Security Researchers Shut Down Silent Updater on Millions of Devices
Eye Security disabled a dormant component in the Popcorn Time software to prevent a potential botnet attack.
By Jacob Leary ·
Popcorn Time, a streaming application that faced legal pressure from the MPAA in the 2010s, has not received official development updates for years. Despite the project’s dormancy, copies of the software remain installed on a vast number of computers and mobile phones.
Researchers at Eye Security discovered that the updater for a fork of the software named Time4Popcorn was still active on Windows, macOS, and Android devices worldwide. The component contacted web domains that were no longer maintained. It transmitted data over unencrypted HTTP connections and relied on an outdated and insecure version of the Chrome browser engine.
Niels Teusink of Eye Security stated that this configuration created a serious vulnerability. The updater had the capability to install and execute any software with full system privileges. An attacker could have seized control of one of the abandoned domains to build a botnet. Alternatively, they could have targeted specific machines using a man-in-the-middle attack or identified which devices were running the software for surveillance purposes.
The research team decided to register one of the abandoned domains themselves. They used it to push an update that instructed the software to disable its own update process. Teusink noted that the alternative was to do nothing, arguing that the update process was only creating risk for users without providing any functional benefit.
The Windows version of the fix stops and disables the service via the Service Control Manager without deleting files. On macOS, a shell script prevents the update process from starting. Android devices were excluded from the initial fix because installing an update on that platform still required direct user action.
The team had to revise the update after uploading it to VirusTotal. Security programs flagged the original file as malware and blocked it, which left the vulnerable updater active on those specific machines. By March, Eye Security reported sending out over 2 million update downloads before ceasing distribution. The company subsequently transferred the domains it had used to the Shadowserver Foundation, a web security non-profit.
Source: The Verge
