2 Million Update Downloads Silenced Dormant Popcorn Time Updater
Eye Security registered abandoned domains to send a self-disable patch to Windows and macOS devices still checking for updates from the defunct streaming app.
By Naomi Whitaker ·
Popcorn Time, a streaming application for torrents that drew attention from the MPAA in the 2010s, has seen no development for years, yet millions of devices still hold active copies of its software. Researchers at Eye Security identified that the updater for a fork named Time4Popcorn remained active on Windows, macOS, and Android systems worldwide. These updaters communicated with abandoned web domains over unencrypted HTTP and relied on an outdated version of Chrome.
Niels Teusink of Eye Security described the security gap as a severe risk. The updater could install and run software with full privileges, allowing an attacker to build a botnet by taking over one of the abandoned domains or targeting specific machines via a man-in-the-middle attack. Identifying which devices ran the software would also have enabled surveillance.
To address the issue, the researchers registered one of the abandoned domains and delivered an update that instructed the updater to disable itself. The team acknowledged the ethical complexity of the action, stating the only alternative was to do nothing. They noted that the update process was not performing any functional task and was only creating risk for users.
The Windows version of the patch stops and disables the service via the Service Control Manager without deleting files. On macOS, a shell script executes a command to prevent the update process from starting. Android devices were excluded from the initial distribution because installing an update on those systems requires direct user action.
The deployment process encountered an obstacle when the team uploaded the update to VirusTotal. Security programs flagged the original file as malware and blocked it, leaving the vulnerable updater active on those machines. The team adjusted the update to resolve the issue.
Eye Security reported sending out over 2 million update downloads by March, the point at which the company stopped distributing the patch. The firm subsequently transferred the domains it had used to the Shadowserver Foundation, a web security non-profit.
The total number of devices at risk remains unclear, but the intervention prevented the dormant software from becoming a potential vector for large-scale attacks.
Source: The Verge
