Remember Popcorn Time, the app that served as an easy-to-use interface for streaming movie and TV show torrents? Development of the MPAA’s least favorite app in the 2010s has been abandoned for years, but the “Netflix of piracy” software is still installed on millions of devices that are waiting to join an army of bots. Eye Security researchers discovered that the updater for a fork of Popcorn Time called “Time4Popcorn” is still running on tons of Windows, macOS, and Android devices located around the world, calling now-abandoned web domains over unencrypted HTTP and running an outdated and insecure version of Chrome.
Eye Security’s Niels Teusink says the updater could have been used to install and run basically any type of software with full privileges, easily allowing someone to create a botnet simply by taking over one of the domains, using a man-in-the-middle attack to target specific devices, or performing surveillance by identifying the machines running the software.
Their solution was to register one of the domains and use it to send their own update that told the updater to disable itself. Despite ethical concerns about the fix, the researchers say their only alternative “was to do nothing,” noting that “the update process didn’t do anything functional anyway, it just created risks for users.”
Eye Security said that on Windows devices, its update “simply stops and disables the service through Service Control Manager” without deleting any files or anything else. On macOS, you use a shell script to run a command that blocks the update process from starting. They didn’t address software on Android devices, where installing the update would still require actual user interaction first.
They had to modify their update after it was uploaded to VirusTotal, causing security programs to flag it as malware and block it while leaving the vulnerable updater running. It’s unclear exactly how many devices were at risk, but Eye Security says it “shipped more than 2 million update downloads” in March, when they stopped shipping the update and transferred the domains they used to the Shadowserver Foundation, a web security nonprofit.
