in the threat log on my Palo Alto firewall. And it's for a SCADA vulnerability.

• 11:54Jack Rhysider?

  A SCADA vulnerability? This makes no sense. SCADA is the control systems used in large-scale industrial settings. Think pumps, valves, conveyor belts, compressors, elevators, railway switches. This is where SCADA systems live. Why in the world is this box that's here to deliver TV and movies attempting to trigger a SCADA exploit on Deadass's network? This is very concerning. So she continues to look at the traffic this thing is sending. And she notices it's communicating hard with all the other devices on her local network. Typically, a streaming box will not care about what else is on your local network, and only want to go out to the internet and get the content so that it can show it to you on your TV.

• 12:36Jack Rhysider?

  But this box was super busy feeling around to see what else is in her network. Specifically, it starts ARPing out to any device in the same network as it. So basically ARP is when a device is like, "Hey, are there any computers on this network that have the IP 192.168.1.10 or whatever?" And if there is a device that has that IP, it'll respond. It'll say, "Yeah, that's me. You want to chat? Here's my MAC address." And then it gives the MAC address. So this super box was ARPing out to every IP in dead-ass's network.

• 13:05Speaker 02

  I would say it was almost more of like an ARP DOS, because it was ARPing at things so hard that they would like freak out and like lose their IP address reservation. Yeah.

• 13:15Jack Rhysider?

  Really?

• 13:15Speaker 02

  Yeah, they were just so chatty. And that was also something weird to me, because normal devices, like, they're chatty, but they're not chatty like that.

• 13:25Speaker 02

  Right? So it's this noisy thing on a network. It's ARPing everything. It's sniffing around. It's just way too interested in things going on on my network.

• 13:36Jack Rhysider?

  So this thing would ask, "Who has this IP?" And when the device with that IP would respond, then it would just continually ask again and again, thousands of times, flooding it with ARP requests, until that device would get overwhelmed and go offline, which would then allow this super box to pose as that device. It would change its own IP and MAC address to match that thing it just took down, which is such a wild attack. To knock out other things and then pose as them to see if they are communicating with anything more juicy? Holy cow, this thing is scary. So she keeps Googling this thing to try to learn more.

• 14:12Speaker 02

  And it looks like it's all been SEO poisoned because it's only places to buy the SuperBox. There's no negative, like you can't even find Reddit posts even questioning anything about the SuperBox. The entire first page is where to buy and everything that's great about it.

• 14:26Jack Rhysider?

  Now she's getting curious. Who makes this thing? What brand is it? Where does it come from?

• 14:31Speaker 02

  One of the more common things a lot of us have probably done were like, what's this device? What's its MAC address? Who makes it? I look into who makes it. It's some weird looking like website templated, just strange looking company called like GBS Labs or something like that. And it, it's basically a shell, like there's stock photos on the site and just all kinds of like the telltale signs of like, we stood this up to look just legit enough, not actually be legit. So I look into them as a manufacturer. I'm finding like fake LinkedIn's and all kinds of stuff like that. So I'm like, okay, this obviously isn't real. So I keep digging.

• 15:12Speaker 02

  I get worried because as I continue to kind of acquire boxes, I got like a couple off Amazon. I got one from Best Buy, one from Walmart.

• 15:20Jack Rhysider?

  Whoa, whoa, whoa. These things are available at Amazon and Best Buy and Walmart?

• 15:23Speaker 02

  Yes, they are.

• 15:25Jack Rhysider?

  You could buy a SuperBox right on these sites?

• 15:27Speaker 02

  Yeah.

• 15:28Jack Rhysider?

  Hold on a second. A bunch of pirated movies and TV shows sold in a box that you just plug into your TV and now you don't have to pay for cable or any movies. That's, that sounds illegal.

• 15:43Speaker 02

  Yeah. I mean, it is, but they, even on the box itself, when you turn it on, it pops up a little disclaimer.

• 15:49Jack Rhysider?

  Here, I actually want to read to you the notice that pops up when you just plug this thing in for the first time. It says, "Thank you for choosing SuperBox. SuperBox is an empty and open entertainment device. Due to the nature of this item, we are not in any way responsible for the content streamed or viewed by any user. It is the user's responsibility to satisfy themselves that the site's accessed for streaming the content, to have correct copyright agreements in place and are entitled to the content. The burden of determining this falls completely on you, the user. SuperBox in no way takes any responsibility for how you use this device." Unbelievable. Does that even work? Like, can you sell a box? That markets itself for having thousands of pirated shows on it and movies? But then put a disclaimer up that says, "We're, we're not liable for anything that you do on it."

• 16:35Jack Rhysider?

  I mean, they're doing exactly that. So in theory, no, it shouldn't work. But in reality, yeah, it's working. Since this is for sale on Amazon, Walmart and Best Buy's websites. And I should mention that Amazon, Walmart and Best Buy aren't listing this themselves. These are third-party marketplace areas of the site where anyone can go and set up a shop on those sites and start selling whatever they want. And while these listings would get removed every now and then, they would just come right back up, listed by a totally different seller. Of course, eBay has them for sale, too.

• 17:06Speaker 02

  So as I start kind of looking around, I, you know, I go into YouTube and I'm like, okay, super box. And so I see, you know, a bunch of different influencers. They're not like Linus Tech Tips or, you know, some of these other bigger folks that have a huge following on YouTube. These are folks with like, sometimes like 800 followers, sometimes 50, sometimes, you know, 50K. One guy had like pictures of like motorcycles and like his wife and like pictures of food. And then just a hard right turn and he's now talking about super boxes. I saw one kid who was like talking about like speakers and then suddenly the super box.

• 17:42Jack Rhysider?

  Yeah.

• 17:42Speaker 02

  So I'm like, that's really weird. So obviously they had to be paying them. And it took me a while to figure this out, but I went way back to like a seven-year-old like super box video. And this one influencer was like, yeah, they contacted me and they're offering me 50% of the proceeds of every device that I sell if I talk about this.

• 18:01Jack Rhysider?

  Whoa, so there's super box influencers out there? People paid to spread this thing? Gosh, this makes it a lot harder to control and stop this. If they're being sold by random people just trying to make a few extra bucks, it's almost like they have an army of marketers and salespeople.

• 18:16Speaker 02

  They start appearing in weird places. I start seeing it on TikTok. They're on Facebook Marketplace. Like, so I start getting suspicious, even more suspicious because I'm like, this has to be a whisper campaign. Because I'm not seeing it like I'm not watching cable television and there's like an ad for the super box. And if that ever happens, like I'm gonna just move out of the country at that point. But I haven't seen that yet. But what I have been seeing is, oh, check out the super box. Here's YouTube shorts about the super box. Check out my TikTok. Get it off my store. So it's spreading. And then I find out later that because of how they're using the reseller market, they're like basically penetrating like the suburbs everywhere to get these sold and get these out to people and and

• 18:59Speaker 02

  get that kind of like foothold across the United States.

• 19:03Jack Rhysider?

  Holy cow. These things aren't just spreading. They're spreading in specific places. Suburban families are getting them. And why there? Okay, let's think about it. By targeting suburban families, it's almost like a bottom up approach to intelligence gathering. Don't attack companies or even the government at the front door where there's their strongest firewall and security controls set up. Don't even come in through the back door. Instead, focus on the workers at their homes. Because a lot of people bring their work home. And if they can jump off this thing onto a work laptop, or find a VPN into the office from

• 19:42Jack Rhysider?

  home, then bingo, they just gained access to the corporate network. Or even worse, it might hitch a ride in someone's backpack or pocket and get plugged in at work. So if this is a malicious device disguised to be a TV streaming box, then yeah, targeting suburban family homes in the US makes a lot of sense if your goal is to try to set up a large scale attack against major US companies. Geez, that just gave me the chills. At that point, did you have any guesses as to who might be behind all this?

• 20:17Speaker 02

  Um, so that's been kind of the weird part. I mean, obviously, if it's talking to China, I just assumed China, but it does look like there's a few layers to this. Still trying to crack the code, but. You know, a lot of folks here in the cybersecurity industry in the United States, of course, we're very concerned about this because you can't really detect them on a network unless you know what you're looking at or know exactly, you know, where your net, things in your network live and, and what the baselines are and what looks normal. So if you're not using it and it's sitting there, it, your traffic's gonna look normal. And we all stream and everything, but what a lot of folks don't know is that with traditional streaming

• 20:58Speaker 02

  services like a Netflix, a Hulu, whatever, um, when they ask you, are you still there? That's the bandwidth control. So it's not just sucking up and, and chewing up the pipe. These don't have anything like that. They'll just keep going. And then when you factor in the residential proxy stuff, that's a lot of bandwidth.

• 21:15Jack Rhysider?

  Oh, I see. If thousands of these are in homes across America and those homes all have high-speed internet, that means these boxes have quite a lot of bandwidth at their fingertips. When you have control of that much bandwidth, then there's a lot of damage you could do with just that. So at this point, it's 2023. Deadass has really started to get deep into researching this thing. She learned that the operating system on this thing is just Android and not Android TV, just Android.

• 21:42Speaker 02

  I looked at the Android information and it was a patch from 2021.

• 21:46Jack Rhysider?

  Okay. So three-year-old operating system.

• 21:47Speaker 02

  At that point, yeah. And, and, and it's on purpose. Cause this was one of the ones that had a lot of holes in it. Um, we think about like, you know, not great Android patches that came out. 2021 was kind of a strange year for that. And so I'm looking at that and I'm like, okay, that's super, super weird. I keep digging in. I'm looking at the box. I'm like, let's look through the apps. Like there's TeamViewer on it. Right. Like why does that?

• 22:12Jack Rhysider?

  TeamViewer. Okay. So TeamViewer is a way to remotely manage a computer. Like it allows you to connect to that thing and control it as if you're sitting right in front of it. So with TeamViewer installed on it, that means that whoever is behind this has a dashboard at their fingertips of all the super boxes out there with TeamViewer running. And with one click, they could just jump right into any of them. That's horrible. Holy cow. The idea that someone is inside your home, looking around at your network and you have no idea? No, no, no, no, no. I do not want this. Burn it with fire.

• 22:46Speaker 02

  Watching Reddit and stuff like that, and people are like, is this thing too good to be true? And so there was an account on Reddit that was created about, at that time, about four years ago, which lines up with like, kind of the initial timeline of, of everything we were seeing with this, starting about 2019, 2020. And that account did not post a single thing for four years. And then it pops up just to say, I've had the super box for forever. I get NFL, MLB, you know, Sunday ticket, like, this is the best thing ever. Like, everyone should get one. And then it never posted again. So they're, of course, nudging it and trying to like, you know, prop it up in places. I'm like, so this is, again, it's spreading. People are talking about it, but like,

• 23:31Speaker 02

  I still have not heard a thing about it in the security community. Um, so I decided to do a talk on it initially. And that was my first ever, like, technical talk at a hacker con. I was scared to even get up there.

• 23:44Jack Rhysider?

  So she gave the talk at a B-sides event and the crowd was stunned with her findings. Her talk was so scary. I think everyone after the talk called home to see if their parents had bought one of these or installed anything like that. Which reminds me, I need to call my dad to see if he has one. Let me take a quick ad break real quick, but stay with us because everything got way more serious after she gave that talk.

• 24:09Jack Rhysider?

  This episode is sponsored by Vanta. As AI adoption grows, so do your company's security risks and requirements. New frameworks, audits and vendors keep piling on, but your team isn't getting any bigger. Most compliance tools promise automation, but you're really stuck doing all the work by hand, chasing screenshots, validating controls and playing catch up when audit season is coming around the corner again. Vanta works differently. Their agentic trust platform is built to scale with you, not slow you down. With over 1,400 automated tests across 400-plus integrations, Vanta collects evidence and monitors your controls year round, cutting your audit prep by 82%.

• 24:50Jack Rhysider?

  Plus, you can access the Vanta agent everywhere you work. Whether your team is in Vanta every day or living in tools like Claude or Cursor. Want proof? Over 16,000 fast-growing companies like Ramp, Writer, and Harvey save time and resources while scaling fast with Vanta. Learn more at vanta.com/darknet. That's spelled V-A-N-T-A. Vanta.com/darknet.

• 25:17Jack Rhysider?

  Okay. My dad says he does not have one, but he says the guy at the gym has one and he keeps inviting him over to come watch shows.

• 25:24Jack Rhysider?

  Okay, so after that talk, what happened next?

• 25:28Speaker 02

  Um, how can I put this without sounding crazy?

• 25:35Speaker 02

  Our, uh, our government was very, very interested in knowing more. I can put it to you that way.

• 25:43Jack Rhysider?

  Yeah, word got out and an investigation was opened up and they brought her in to learn more. If this is another nation trying to plant boxes in family homes across America with malicious intent, then the Department of Defense was interested in knowing more. But the thing was, because this was now an active investigation, it meant dead ass had to be quiet about this. So she wasn't allowed to talk publicly about it. But it didn't stop her from researching it further and talking privately about it. So for years, she continued to research it and gave talks. But every one of those talks had to be no cameras, no recording, no photos in order to keep this hush-hush. And it's been driving me crazy since I've been attending her talks for years.

• 26:25Jack Rhysider?

  And I think it's such a good story to get out to you, but she's never been allowed to be interviewed for it. And that's why I'm so happy to finally, finally, finally get this interview to tell you her story. But as it turns out, this wasn't the first time we've seen bad boxes.

• 26:38Speaker 02

  Human Security and Google and all those guys had kind of done the stuff on like, you know, the first bad box and so, um, and they were sourced for a lot of the stuff on the second bad box, but we basically discovered that this thing was part of what's now referred to as the Bad Box Botnet.

• 26:55Jack Rhysider?

  Bad Box Button. So we've been referring to it as SuperBox this whole time.

• 26:58Speaker 02

  Yeah.

• 26:59Jack Rhysider?

  Where's Bad Box come from?

• 27:00Speaker 02

  Bad Box comes from the fact that there are just other Android like streaming devices and they're they're actually a lot cheaper. And this was actually an anomaly that I noticed when I was looking at the SuperBox. They're like anywhere from like thirty bucks to maybe like a hundred at most. And so again, cheap devices, they're kind of everywhere. They can get them out there pretty quickly. And so a lot of those made sense already infected. You know, the behavior looked the same. Once I started kind of like providing information and stuff. And so we all came to the determination that it should just be, it's still Bad Box, but it's Bad Box 2.0, even though we'd shut down the first Bad Box. And so, yeah, it's for any Android, basically, device that's like got malware

• 27:43Speaker 02

  or is beaconing out to interesting places, etc. But the SuperBox, like my focus on it is because it's $300 and the rest of them are like 30. So why is this one $300?

• 27:55Jack Rhysider?

  So she gave the authorities all the information that she discovered about this.

• 27:59Speaker 02

  I provided, you know, network traffic, some logs, just things so that they could get an idea of what they were looking at. And I just kind of took it from there. So.

• 28:06Jack Rhysider?

  Okay. And then, and then for your own, you didn't stop with your own research.

• 28:12Speaker 02

  Oh, no. I was like, we're not even, we haven't even scratched the surface. Like I'm, you know, we're still like, at that point, I was just like, there's still more. Like, I know there's still more because there were still so many unanswered questions. Like, okay, I get why it's beaconing. I get that it's talking to this IP. But like, again, why? Why? So I keep digging. I just, I just keep digging and I continue to dig and I continue to dig.

• 28:38Jack Rhysider?

  She got obsessed with this box and she knew she needed to skill up in order to research it better. So she took some SANS courses, got her GCIA certification, upgraded her tools, and once again, looked at the traffic this thing was sending. She saw that it was talking to a lot of domains ending in .top. Like most websites end in .com, but not this box. It likes speaking to things in the .top domain.

• 29:01Speaker 02

  Which like, we all know there's nothing good for anybody at a .top domain. Like, that's not for us.

• 29:08Jack Rhysider?

  Of course, it talked a lot to the .cn domains too, which is clearly China. She studied protocols deeper, domains, IP addresses, analyzed the hardware and the company that makes it all. And she saw that this thing was just automatically downloading different apps and stuff for Android and was able to capture those and analyze those.

• 29:27Speaker 02

  So that was new for me, too. Like I said, I worked in the SOC, like I did my little alerts and like, okay, escalate. Like, that's all I used to do. So to figure out how to like decompile APKs was like insane. But like, I figured it out and I kind of started like looking inside of them. And I'm like, oh, that doesn't seem right. Like, you shouldn't be sending that in clear text or, you know, stuff like that. So, I mean, there was just so much smoke, right? Like, I knew there was gonna be fire.

• 29:52Jack Rhysider?

  Because this thing is running the Android operating system. It has the Google Play Store. But of course, that's not where you'll find the thousands of channels that it says it has. Instead, you need to basically rip out the Google Play Store and instead install something called the SuperBox App Store.

• 30:07Speaker 02

  What got me is when I tried to download the App Store and my firewall basically showed me that it was like a multi-layer encoded file. So it was zipped up like six, seven times. So that was weird because that's still not normal for an App Store. Like, and I mean, if anything, like you should just be using the Google Play Store. It's an Android device, but they have their own App Store that you had to download and install to get access to their piracy apps.

• 30:34Jack Rhysider?

  And their App Store looked nice and polished?

• 30:37Speaker 02

  Oh, my God. It was, it's pretty brutal. It, it's weird because you, you click on it, it installs, it turns blue, which I thought was just kind of funny. I'm like, it's, why is it blue? You click on it and it just has the three apps in there. Like, there's nothing else in it. So it's only so you can, again, get access to their stuff. And they want it to look as legitimate as possible so people will use it. You'll appreciate this. So they're all running Android debug bridge, which makes sense if they're, you know, pretending to be an Android device. Because it's not an Android TV device. It's just straight up Android, which is already weird for the other types of devices.

• 31:19Speaker 02

  This, this was super strange to me because there's no, there's no authentication on it. Like, I was able to connect just straight across the Android debug bridge. And then I just typed in, you know, SU for switch user and it gave me a root shell.

• 31:35Jack Rhysider?

  So you have root access to the super box?

• 31:37Speaker 02

  I have root access to like the six that I have in my house. Yeah.

• 31:39Jack Rhysider?

  Oh my gosh.

• 31:40Speaker 02

  And then I did finally dump the firmware and there's entire sectors missing off of the device. Like if you're looking at say like the, the structure, like the boot structure, there's 27 partitions, but you can only see 15.

• 31:56Jack Rhysider?

  What?

• 31:56Speaker 02

  Right. That doesn't make any sense. It's not normal.

• 31:59Jack Rhysider?

  That is strange.

• 32:00Speaker 02

  Yeah.

• 32:02Jack Rhysider?

  I just assumed that if there are partitions on it, but you can't see them, then that means it has some sort of software deep inside it. And who knows what's going on in there? What's in those partitions? And how scary is it? Nobody knows.

• 32:16Speaker 02

  I'm also at the same time, still digging into the shell company. They have these weird, like fake certificates of award to like look legitimate. And I'm like, what even is, is that supposed to be like a certificate of like authenticity? That's basically what they're putting out for the super boxes to make them look legit.

• 32:31Jack Rhysider?

  Yeah. So the, the packaging of this thing, uh, you got a few, right? And so what is it? What is, does it just look like a regular device? Or is there anything silly about it?

• 32:40Speaker 02

  I mean, I look at it and I'm like, why does it look evil? Like it feel, it feels evil to me. Like, have you ever like seen something? You're like, I don't like that. It, it kind of gives me those vibes, but like it says 6K on the box.

• 32:52Jack Rhysider?

  6K.

• 32:53Speaker 02

  Sick. Right. Like what is, what is 6K? I must've missed, I must've missed that memo between four and 8K. But yeah, it has 6K on the box. And there's even like regulatory information like printed on the box, but then like, we can't find like FCC information on it.

• 33:07Jack Rhysider?

  Okay. So, so the regulatory stuff looks like it's just made up.

• 33:11Speaker 02

  Yeah.

• 33:12Jack Rhysider?

  Yeah. And like, oh, we're, we're certified and all these things, but not really.

• 33:16Speaker 02

  Right. And

• 33:16Jack Rhysider?

  Wow. That's crazy. Like that's illegal.

• 33:18Speaker 02

  Well, and so the average everyday person, it looks like anything else they might buy. It's got the regulatory information. It tells me what the product is. It says who makes it.

• 33:28Jack Rhysider?

  That seems highly illegal. The government's not going to want you to put regulated or, you know, certifications on there that aren't, especially for like some of the safe electronics out there.

• 33:37Speaker 02

  Exactly.

• 33:38Jack Rhysider?

  And make it safe for consumers.

• 33:40Speaker 02

  Mm hmm.

• 33:40Jack Rhysider?

  They're just putting it on there and not.

• 33:42Speaker 02

  It's not actually vetted. They're just like, here you go. This is safe for consumers.

• 33:47Jack Rhysider?

  So, okay.

• 33:48Speaker 02

  It's ridiculous. It just, and it just stays ridiculous. So like, you know, just buckle up.

• 33:56Speaker 02

  There's just so many glaring like red flag. I would call them more like neon red flags, if that's even like a thing. I'm just, again, at this point, this is like the end of 2024 at this point. And I'm just like, does no one else see this? Like, are no one else sees this, really? And, and so I get into 2025 and, and that's where it kind of like really started to take off. So the bad box PSA comes out in June. That was a huge deal.

• 34:25Jack Rhysider?

  Oh, yeah, I saw that announcement. Let me pull it up for you. It's titled, "Home Internet Connected Devices Facilitate Criminal Activity." Here's what the FBI warning says. "The FBI is issuing a public service announcement to warn the public about cyber criminals exploiting IoT devices. Cyber criminals gain unauthorized access to home networks through compromised IoT devices, such as TV streaming devices, digital projectors, aftermarket vehicle infotainment systems, digital picture frames and other products. Most of the infected devices were manufactured in China. Cyber criminals gain unauthorized access to home networks by either configuring the product with malicious software prior to users purchasing or infecting the device with backdoors, usually during the setup process." Gosh, wow.

• 35:08Jack Rhysider?

  So the FBI put this warning out, but that wasn't enough for them to get banned off of Amazon, Best Buy, Walmart marketplaces. And even with this FBI warning, it wasn't enough for dead ass to convince her father to get rid of it either.

• 35:22Speaker 02

  He did at least unplug it.

• 35:25Jack Rhysider?

  Only when you're home.

• 35:26Speaker 02

  Only when I'm home.

• 35:27Jack Rhysider?

  It's probably plugs it back in when you leave.

• 35:29Speaker 02

  It's, it's just so frustrating.

• 35:30Jack Rhysider?

  So how do you convince, imagine it's my dad here or your dad here. How, what do you say to them to say, "Don't not do this"? Because what, what matters to them, right?

• 35:40Speaker 02

  Yeah.

• 35:41Jack Rhysider?

  So you have to bring it to their level.

• 35:42Speaker 02

  Well, so what was interesting, I think what got through to my dad was when I said, hey, like, if something goes wrong with this and, you know, you're in a pretty high position at your company, like, I mean, they, people are reporting their bank accounts getting hacked. Like, do you care about your money? Do you care about your retirement? Like, there, again, they're looking at your credentials. They're monitoring the network. They're gonna see when you're logging into your bank. And they're gonna see when you're doing things that we might all consider sensitive. And if you don't want that to now become a negative or get exploited or become a problem, like, you have to think about what you're bringing home on the network.

• 36:22Jack Rhysider?

  Okay, you said someone's bank account got wiped out?

• 36:24Speaker 02

  Yeah, somebody, yeah, somebody reported on Reddit, like, oh, they tried to hack our bank account, so put it on a guest network. Not stop using it, just put it on a separate network.

• 36:34Jack Rhysider?

  Gosh, what are we even doing? Imagine you had some roommate that tried to steal money from your bank account every time you turned your back and was constantly spying on you. You wouldn't just move them to the guest bedroom, you'd throw them out of the house. How is it that this thing can clearly be so dangerous, yet people still don't throw it in the trash? It's because it's still proving value to them, even after it's an apparently dangerous and harmful device to have in your home. And this puts me in deep thought, actually, on how to fix this. This isn't a one-off, it's an industry trend. And it's, it's not even just an industry trend in cybersecurity, it's a bug in human beings. We often ignore good advice. Like, we all know you should take your health seriously, eat healthy, work out five times a week, and get plenty of sleep.

• 37:19Jack Rhysider?

  Yet, most of us don't do it. It's not because we don't know better, we all know better. And there's nothing you should value more in your life than your own life. So it's not like there's something more important to focus on, yet we still don't take care of ourselves properly. And this is what I think is a bug in human beings. We know what the right thing to do is, yet we still don't do it. And here's an example of this bug being exploited so perfectly, even when the superbox rears its ugly head and shows us how dangerous and harmful it is. People still use it because they like getting their TV shows.

• 37:57Jack Rhysider?

  To be clear, how do you feel about piracy?

• 38:00Speaker 02

  I mean, I personally do not care. That's you and your business of between you and your ISP. That has nothing to do with me.

• 38:06Jack Rhysider?

  Yeah, that's not what you're out here saying is bad.

• 38:09Speaker 02

  Yeah, it's it's the fact that like to make it easier to have access to these things because a lot of people do not have the technical know how to potentially participate in sailing the internet high seas safely. This is a one stop, easy pre box shop.

• 38:26Jack Rhysider?

  Can we talk more about who you were seeing getting these things?

• 38:30Speaker 02

  Yeah, so you know, I I had folks reporting to me that they were getting the mail to them like at their house. I'm like, what? And they work in oil and gas. And they're like, I didn't order this. So I'm like, yeah, definitely don't plug it in. And so one of those got sent to me.

• 38:48Jack Rhysider?

  Wow, how scary is that to have one mysteriously show up at your doorstep? And you work in oil and gas? Man, this is a very serious and dangerous campaign. I already said this thing should be burned with fire, but now I think you need to take a sledgehammer to it first and then burn it.

• 39:06Speaker 02

  Of course, I'm seeing stuff on like social media, kind of all the different platforms. Like, oh, my parents got gifted one. My uncle was telling us about it. Like all the again, it was it was lots of stuff like that. Um, I had a friend in Sacramento tell me that he saw like one of the single moms that like is known in the neighborhood, like she had them. And I'm like, that's so weird. Like,

• 39:31Speaker 02

  again, if it's if it's the gray money, I guess, and you, you know, you want to make some extra cash on the side, like it's a great business. I mean, that's.

• 39:38Jack Rhysider?

  If we if we look back at, I think it was the late 90s, early 2000s, we had a similar thing where you could buy the the some sort of a streaming box. It was it was it was a cable box, but it was like a.

• 39:53Speaker 02

  Like a black box or whatever.

• 39:54Jack Rhysider?

  Yeah, it was the, you know, jailbroken. And so you would get free cable. And so this was this wasn't sold by the moms in the neighborhood. This wasn't sold by your uncle, maybe your uncle.

• 40:04Speaker 02

  But it was some guy.

• 40:05Jack Rhysider?

  Sold in the seedy parts of town.

• 40:06Speaker 02

  Exactly.

• 40:07Jack Rhysider?

  Where you had to know someone who knew someone who knew someone and then make a deal with them to get your. You're a pirated, you know, your jailbroken cable box.

• 40:16Speaker 02

  Yeah.

• 40:17Jack Rhysider?

  And that's what, that's what this, this doesn't smell the same. This has a different scent to it because it's people who are, the people who are selling it are almost like hustlers in some way.

• 40:28Speaker 02

  Yeah, exactly.

• 40:29Jack Rhysider?

  Where they're, where they're got like six side businesses.

• 40:31Speaker 02

  Exactly.

• 40:32Jack Rhysider?

  And they've got a lot of free time.

• 40:34Speaker 02

  It's like a weird, there's a weird profile overlap that I was noticing because at first it was like real estate agents. I'm like, okay, I could kind of see that. Then I'm seeing reports online where someone's like, oh, my cable guy tried to sell me one. I'm like, your cable guy, like, who just installed your internet is trying to sell you one of these boxes? Like, what? Um, and then of course, there's the whole issue with just as you're, you know, a, as, as we start looking at kind of like the whole thing. I'm like, okay, well now I'm starting to see like people, like you said, like five, six businesses and they're not tech savvy people. They're just like, oh yeah, it just works. I've been using mine for two years. I don't have any problems. You know, and they're usually the ones that will go into a lot of these social media posts and they say anyone trying to say anything negative about it.

• 41:17Speaker 02

  Like they're ready to squash any negativity as soon as you try to post about it.

• 41:21Jack Rhysider?

  The marketing images of this thing is ridiculous. There's one with a family sitting on a couch, which looks like a stock photo and the super box is like oddly placed on the TV in front of them. And the mother is smiling all happy with this thing, holding her daughter. And again, to me, this thing looks like it's targeting suburban families.

• 41:38Speaker 02

  There's a piece here that I don't think we talk about enough in cyber, cybersecurity. And it's really truly like the cyber psychology of us as consumers, as of us as practitioners, of, of everyone, really. And so we don't have a culture of understanding, again, like scams and stuff. Like we, we lose billions of dollars every year to pig butchering, phishing, all kinds of get rich quick schemes. Like everybody wants to make a buck or everybody thinks that, you know, oh, I'm gonna, I'm no longer going to be a temporarily embarrassed millionaire. Like I'm going to be a millionaire now. Or I get to watch TV and I don't see what the problem is.

• 42:16Jack Rhysider?

  Yeah, I wanna, I was, at first I was gonna push back and say, well, you know, we, we, we assume that the stuff we buy has already been vetted and secure and all that stuff. Or else it wouldn't be in the store because the store should have some sort of a, you know, responsibility.

• 42:32Speaker 02

  There's implied trust when you go to like Best Buy, right? Like, there's a reason I'm not gonna go like, stand out here on the corner and say like, hey, does anyone have like an iPhone 17? I can just buy real quick. Like, I'm gonna go to Apple, I'm gonna go directly to Best Buy. And so again, as consumers, especially in the United States, like you said, we go to Best Buy, we assume that what we're getting is okay.

• 42:52Jack Rhysider?

  Okay, well, let me ask you this, once the FBI warning came out, did all of the stuff evaporate off Best Buy and Walmart?

• 42:58Speaker 02

  Nope, it's still there and part of the problem is because they have very unmonitored third-party marketplaces. However, I did receive reports from other contacts that they had a parent that was able to get one off the shelf at Best Buy.

• 43:12Jack Rhysider?

  What?

• 43:13Speaker 02

  Which I was like, how did that even happen? Because it's very hard to get things on the shelf at Best Buy. But if there's this other kind of influence of like, hey, let me slide you some cash like in this envelope, like, secondarily, like, put this on the shelf at Best Buy, like, I, I could absolutely see that happening. If we just think about like, you know, humanity.

• 43:32Jack Rhysider?

  So, I mean, I'm, I wanna assume that it did get wiped off of all these online marketplaces, but then it's a cat and mouse game, and so it just comes right back. And there is a different seller selling it, and there's another person, and maybe there's tens or dozens or hundreds of people trying to get it back on to Amazon. And since Amazon has this sort of, anybody can come on and sell something, then it becomes very hard for Amazon to pop every mole in the head.

• 43:56Speaker 02

  Yeah.

• 43:57Jack Rhysider?

  Okay, so, you, you feel like that's what, that's what happened?

• 44:01Speaker 02

  I think that's probably got a lot to do with it. I mean, the third-party marketplace thing, you know, I, I still have questions about how, how Timu came out of nowhere and got two Super Bowl commercials the first year of its existence. But, yeah, like, looking at Amazon, like, I did look recently, and it's actually harder to find them. So I think Amazon did make some changes. But like Walmart is still just like pages and pages and pages. And again, I mean, they get a lot of money out of having all these sellers on their marketplaces, but they're selling something that's, that's kinda dangerous.

• 44:34Jack Rhysider?

  Gosh, this device is so insidious and the way it's wriggling into our homes across the nation. We humans are vulnerable to scams and manipulation, and this seems to be the perfect thing to exploit that.

• 44:46Jack Rhysider?

  Americans are sick of paying for 20 different streaming services. Like, if you pay for Netflix, Disney+, Amazon Prime, and HBO Max, you still don't get any news channels. It's so fractured and crazy. I just remember this YouTube video by Video Game Donkey, who has a guide on how to watch all the seasons of Pokemon. Here, take a listen.

• 45:06Speaker 03

  For Pokemon, there is a website that tells you how to watch this. You start off on Netflix, then swap over to the Pokemon streaming service, which is the only place that has season 2. Then, swap over to Prime Video for seasons 3 through 5. Swap to Freevee, then Hoopla. Season 13 is only on Amazon, though. Then swap to Tubi, then Hulu, then Roku Channel. And then finally, back to the Pokemon streaming and then Netflix. Easy.

• 45:31Jack Rhysider?

  What are these streaming services doing? It's like, the more they battle, the more we lose. Like, Disney bought Marvel in 2009 for $4 billion, but even Disney Plus doesn't have the rights to play all the Spider-Man movies? What's happening? So, this super box hit us right where our pain point is when it comes to watching TV and movies. It solves so many problems. People don't want to pirate. But when it's so painful and so complicated to find the shows you want to watch, then they just migrate to a simpler way to watch the shows. It's not even less expensive, since they're paying $300 or $400 for one of these boxes, which just has all the shows they want to watch. I'm sure they'd be happy paying a monthly fee if it was for a streaming service which gave them what they wanted.

• 46:16Jack Rhysider?

  But piracy is on the rise because of how complicated and frustrating streaming services are today. And when it's 1,000 times easier to pirate a movie than it is to research where things are streamed, only to create an account there, only to find that they're no longer streaming it there, then people are going to give up and just pirate. Honestly, I blame the streaming services for this explosion of piracy that we're currently seeing. They need to start treating their users with more respect, and we'd all be much happier for it.

• 46:44Speaker 02

  Like, I had been hyper-focused on the super box, but then I saw some of the same characteristics of a bunch of sellers and folks on social media talking about the VC box. So again, another one that's like, still something-something box, but a lot of the same stuff. "Oh, we've got this playback feature." Like, "You get all the channels." I'm like, "This sounds familiar." And so I start digging into the VC box, and so I buy one of these.

• 47:12Jack Rhysider?

  And this thing looks equally as strange.

• 47:14Speaker 02

  It was another weird Reddit post too. Reddit was like weird and like got me all these breadcrumbs, by the way, because people just tell on themselves in like Reddit piracy, by the way. Um, but this, this particular post stuck out to me because they're like, oh yeah, there's no Chinese here. I got this new box and it still gives you all the channels and it's better than the super box.

• 47:34Jack Rhysider?

  Does it say no Chinese here?

• 47:36Speaker 02

  It literally says, that's the first, first thing it says. Like they started the post like that. I'm like, what? Like, why, who, no, and in the thread, no one said anything about China. Like, that's the thing that was weird. I was like, why are you telling on yourself? And so I read this post, uh, there, this person in particular was like, no, everything was great. My seller was awesome. Everything's responsive. It's the best ever. You should get the VC box now. And I'm like, why is there another one? And so they look like, like almost competing companies. So I buy one and it's also beginning straight to like China via Tencent and infrastructure. I'm like, I'm not crazy, right? So I put them all in the same network together and they all start talking to each other.

• 48:18Jack Rhysider?

  Really?

• 48:19Speaker 02

  Yeah. I was like, oh no. Are you guys sentient? I'm scared. So again, I continue to dig. I continue to dig. I'm looking again, actually getting access to, I was using Census at this point because I started Census in the beginning of 2025.

• 48:34Jack Rhysider?

  What is their tool?

• 48:35Speaker 02

  Um, their internet intelligence, internet scanning, like showdown for grownups.

• 48:44Speaker 02

  Gotta do the job. Um, so as I, again, it just continues kind of to get weird. I'm, I'm now tracking the different marketing campaigns. I'm tracking, you know, when new models come out. And so when I started, the, the, the super box S5 was the model that was available and now they're up to the seven. So they're still just releasing.

• 49:05Jack Rhysider?

  They come out with new versions.

• 49:06Speaker 02

  With new versions.

• 49:07Jack Rhysider?

  Wow.

• 49:08Speaker 02

  I'm like, wow, this one has USB C on it. Look at them go.

• 49:14Speaker 02

  So yeah, so again, it's just kind of continued. I got to the kind of towards the end of 2025. And I start seeing more posts about like suspicious activity blocked from users on Reddit. Getting, you know, messages about, oh, my ISP says that I'm visiting malicious IPs and things like that. So I'm like, okay, so maybe like there's some traction picking up here because now there's starting to be signals that folks are starting to pick up on this, folks are starting to notice this and make those changes with regard to like our own infrastructure. So I'm still looking. And in the beginning, I, in the beginning of last year, I found a third box called the MAGA box.

• 49:56Jack Rhysider?

  Manga.

• 49:57Speaker 02

  MAGA.

• 49:58Jack Rhysider?

  Oh, MAGA box.

• 49:58Speaker 02

  Like M A G A.

• 50:00Jack Rhysider?

  Oh, my gosh.

• 50:01Speaker 02

  And that, that actually finally I got the, the answer I was looking for just this week from an interesting Verge article I'll talk about here in a second. But that one, of course, stuck out to me because I'm like, well, who could they possibly be trying to advertise to?

• 50:18Speaker 02

  And I was just like, wow, like in there, it was so blatant and it looked just like the super box. That's what got me. I'm like, why does it look like the super box? Like, I don't understand. So again, there's so many weird things. I'm like, I, why is this still happening? Like just a lot of like, why, why this?

• 50:38Jack Rhysider?

  And did you get one of the MAGA boxes?

• 50:40Speaker 02

  I did. I think it like, I don't know if they killed it or what, because I hooked it back up recently to kind of put back into my little baby botnet that I'm running at the house and it wasn't getting updates or anything. So something else may be going wrong with that, or they've just kind of shifted focus back to the other ones. But yeah, I ran it for a little bit, kind of the same thing, had a weird little, you know, video, you know, get the little app store, get the little video app, watch your TV shows, here's your local listings of channels. They have like, you know, all the different like, you know, fandoms and things that you can get access to, but it worked like the other two.

• 51:13Jack Rhysider?

  Things come with remotes?

• 51:14Speaker 02

  They come with remotes.

• 51:15Jack Rhysider?

  And anything interesting in the remote?

• 51:17Speaker 02

  Um, they have self-signed certificates for some reason. They of course have microphones, but like, again, they have open ports on them as remotes. So I can, if I'm looking for super boxes on the internet, I can actually see the ports, but it's the remote. So I still have some some mysteries I'm trying to solve there, but I did see it had a long antenna and I'm like, why is that antenna so long if it's just like an infrared remote?

• 51:46Jack Rhysider?

  Yeah, if, okay, so infrared wouldn't even need an antenna.

• 51:49Speaker 02

  Exactly.

• 51:50Jack Rhysider?

  Um, so did you find any, like, do you know what protocols it can handle?

• 51:55Speaker 02

  I mean, I know it's Bluetooth. Um, my tinfoil hat moment is cellular, but I haven't confirmed that yet. I'm talking to some cellular nerds to see if we can have a way to figure that out. But again, it's very strange because with most of the Android boxes I found, I bought like some cheap ones and they just had like a generic like Android TV remote.

• 52:14Jack Rhysider?

  Okay.

• 52:15Speaker 02

  The remotes are specific to the SuperBox that it comes with, or the VC box that it comes with. Like, you have to use the remote they give you. And even if you go on, say, like, Amazon Best Buy and you look for, say, like, SuperBox Remote, it'll, it's a specific remote that you can only use with those boxes. It doesn't work with other Android boxes, which is also weird.

• 52:39Jack Rhysider?

  God, this thing just gets worse and worse. It's like a never ending nightmare. The remote has a microphone? At this point, I'm certain that that thing must always be on and is listening, and maybe even using AI to parse out what's being said in the privacy of our living rooms and bedrooms, and sending those conversations to who knows where, which the living room is probably the place where you make private phone calls and stuff. Holy cow. And it interacts with the SuperBox using infrared. So why in the world is there even a Bluetooth antenna on it at all? Look, let me tell you, a lot of us are walking Bluetooth signals. The Bluetooth that's on our phone is always looking to see what it can connect to. And you might have a Bluetooth smartwatch or earbuds. And I've seen pacemakers

• 53:22Jack Rhysider?

  and hearing aids with Bluetooth. And all this can make quite a fingerprint that's unique to you. I mean, have you ever gone to add a new Bluetooth device and you see things like Diane's earbuds or Bill's fitness tracker? I imagine that this thing is taking notes of what Bluetooth devices come near it, so it can tell who's nearby. And as a side note, to improve my home defense strategy, I recently got a Bluetooth antenna which is just scanning for what Bluetooth devices are near my home, and it records it. My theory is that if someone ever breaks into my home, I'll pull up the logs to see what Bluetooth devices were in range at that point, and try to see if they ever visited before to try to figure out who it was. There is a lot of data you can get from sniffing Bluetooth signals.

• 54:05Jack Rhysider?

  So if this remote has a Bluetooth antenna, a long one at that, and is quite the malicious little box, I can only take guesses as to what it's doing with that antenna. And keep in mind, it doesn't use Bluetooth as a feature. You can't connect to it that way, and it doesn't try to connect to Bluetooth speakers or anything. The Bluetooth antenna is covertly installed on it and is not user accessible.

• 54:31Speaker 02

  And then we get to kind of fall 2025. I see you B-Sides Portland.

• 54:37Jack Rhysider?

  I did go to B-Sides in Portland, a hacker conference, and at that point, she's given talks about this box about a half dozen times, but because there's a federal investigation going on, she has strict rules: no cameras, no mics, no recording, no pictures. It's very hush-hush kind of talk that she gives. But it was one of my favorite talks I've ever seen, and the crowd was stunned. For two hours after the talk, she had a mob of people around her just asking more questions about what she found, and they were giving her information. I even stood there, perplexed by this whole thing, listening to everyone ask her questions for hours. Everyone thought it was such a fascinating little box. And at this point, this is probably the third or fourth time I've seen her give a talk on this, and it just gets better every single time because there's just more to the story.

• 55:22Jack Rhysider?

  And every time, I would tell her, "Listen, when you're ready, let's please make an episode." But she was very hesitant, mostly because there's an active investigation, and if she exposes them in a big way, it might ruin the ability to collect more evidence. But at the same time, the story was burning in her. She wanted to get the word out as a warning to everyone and their parents: "Don't buy these things." But she felt worried about it, so she told me... No, not yet, but soon.

• 55:50Speaker 02

  And then, uh, Mr. Krebs reached out to me.

• 55:52Jack Rhysider?

  Hmm.

• 55:53Speaker 02

  Uh, not too long after that, and he was asking about the super box. And so he wrote a really good article that basically broke down kind of the interconnection between the super boxes and the residential proxy networks. And, you know, I didn't think that the super box finding was going to be anything major. I was just kind of like, hey, I wanted to share and come to find out that like all of the residential proxy stuff and the botnet stuff and all that stuff that we're seeing in the news. A lot of that were breakthroughs because of what we all discovered looking at streaming devices. Like, we hadn't considered them a true vector until recently.

• 56:27Jack Rhysider?

  So when she says Mr. Krebs, she's talking about Brian Krebs, the journalist behind Krebs on Security. Uh, how'd you feel about that article?

• 56:34Speaker 02

  Um, you know what? I thought, I mean, I didn't say anything factually incorrect in the article. So there was that. No, I think it was a good article because I think that was kind of another big push to kind of just show awareness. Um, some awesome folks also got quoted in that article. Folks from Spur and things like that, who also specialize in like proxy networks and stuff like that. That's what they hunt. And so it was really cool to kind of see this amalgamation of all the different little pieces that all of us were looking at and then kind of seeing the full picture and having it explained in an approachable way. Because when you're sitting here listening to me talking about this, you're like, oh, my God, this is so much stuff. I'm like, I know. But there's like a lot of this other stuff that kind of builds up to sort of these major events that we've had

• 57:17Speaker 02

  happen in the last 60 days, uh, just, you know, beginning of 2026 and end of 2025. So the Krebs article comes out and then I get phished, or at least someone tried to fish me. Because when Mr. Krebs published that article, another IOT researcher got a super box and started finding some cool stuff. And, um, there was a posting of the store itself, like the, the repo they were using was just kind of out there. Um, when it started to get bigger on YouTube because of Matt Brown's work, um, all of the sudden the store's not there. It's not, you can't find the repo anymore. Then I get this email saying, hey, do you have like, you know, the app store dumps?

• 57:59Speaker 02

  Do you have some TCP dump? And I'm like, first of all, it's a very personal question. Like you, you don't just, you know, start off asking for people's TCP dump logs. Like, come on. But I'm like, holy crap. And it's of course coming from a proton mail. They said they were a computer science student, but they're not emailing me from an academic email. And they emailed me at my academic email where I adjunct that I don't put out anywhere. And I was like, how the hell did you get this? Number one. Number two, wow, like that was a, that was a hard nudge trying to kind of sniff around and see what was going on. So of course I didn't answer. I was just like, no. And then I got a LinkedIn phishing message too. Asking about, we want to see your super box research.

• 58:41Speaker 02

  We work at ISP. I'm like, that's the tell. Like there's, there's certain things that give away these folks. And so obviously the stuff that I've been working on and looking at this, like this is making somebody a lot of money. So I'm sure they're, they don't want me going around telling people not to buy the super box. But here's me just blanket saying, don't buy the super box. Um, and so a lot of interesting points have been kind of, uh, in interested in kind of what I've been finding and where I got. So after that happened, I got DDoS'd at my house.

• 59:14Jack Rhysider?

  What?

• 59:15Speaker 02

  Yeah.

• 59:19Speaker 02

  That was wild.

• 59:20Jack Rhysider?

  externally coming from the internet to you.

• 59:22Speaker 02

  Yeah.

• 59:23Jack Rhysider?

  How, how in the world would anybody know your IP?

• 59:25Speaker 02

  Well, I don't think, I, I think in the very, very beginning, and I've changed ISPs too, which I thought was kind of hilarious that I still got hit. But again, depending on who's behind it, I mean, they probably have more resources than I do. So they, I mean, if they really wanted to know, they could probably find out. But yeah, I got nailed like pretty bad.

• 59:45Jack Rhysider?

  How long? What did it last?

• 59:46Speaker 02

  Um, I think it was like 15 minutes. Like, we couldn't like, like, nothing would play, nothing would stream. Like, I was actually on a Signal voice call with like a friend and it was like all choppy, like more so than usual because Signal Voice can be like hit or miss anyway. But it was like really bad. I'm like, holy crap. Like, I can't even talk to you and.

• 1:00:03Jack Rhysider?

  And did you look at the Palo Alto and it was telling you?

• 1:00:06Speaker 02

  Oh, yeah. It was just like, just over, over, over. Like, it was just, it was like three pages worth of just this one IP. Um, I looked it up. It was in like Ireland. I'm like, okay, well, that's not, it was in Cloudflare. I'm like, okay, well, I don't know who the hell did it right now. Um, but yeah, I was more upset that like, you know, my husband was watching Spaceballs and like that totally got paused because of this DDoS attack. So, yeah, I was like, wow, I made a new friend. I got DDoS'd at the house.

• 1:00:35Jack Rhysider?

  So this brings us into January of 2026. And around then, we saw the largest botnet DDoS attack ever. It was the Kim Wolf botnet, and it was launching attacks at 31 terabits per second. It basically had control of 2 million devices and could tell them all to send traffic to a specific IP on the internet, which would basically flood any computer with so much traffic that it would knock it offline.

• 1:01:01Jack Rhysider?

  And you think the Superboxes were part of that botnet?

• 1:01:04Speaker 02

  They, they were confirmed as part of that botnet.

• 1:01:07Jack Rhysider?

  But here's the thing, from my understanding, it wasn't the makers of Superbox who were involved at all in this botnet. These things shipped with a really old version of Android and are loaded with all kinds of remote access features like TeamViewer, Netcat and stuff. So the person behind the Kim Wolf botnet simply found how vulnerable these Superboxes were and spread their botnet onto a ton of them. So now this guy Dort, who's the one who made the Kim Wolf botnet, controls the Superboxes. I mean, if I wasn't already extremely concerned about who's in these Superboxes listening, now there's Dort in there too, and who knows what he's doing with these things, turning them into weapons, I guess. And if Dort can get into any Superbox that's on the internet, then does that mean anyone else can get into these things too? Like, are there a dozen spies in these things, listening

• 1:01:51Jack Rhysider?

  to us, seeing what we're doing on our microphones and stuff, and poking around on our networks? Gosh, I was telling someone about this the other day and their first instinct is that the CIA must be in there listening too. And you know what? At this point, I don't doubt it. The fact that these super boxes are getting infected with more malware by random people on the internet just makes it so much worse. So at this point, it doesn't even matter if China's behind this because pretty much anyone can take these things over and eavesdrop on us or use the device to attack someone else with. This thing is radioactive and it should be smashed, burned and yeeted into space.

• 1:02:24Speaker 02

  Cloudflare, you know, put out a report that talks about kind of the DDoS statistics for the year for 2025. And they said that the Aceru Kim Wolf botnet was the busiest and they mitigated, I think it was, I think the number was crazy, like over 2,000 attacks they mitigated originating from this botnet. I'm like, wow. So it's been busy.

• 1:02:43Jack Rhysider?

  Basically, the Kim Wolf botnet is a DDoS as a service business. You can pay them money and then they'll aim this botnet wherever you want, the target of your choice, and it'll take down whatever you tell them to. So it's purely profit driven for whoever's behind it.

• 1:02:57Jack Rhysider?

  Did this box try to communicate with other devices on the network internally?

• 1:03:02Speaker 02

  Yeah. So I had my, my two little sacrificial raspberry pies, as I call them. I was like, well, once you've touched this network, you can never go back anywhere else. So thank you, my little lambs. And so the raspberry pies sit there on the network and I, you know, I didn't even name them anything interesting, but I'm looking, I've got TCP dump running on them and the boxes are just going freaking crazy. Like all of them are just actively trying to like poke at it. I'm watching scanning. I'm like, are you guys end mapping this like little raspberry pi in here? Like what the hell? Again, they're, they're doing that discovery when they get on a network to see what's on the network. So if you're working, say from home and maybe you're in a position of trust, you're in some type of like important position or you have like, you know, privileged credentials, things like that, you have this

• 1:03:47Speaker 02

  thing sitting on your network and don't know like what it's potentially doing. It could be sniffing creds every time you log into work. It could be discovering your work device on your home network because a lot of folks don't have any segmentation on their home networks. I mean, you know, the possibilities really are endless if we, if we think about it as just like an attack tool. The, I did get a report from someone that there was one at a, at a remote employee's house that was actively trying to poke stuff on their corporate network.

• 1:04:17Jack Rhysider?

  Okay, so try to figure out, do they have a VPN between their home and corporate network?

• 1:04:22Speaker 02

  Uh huh.

• 1:04:22Jack Rhysider?

  Hmm. Gosh, this thing is bad. I still cannot get over how it scans your house, attacks the devices on your network, knocks them offline and impersonates them. Ah, this is such a nightmare.

• 1:04:34Speaker 02

  It's like a perfect Trojan horse, like in the traditional sense. Like, if we go back to the original story, here's this big present and we're gonna hide inside. Here is this device that lets you get all the channels and somebody is going to hide inside.

• 1:04:48Jack Rhysider?

  Okay, fair. It solves a ton of problems for people and that's the big reason why they want to get it. But my gosh, at this point, the veil is lifted, we can see the spies are inside of it, and I'm glad that word is out now, right? And, and that means that there's enough information that everyone should be extremely careful and not buy these things and should be clear that nobody should get this thing because it's just pure evil, right?

• 1:05:11Speaker 02

  Earlier this week, an article comes out on The Verge. And I'm like, oh, The Verge? And it's talking about the super box and the VC box. And basically, and you know, I'm a big wrestling fan, so you know, we call it getting over or putting someone else over. It's basically trying to put over the super box and say like, oh, well, like, you know, there's people at the farmer's market selling these and, you know, they've also got like some goat cheese and stuff. So they're just trying to make it and like, this guy was a retired cop in upstate New York and now he's trying to help, you know, his church get access to quality television. And I'm reading this like, this is literal propaganda. Like, oh my goodness. Like, this is, this is what they mean when they say like, it's gonna be plain as day in your face and you're not gonna understand

• 1:05:56Speaker 02

  that like, again, an average, everyday person's gonna read that and be like, oh, well, these people don't care. Like, in the article, like, it verbatim said like, oh, I don't care about sending a couple thousand dollars a month to China every month because I, you know, I'm helping people get affordable TV.

• 1:06:12Jack Rhysider?

  Sorry. I had to pick my jaw up off the floor. What? This Verge article is titled "Everyone is Stealing TV." And yeah, it simply talks about how so many Americans are selling and using these things. Like, they interviewed Jason, and Natalie, and James, and Eva, all who are happy SuperBox users and resellers. The quote from Eva is, "I've been on a crusade to try to convert everyone." I'm completely flabbergasted by this article. Like, what are we even doing? I mean, let me read one part to you. They interviewed this guy Jason, who earns a commission for every SuperBox he sells. "After signing him up as a reseller, Jason's SuperBox contact also recruited him for a unique side gig.

• 1:06:56Jack Rhysider?

  Whenever Jason finds a SuperBox advertised for less than the company's suggested retail price, he buys it and sells it back to the company for a premium. He says that the SuperBox maker then checks the device's MAC address against a list of past sales and remotely deactivates all boxes it sold to the reseller, who openly advertised the unauthorized discount. Offending sellers are then asked to pay a fine, Jason says. Consumers who happen to buy a box for the wrong price find it locked, with an on-screen warning telling them to contact their service provider. To alleviate the concerns of would-be buyers fearful of getting scammed, device makers maintain online verification tools. Each reseller gets a certificate with a unique code. Enter that code into a web form, and the company will tell you if the reseller in question is in good standing."

• 1:07:42Jack Rhysider?

  Oh. Thanks, Verge, for squashing my concerns about being scammed by someone selling me a cheap SuperBox. I feel much better now that you told me that there's an online verification tool to check whether this seller is legit or not. Ahhh. This article, in my opinion, is all hyped for this thing. It doesn't raise any of the red flags that I see on it. I simply cannot believe The Verge posted this article. This is ridiculous. I am officially nominating this article for a Pony Award.

• 1:08:16Speaker 02

  Then yesterday, um, there was like, I think it was called like the tech brew ride home or something like that. At the end of the episode from yesterday, he spends about five minutes and he's basically, it sounds like he's reading the verge article. And I'm like, no, like, don't, don't repeat it. Like, we were already, again, they're already trying to discredit any of the research that any of us have done on this to basically prove that like, this isn't something you should be getting. And what cracked me up is in the article that said, well, it's not like you can get these at Walmart and Best Buy because everyone knows it's illegal to have pirate devices at the store. And I'm like, no shit. But they're at Walmart and Best Buy.

• 1:08:58Jack Rhysider?

  And I don't think you understand how crazy it is to have an influencer marketing campaign working against us here. You're not buying these things from some shady guy in a dark alley who you know is a hundred percent illegal and is probably scamming you. You're buying it from a soccer mom, a guy with a stand at the farmer's market, your church friend, family members, gym buddies, coworkers. And when it comes into your life in this way, it doesn't feel illegal. It doesn't seem shady. It feels like you're clever and smart to get such a cool gadget.

• 1:09:28Speaker 02

  I remember, you know, kind of the old adage, like you, you know, back in the nineties, early aughts, like especially all of us who've been on the internet a long time. And those of us who were like in high school and stuff like that, when in the early days of the internet, we, you know, you felt like you could spot a scam from a mile away because the skill wasn't there. But this is sophisticated. Like, again, they're hitting it from a few different angles. They're making sure that they have people ready to counter any negative, like press or posts or anything like that. They're making sure, like, like, like we've said, to tap into the economic anxiety. Like, it's crazy. I'm like, wow, they've put so much time into this.

• 1:10:06Jack Rhysider?

  But then you think about where these things end up.

• 1:10:08Speaker 02

  I mean, you, you know, you know, people that work weird shifts, or maybe they work in like, you know, some kind of weird office. It's boring at night. Maybe they're on graves. Oh, I want to watch the UFC fight. Let me bring my super box.

• 1:10:23Jack Rhysider?

  And then that thing just gets busy devouring all the computers at work. Or it's brought to a hotel to watch TV on the go. Or maybe the coffee shop owner installed one so they could play shows on the TVs in the shop. And now when you get on the wifi in that shop, suddenly you're on the same network as a computer that's probing and scanning you and attacking you. This is why I never use wifi in a coffee shop or a public place. I just picture it riddled with these diseased infected boxes that are desperately trying to get access to my machine. The moment it connects, I bring my own wifi hotspot with me everywhere I go. So I only trust my own network.

• 1:11:00Speaker 02

  The funniest thing I think that has happened so far was being out at a pho restaurant. And you know, I'm looking around because someone had just told me they were at a pho restaurant and saw three of them in there. So now I like go into places and I'm like looking and making sure there's not like a super box behind the TV and stuff like that. Because even if it's not doing anything else, just the fact that like anything you connect to it, it wants to know about it and it's gonna start poking at it. To me is scary like if I connect my phone like and what what made me upset about this whole situation with my dad is like I went over there and didn't know he had these and had connected like my work computer at the time and like my phone and stuff to the home network because I was visiting for a couple of days. And I'm like, you have these things in the house?

• 1:11:44Speaker 02

  These have been plugged in the whole time like you what? And so it exposes all of us in a lot of ways that we may not want to be exposed. And you know, I'm not doing anything shady, but like I I want my privacy.

• 1:11:57Jack Rhysider?

  And I saw you are bringing a Faraday bag with you everywhere you go. Is it is this why?

• 1:12:02Speaker 02

  Um, I mean, it could have something to do with it for sure. But also just trying to be more cognizant of my own like personal security hygiene, because I think for a lot of us that have been doing this for a while, there's always gonna be places where we're just like, eh, I don't just, I just don't care that much. Because we already, we're already in it so much all the time. But I I spent some time kind of reflecting on, you know, I was out traveling. Um, and I think I got popped with something because my phone was acting crazy and all this other stuff. So I blew away everything in the house, reimagined everything. Everything's fine now, but I'm like, mm, I'm just gonna take some extra steps just to make sure. Cause I usually, you know, I always have VPNs on and stuff like that, but you know, a VPN can only do so much if somebody's really interested in what you've got going on on the other side of that.

• 1:12:45Speaker 02

  So yeah, I, I will just encourage everyone to just keep practicing basic security hygiene because the moment we get complacent, that's usually when we get got.

• 1:12:54Jack Rhysider?

  Okay, that's it. I'm taking dead ass's cue here. If she always keeps her phone in a Faraday bag, I think I have to do that now too. A Faraday bag is one that just doesn't let wireless signals pass in and out of it. Think of it like the door of your microwave, which blocks it so your microwave doesn't cook the whole kitchen. Because who knows what coffee shops and restaurants have these things in them and are scanning my phone, even if I'm not connected to the wifi. Like what's with the Bluetooth and other antennas on this thing? It's proven to be so malicious that I don't trust it for a second. I don't even want to be in range of this thing.

• 1:13:22Jack Rhysider?

  Let's put all the pieces together.

• 1:13:23Speaker 02

  Yeah.

• 1:13:24Jack Rhysider?

  And, and where do you, where do you land on this?

• 1:13:26Speaker 02

  Okay, so, so the whole picture is somebody, and I'm going to be vague on purpose because I am still working to get the full picture of the somebody. Somebody is basically getting influencers, of course, to show these. There's an entire distribution network of distributors and resellers. So they're getting folks, you know, in their neighborhoods and in their communities and, you know, all these places to sell these boxes to friends, family, every, everybody as much as they can. Which again, already weird. They've already infiltrated all the big box stores. So again, it's now looks like this normal, everyday, has been around for nine years, consumer product. Um, we still, of course, have the whole issue with them targeting people directly in oil and gas.

• 1:14:11Speaker 02

  Which that's still to me, I'm like, this got mailed to you at your house, friend? Like, are you gonna move? Like I just, you know, I'm, I'm worried for you. And then we still, of course, just have the endless problem of like, there's no like legitimate, like regulatory tracking on it. They're, they're dark. There's no FCC IDs, like you can't find really any information on these things. Um, the one that we did find information on, you know, when you're importing something and it's coming from overseas. You have to sign off on it and say that like, you know, it's, it's, everything's correct, like it's, it's labeled, it's got the FCC ID, things like that. And it had a signed one. But the name did not, it was a QQ email that signed it.

• 1:14:55Speaker 02

  And I'm like, so the US agent has a QQ.com email signing off on this device that it has all the regulatory information and the things it's supposed to have when it, when it doesn't.

• 1:15:07Jack Rhysider?

  That's not, that's not legit.

• 1:15:08Speaker 02

  Yeah. So it's kind of like, they've got us like on the MLM thing too. Like, I don't know what it is about America and we love our MLMs, man. Like, there's been like, you know, Amway and all the, you know, there's, there was even like, like a power one. So this is just like a new MLM. It's just streaming box MLM, it seems like.

• 1:15:24Jack Rhysider?

  Yeah. And I think they're hitting us in, in such a unique way because they know we're, we're frustrated with the rising cost of cable and all the different streaming services are branching off into their own. So now you have to have 10 different streaming subscriptions and people are sick of this. So they're just like, we got the solution for you.

• 1:15:41Speaker 02

  It's perfect. You get all the channels.

• 1:15:43Jack Rhysider?

  And we don't care about breaking the law. So, yeah. So someone is doing this. Do you have an idea who might be behind this?

• 1:15:49Speaker 02

  I mean, given everything that's going on geopolitically, like, of course, everyone was kind of just like, you know, hands up like China. Like, it, it just seems like it's obvious, right? At this point, because why else would it be beaking straight into Tencent?

• 1:16:05Speaker 02

  The other thing too, is that as I've kind of been like, looking at this and everything else, the, the devices themselves, like, they've got a whole, like, manufacturing arm that has to be, again, China's gotten the manufacturing thing down. Like, we're all sitting around with iPhones and all these other things. Like, China makes our stuff. So they've gotten really good at how to fabricate this stuff. And so it actually looks nice. Like, it looks like it's good quality to make it look even more credible for the price that people are paying. And if we think about, like you said, everyone's stressed out for money. Everybody always wants a quick fix. We, we are such suckers for get rich quick schemes and things like that. And that is like, peak multi-level marketing.

• 1:16:49Speaker 02

  The distributors get a cut from the resellers. The resellers get a cut from the boxes. And then if you get friends to also help you resell, you get more of a cut of their boxes. So like, it's a perfect MLM. So they're hitting us from the things that are built into our culture, TV, multi-level marketing, get rich quick. They're building into our economic anxiety.

• 1:17:10Speaker 02

  They're building into our complacency with just accepting things that even if, you know, we don't know that much about it, it's like, oh, well, we get all our stuff from Walmart or all our stuff from Best Buy.

• 1:17:20Jack Rhysider?

  Social proof.

• 1:17:20Speaker 02

  Yeah, so they're, they're hitting us from a few different angles, just psychologically, like not even from a technical perspective, like the, the tactics and everything that the box are, are using, those are like table stakes, like you expect reconnaissance, you expect some of these other things. You don't expect an influencer network that's trying to get these out there. You don't expect there to be marketing, because if you look at some of the other devices, like there might be one or two videos here and there, like maybe talking about like an Nvidia Shield as an example, but this thing has like a whole campaign, websites and everything else. I'm like, who is doing, like, you set up a whole brand just to sell these things? Like, this is insane.

• 1:18:01Speaker 02

  And so, yeah, all that to say, like, we're now at this point where I'm like, okay, well, we have to make a decision, I guess, as like a nation. Do we want cheap, easy cable? Or do we want to continue to have basically backdoors plugged into all of our networks?

• 1:18:18Jack Rhysider?

  Okay, so if it is China, even the Chinese government, it's, it's crazy to think that the Chinese government would be behind this, but it sounds like it may be.

• 1:18:27Speaker 02

  They have that unified, you know, front as far as integrating everything with the military, so.

• 1:18:32Jack Rhysider?

  Sure, so if the Chinese government is trying to get into Americans' homes in order to gain more access into them and visibility and all that sort of things, it doesn't seem like we'd be their first target. So I'm just wondering if there is a, if we've seen this activity in other countries, these kind of boxes show up in other countries.

• 1:18:54Speaker 02

  Yeah, that was kind of interesting, because I kind of like immediately, you know, when I first started looking at it, of course, I wanted to see if there was anything else that had been reported. There was a researcher, I'm spacing on his name right now, he, but he had done a write-up on the malware that was in the T95 box, so that kind of got me already thinking like, okay, so we have seen behaviors similar to this before. Um, I did look in like other countries and stuff and um, like China had already cracked down on these types of device. Uh, I think like New Zealand had already cracked down on these types of devices. So it seems like this had already been like a similar problem. But apparently there was also a similar campaign in Taiwan about tenish years ago.

• 1:19:34Speaker 02

  It was all centered around illegal piracy of sports. And so it was the same idea though. They had these streaming boxes that were convenient and you could get all the sports channels and they were all over Taiwan. And then they got busted and then they weren't all over Taiwan anymore. But that could have been a testbed to then see, okay, well, how do we make it work here?

• 1:19:53Jack Rhysider?

  Hmm. So how does, how does a country bust them so that it's no longer valid in that country or whatever? Like, what are the, what are the even approach to stop something like this?

• 1:20:04Speaker 02

  I mean, they of course were like, you gotta pull them off the shelves, they're banned, like, they can't be imported, you know, those big, those big kid controls, as I like to call them. Um, I don't know how long it's gonna take to even see that here. We did just finally get some stuff taken off the shelf that, again, we were, we all had concerns about China and we all had concerns about like, you know, what are these devices actually doing? But it was like years after the fact when it was already a problem.

• 1:20:30Jack Rhysider?

  Yeah, I mean, even if you did get it banned from Walmart and Amazon and Best Buy, you still have the soccer mom down the road slinging them and your electrician's coming over and saying, I got some extra stuff for you if you want to buy these things. And so it would be really hard to put the genie back in the bottle at this point. So that's one prong. And then maybe another prong is getting ISPs to do something and, and say, hey, this is illegal streaming, so we don't allow that here.

• 1:21:00Speaker 02

  Yeah, and I, the ISPs have been really good about this.

• 1:21:04Jack Rhysider?

  I actually got word from a friend who works at an ISP, and he says that a lot of users are reporting that their allocated bandwidth is getting maxed out super early in their billing cycle. And they're like, I'm not online that much, yet it says I've uploaded 360 gigabytes of data? Clearly you have a faulty meter. So the ISP technicians go out to the house and investigate and they can't find an issue. And so they swap out their ISP devices and reset their bandwidth usage. But then the problem persists. Next month, the customers call back saying, it shows that I've uploaded so much data that my ISP is now throttling me. One customer was even seen uploading 4,000 gigabytes in a single day. So the ISP asks the customers, by chance, do you have a super box?

• 1:21:48Jack Rhysider?

  And many of them say, yeah, I do. Why? Well, it's because those things are sending enormous amounts of data to the internet. But what is it sending? Sure, it's part of a botnet, so it's attacking other devices by sending floods of data. But also, it just might be exfiltrating tons of data that it's collecting in that home network. Voice logs, network data, photos, files, anything that it might find valuable. It just sucks it up and sends it off. I mean, if a device is sending terabytes of data a day or a month, then the question isn't what is it uploading? It's more like, what isn't it uploading? So yeah, ISPs are getting hit in the face with these boxes too, and are unsure how to effectively handle them.

• 1:22:28Speaker 02

  I think the telecom and ISP networks understand, I think, their vulnerabilities a little bit better. They're like, okay, yeah, we actually have to like, look at what is going on in home networks, because we are no longer at the point where we can just pretend, oh, well, it's consumer. That doesn't impact me. We're all, we're all in it now. Like, there's no, we can't, like you said, we can't put the genie back in the bottle. So they've been pretty good about trying to, of course, sinkhole traffic. So ISPs can, of course, see downstream. But we have to kind of think about, like, are we prepared to be a country where we are now policing what's going on on home networks? And obviously, like, that would be problematic for a lot of people.

• 1:23:07Jack Rhysider?

  I think that's going too far, but...

• 1:23:08Speaker 02

  Right, no, exactly. Like, I think, and I don't, I don't think we should have to do that.

• 1:23:12Jack Rhysider?

  This might be the one time that I want Disney to get litigious.

• 1:23:16Speaker 02

  Yeah, right.

• 1:23:16Jack Rhysider?

  Why hasn't Disney figured out, hey, they're streaming this piraty? And because I know that they've always been really...

• 1:23:22Speaker 02

  The mouse is always like, ready to strike when it comes to that stuff. I'm actually really surprised that it hasn't been like, one of these bigger, like, media companies, like, actually striking back. I mean, Google sued the bad box operators.

• 1:23:36Jack Rhysider?

  Okay.

• 1:23:36Speaker 02

  Um, and there was a bunch of like, DMCA, like, kind of notices and stuff like that, but it's still going. So is is that gonna actually do what we want it to do? I don't know. Like, we still, you know, so much has happened in the last couple of weeks that like, it's gonna be a busy year in 2026. That's all I could really say. Like, it's, I, there's, there's so much more that's gonna come from this. I, I guarantee it.

• 1:24:02Jack Rhysider?

  Yeah. And if it's, it seems like so easy for it to just be eliminated since it is illegal.

• 1:24:08Speaker 02

  Mm hmm.

• 1:24:09Jack Rhysider?

  And, and that's the thing I'm, I'm.

• 1:24:12Speaker 02

  I've been stuck on that, honestly. Like, to, to me, I'm just like, this is the most blatant example of this. And like, y'all are out here sending like these, you know, ISP letters to like a single mom because she wanted to like download Shrek 2 for like her kids. But like, we're not doing anything about.

• 1:24:27Jack Rhysider?

  Exactly.

• 1:24:28Speaker 02

  This entire network of bootleg streaming.

• 1:24:30Jack Rhysider?

  That, that's what's so surprising is, is the, the, the pushback on piracy all these years.

• 1:24:35Speaker 02

  Yeah.

• 1:24:35Jack Rhysider?

  And how terrible it's been to torrent things and how people are, are, yeah.

• 1:24:39Speaker 02

  Yeah, we're all evil, we're all evil trash for.

• 1:24:44Jack Rhysider?

  Apparently, that's not a problem anymore.

• 1:24:46Speaker 02

  Yeah, I guess.

• 1:24:46Jack Rhysider?

  Or, or they haven't got the memo. That's what's surprising about it.

• 1:24:49Speaker 02

  Yeah.

• 1:24:50Jack Rhysider?

  And so that's what I think is going to unravel this year is, is the, there's, it's no longer unknown.

• 1:24:56Speaker 02

  Yeah.

• 1:24:57Jack Rhysider?

  And it's like, okay, this is clearly, and, but it, because if it, if it is allowed, then why don't, why don't we just make a legit?

• 1:25:05Speaker 02

  A legit one.

• 1:25:06Jack Rhysider?

  Not a legit one, but a non, uh.

• 1:25:08Speaker 02

  Malicious one. Like, we could have a whole new business model, man. Like, I, and again, I'm surprised someone just hasn't, right? Like, I won't be surprised when somebody's like, hey, I'm ethical and I'm gonna help you get all the channels. Like, like, here comes everyone else's money because we don't want implant devices. But again, there's just a lot all going on at the same time. Like, obviously, like, when we think about the whole geopolitical picture, there's a lot of different moving pieces. We've seen a lot of stuff overseas, internationally. And so I still am trying to understand how this might even be a part of that. So I will be digging more this year, that's for sure.

• 1:25:46Jack Rhysider?

  Oh, yeah. I mean, I hope that the update, whatever comes next, isn't bad, these bad boxes destroyed America.

• 1:25:53Speaker 02

  Yeah, like, oh, my God.

• 1:25:55Jack Rhysider?

  It is, you're right, they said, if you put in, this is a prepositioning move.

• 1:25:58Speaker 02

  Mm hmm.

• 1:25:59Jack Rhysider?

  What is their final intent? And maybe we don't know yet.

• 1:26:02Speaker 02

  And that's what I, yeah, that's the part that I'm still kind of scratching my head about, like. It's just, it's the why. I mean, I'm like, yeah, I guess like, maybe the ad fraud, maybe it's the, you know, residential proxy business they're running. Maybe it's just the botnet, but like, there's so many other ways to do all of that. That's not stand up a whole brand and then market these boxes to people so they, they buy them.

• 1:26:28Jack Rhysider?

  Yeah, I, I predict that we haven't seen the full wrath of what these things are capable of yet. It's possible that all this is just some pre-positioning move of some kind. And whoever's behind this is trying to get blue collar workers to give them access into US corporations. And then what? If someone gets a hold of our critical infrastructure in a large scale way, it's like having a chokehold on us. They could do whatever they wanted. So the potential damage these things could do could feasibly be in the realm of nation toppling. Does that make me crazy to say that? This is the very reason why I don't like getting into politics. Politics is designed to confuse you and to keep you from getting to the truth. So you can never be sure of what's actually happening.

• 1:27:12Jack Rhysider?

  But even when you get a glimpse of the truth, you then sound like a lunatic when you start telling other people because if I ever see one of these things plugged in anywhere, I'm going to immediately unplug it and try smashing it to bits. And I can only imagine the owner of it yelling at me, hey, what are you doing, man? And I'd be like, don't you know this thing is evil? And if we don't stop it, it might be the end of our nation.

• 1:27:34Jack Rhysider?

  I feel like a lunatic just thinking that scenario through. But maybe this is the new world that I just need to get used to. Because even if we all team up to get these things smashed and burned and yeeted once and for all, there's just gonna be another thing that pops up, a 3D printer with spyware, a drone with spyware, a projector with spyware, a router, a computer, or even a car. Because if these things are cheaper or better than the competition, or if they just have a better marketing campaign by paying influencers to spread it, then this battle to discover it and eradicate it is just gonna start all over again. And I'm not sure it's possible to fix this. And that's what makes it so scary.

• 1:28:18Jack Rhysider?

  The whole goal of information security is to conduct business in a hostile environment. Like, for instance, when you do anything online, you're traveling through a bunch of networks that you have no idea who owns them. So you have to operate in a zero-trust kind of way, by encrypting your connections so that they can't snoop on you, and doing things to verify the data and tamper with the message. So maybe this is the new hostile environment that we need to learn how to operate safely in. Our homes and workplaces, our coffee shops and bars, could all be out against us now. I never expected our home networks to be hostile environments. But let's take this as a sign that they probably are. And spring is here now, so it's time to clean up our networks and make them safe again.

• 1:29:03Jack Rhysider?

  I'm drawing a line on my front door. Spyware is not allowed past this point.

• 1:29:18Jack Rhysider?

  Thank you so much to Deadass for finally sharing this story with us. It has been such a treat watching her progress through this over the years, and I'm so happy to finally tell you all about it. This show is brought to you by the lovely people who support the show. If you find this show valuable, please consider supporting it too. As a premium listener, you'll not only show a new ethic for directly supporting the people that you appreciate, but you'll also get bonus episodes of this show and an ad-free version too. Just visit plus.darknetdiaries.com and become a premium subscriber today. Thank you. The show is created by me, the failed pro gamer, Jacque Cider. Our editor is AI's worst nightmare, Tristan Ledger. Mixing done by Proximity Sound and our intro music is by the mysterious Breakmaster Cylinder.

• 1:30:02Jack Rhysider?

  What's a pirate's favorite movie? Anything rated R. This is Darknet Diaries.