Abandoned Popcorn Time apps disabled to block botnets
Security researchers took over abandoned domains of the pirate streaming app Popcorn Time to push a self-disabling update, protecting millions of vulnerable devices.
Stock photo for illustration only, not from the actual event
- The notorious pirate streaming app Popcorn Time remains installed on millions of devices.
- Eye Security researchers discovered legacy updaters communicating over unencrypted HTTP.
- The research team registered abandoned domains to push an update that disables the software.
- Over 2 million update downloads were distributed before handing domains to Shadowserver Foundation.
Remember Popcorn Time, the application that functioned as an easy-to-use frontend for streaming torrents of movies and television shows? Development of the MPAA’s least-favorite software from the 2010s was abandoned years ago, yet this so-called Netflix of piracy remains installed on millions of devices worldwide, merely waiting to be drafted into a botnet army.
Researchers at Eye Security discovered that the updater for a Popcorn Time fork known as Time4Popcorn was still active on countless Windows, macOS, and Android devices across the globe. The software was found phoning home to now-abandoned web domains via unencrypted HTTP connections while running an outdated and insecure version of the Chrome browser.
Stock photo for illustration only, not from the actual event
Niels Teusink of Eye Security explained that this updater could have been exploited to install and execute virtually any type of software with full system privileges. This vulnerability easily allowed malicious actors to construct a botnet simply by seizing control of one of the domains, executing a man-in-the-middle attack targeting specific devices, or conducting surveillance by identifying machines running the software.
This phenomenon of zombie software highlights the persistent security risks lurking on everyday user devices. Applications and utilities downloaded in the past that receive no further security maintenance can instantly transform into major cybersecurity vulnerabilities once their underlying infrastructure, such as expired web domains, is left unprotected for malicious actors to acquire.
The researchers' solution involved registering one of the abandoned domains and deploying their own update instructing the updater to deactivate itself. Despite ethical concerns surrounding this fix, the researchers pointed out that their only alternative was inaction, emphasizing that the original update mechanism served no functional purpose other than creating ongoing risk for users.
"The update process wasn’t doing anything functional anyway, it was only creating risk for users."
Eye Security Researchers
Eye Security outlined the specific methods used across different operating systems:
- On Windows devices, the update simply stops and disables the service via the Service Control Manager without deleting any files.
- On macOS, it utilizes a shell script to execute a command that blocks the update process from initiating.
- On Android devices, they did not address the software directly, as installation would still require active user interaction.
The team was forced to tweak their update after it was uploaded to VirusTotal, which caused security software to flag it as malware and block it while leaving the vulnerable updater running. While the exact number of at-risk devices remains unclear, Eye Security reported sending out over 2 million update downloads by March, at which point they halted the updates and transferred the domains to the Shadowserver Foundation, a web security non-profit organization.
Source: The Verge
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment