a teardown · Magcubic HY310 · around €20–40

What a €30 projector does the moment it's online

TLDR

A €30 Android projector, one isolated network, and a packet recorder. In its first few minutes online it installed apps by itself, carried a dormant piece of known malware, and started reporting what I watch.

What I found The technical details

Summary

Sometime last year I bought one of those tiny Android projectors, the kind that sells for twenty to forty euros under a dozen interchangeable brand names. Mine is badged Magcubic HY310. It runs full Android, ships with its own app store, and asks for your Wi-Fi password the moment it powers on.

I never gave it one. I listen to Darknet Diaries, and the episode about BadBox, the one where a researcher buys a cheap streaming box and finds it quietly looking back at her, had stuck with me. So the projector lived in a drawer. I used it a handful of times over HDMI from a laptop, and never once let it online.

Then I realised my own router could help me watch it. It turns out the FritzBox ships with a packet-capture tool built right into its web interface, something I hadn't known existed and was genuinely surprised to find on an ordinary consumer router. So I finally gave the projector the one thing it kept asking for: a Wi-Fi network. Just an isolated guest one, with no route to anything else I own, with that capture running the whole time. Afterwards I connected a second laptop, pulled the apps off the device over a debug cable, and read their code.

What it did was not subtle. Within a few minutes of that single connection it installed a system-level advertising app on its own, carried a dormant copy of a known malware loader waiting for a server to switch on, and began streaming a running list of every app I opened back to its maker, in plain text. Its two core Android safeguards, the signing key and the sandbox, are effectively switched off. Nothing attacked the rest of my network while I watched, but nothing was stopping it either.

So: not something I would put on a network I care about, and not something I would sign into an account on. It makes a fine dumb screen over HDMI, and that is all I use it for. The rest of this site is that outcome in detail, in plain language first and with the raw packets underneath.

Inspired by Darknet Diaries EP 172: SuperBox and the BadBox research behind it.

2apps installed without askingafter one restart

6 + 1known-bad servers contactedon public malware lists

27unencrypted requestsupdates, app lists, licences

in plain english

What this projector does

Six things, roughly in order of how much they would worry me. Each links to the evidence.

It installs apps on its own

After a restart, the projector quietly downloaded and installed two apps without asking. One of them runs with the highest level of permissions on the device.

evidence: F1 →

Ad companies can control it remotely

That app shows full-screen ads when the screensaver comes on. The ad company behind it can add or remove apps on the projector from its own servers.

evidence: F4 →

A known malware component is already on board

Hidden inside the ad app is a piece of code that security researchers have linked to schemes that turn devices into proxies for other people's internet traffic. It was switched off during our tests.

evidence: F2 →

It reports what you use

The projector sent a list of every app we opened, when and for how long, together with its hardware ID, unencrypted, to the manufacturer. Its home screen also reports clicks to Baidu.

evidence: F5 →

Its core security is switched off

Android uses a secret key to decide which apps get full control, plus a lockdown system (SELinux) to contain apps. This firmware uses Google's public example key and has the lockdown set to “warn only”.

evidence: F3 →

What it didn't do

We saw no attempts to scan or attack other devices on the network, and no proxy traffic during our tests. The risk is what it could be told to do later.

Own one of these? What I would do

Keep it on a guest Wi-Fi or separate network, never on the network your laptop and phone use.
Don't sign in to Google, Netflix or any other account you care about on it.
Prefer HDMI from a trusted device (laptop, streaming stick) over the projector's built-in apps.
If you can, return it. If you keep it, community guides like hy310-deshittify show how to disable the vendor apps.

the verdict

Is it malware?

After a reboot, the vendor store silently installed a system-privileged ad app. That app carries the second-stage loader of a publicly documented malware chain, dormant until a server switches it on. The firmware's “platform” signing key is Google's public test key.

Treat the device as untrusted. It is fine as a screen on an isolated network, but it should never sit on the network your phone and laptop use, and it should not be signed into accounts you care about. The full reasoning, with packet-level evidence and the decompiled apps, is in the technical write-up.