Plume Security Labs Uncovers "SuperProxy" Threat in Streaming Devices Plume, a leader in home Wi-Fi optimization and ISP operational services, has exposed a critical security flaw in a class of "SuperBox" streaming media devices through its newly established Security Labs. The investigation revealed that these devices can be covertly hijacked to function as nodes in a commercial residential proxy network dubbed "SuperProxy" without users' knowledge. The issue was first detected by Plume’s Network Operations Center (NOC) due to unusual uplink traffic patterns, prompting a deeper analysis. According to Plume CTO Chris Griffiths, the devices depending on installed apps can accept unauthenticated connections, creating tunnels to remote command servers. This behavior mirrors commercial proxyware schemes, where consumer devices are monetized by routing third-party traffic, potentially degrading ISP services and overwhelming network infrastructure. Plume’s large-scale management of hundreds of millions of home broadband devices enables early detection of such threats. The company’s integrated security approach, powered by AI-driven telemetry data, allows for rapid identification and mitigation before issues spread widely. Affected ISP clients receive immediate support to isolate and remove compromised devices, minimizing service disruptions. In a separate development, Plume’s security measures have earned recognition from Singapore’s Cyber Security Agency, which certified a Plume-integrated customer premises equipment (CPE) at the highest tier (Level 4) of its Cybersecurity Labelling Scheme. The certification confirms that the hardware meets rigorous security standards, including third-party penetration testing. The full research paper detailing the SuperProxy findings is available [here].