Eye Security Disables Updater for 2 Million Dormant Popcorn Time Devices
Researchers forced a self-terminating update on Windows and Mac systems to stop an abandoned streaming app from becoming a botnet entry point.
By Isabel Moretti ·
More than 2 million update downloads were sent to dormant devices before researchers halted a potential botnet threat. The software in question is Popcorn Time, a streaming front end for movie and TV torrents that gained notoriety in the 2010s. Although development ceased years ago, copies of the application remain installed on millions of Windows, macOS, and Android machines.
Eye Security researchers discovered that the updater for a specific fork, Time4Popcorn, was still active on these systems. The updater contacted abandoned web domains over unencrypted HTTP. It also relied on an outdated and insecure version of Chrome. Niels Teusink of Eye Security stated that the weakness allowed the updater to install and run practically any software with full privileges. An attacker could have recruited devices into a botnet by taking over one of the abandoned domains or through man-in-the-middle attacks.
The research team registered one of the abandoned domains themselves to deliver a corrective update. This update instructed the updater to disable itself. Teusink noted that the update process was not performing any functional tasks and was only creating risk for users. The team acknowledged ethical concerns regarding the unsolicited update but stated that the alternative was to do nothing. On Windows systems, the update stops and disables the service via the Service Control Manager without deleting files. On macOS, a shell script prevents the update process from starting. Android devices were not addressed because they require user action to install updates.
The team had to adjust the update after uploading it to VirusTotal. Security programs flagged the original payload as malware and blocked it, leaving the vulnerable updater running on affected machines. Eye Security distributed the revised update until March, when the company stopped sending downloads. The organization then transferred the domains it had used to the Shadowserver Foundation, a web security non-profit. The total number of at-risk devices remains unclear, but the intervention targeted the specific Windows and macOS instances where the updater could operate autonomously.
Source: The Verge
