Remember Popcorn Time, the app that served as an easy-to-use front-end for streaming torrents of movies and TV shows? Development of the MPAA’s most underrated app of the 2010s has been abandoned for years, but the “Netflix of Piracy” software is still installed on millions of devices just waiting to join an army of robots. Eye Security researchers discovered that the updater for a fork of Popcorn Time called “Time4Popcorn” was still running on tons of Windows, macOS, and Android devices located around the world, phoning now-abandoned web domains over unencrypted HTTP and running an outdated, insecure version of Chrome.
Eye Security’s Niels Teusink says the updater could have been used to install and run virtually any type of software with full privileges, easily allowing someone to create a botnet simply by taking over one of the domains, using a man-in-the-middle attack to target specific devices, or carrying out surveillance by identifying machines running the software.
Their solution was to register one of the domains and use it to send their own update which instructed the updater to deactivate itself. Despite ethical concerns about the patch, the researchers say their only alternative “was to do nothing,” emphasizing that “the update process didn’t do anything functional anyway, it just created a risk for users.”
Eye Security said that on Windows devices, their update “simply stops and disables the service through the Service Control Manager” without deleting any files or anything else. On macOS, it uses a shell script to run a command that blocks the update process from starting. They didn’t address the software on Android devices, where installing the update would still require actual user interaction first.
They had to modify their update after it was uploaded to VirusTotal, causing security programs to flag it as malware and block it while leaving the vulnerable updater running. It’s unclear exactly how many devices were at risk, but Eye Security says it “sent over 2 million update downloads” in March, when they stopped sending the update and transferred the domains they were using to the Shadowserver Foundation, a web security nonprofit.
Gn tech
