Abandoned Popcorn Time apps had to be disabled to prevent a botnet
Security researchers at Eye Security disabled an outdated updater in abandoned piracy streaming apps that was still running on millions of devices and could have let attackers install any software. More than 2 million update downloads had been sent by March.
Researchers at the cybersecurity firm Eye Security have shut down the updater of an app family based on Popcorn Time, a software project abandoned for years, because it put users' devices at risk. Popcorn Time was a popular 2010s program that made watching movies and TV shows from torrents easy, and it was nicknamed the "Netflix of piracy." Its development stopped long ago, yet it remains installed on millions of devices around the world.
What was found
The researchers found that the updater of a Popcorn Time fork called "Time4Popcorn" was still active on many Windows, macOS and Android devices. It contacts web domains that are no longer maintained, using unencrypted HTTP, and runs an outdated, insecure version of Chrome.
Niels Teusink of Eye Security says the updater could have been used to install and run virtually any software with full privileges. An attacker could have taken over one of the domains to build a botnet, targeted specific devices through a man-in-the-middle attack, or carried out surveillance by identifying machines running the software.
The fix
The researchers registered one of the domains and pushed out their own update telling the updater to disable itself. They acknowledged ethical concerns about this approach but said the only alternative was to do nothing. In their view, the update process served no functional purpose and only created risk for users.
On Windows, the update stops and disables the service through the Service Control Manager without deleting any files. On macOS, a shell script runs a command that prevents the update process from starting. Android devices were not addressed, since installing the update there would still require user interaction.
Complications and scale
The update had to be adjusted after it was uploaded to VirusTotal, because security programs had flagged it as malware and blocked it, leaving the vulnerable updater running. The exact number of devices at risk is unclear, but Eye Security says it sent out more than 2 million update downloads by March. It then stopped distributing the update and handed the domains it had used to the Shadowserver Foundation, a web security non-profit.
