Popcorn Time Apps Threaten Security, Researchers Take Action
Abandoned Popcorn Time applications risk creating a botnet army, prompting researchers to intervene and disable vulnerable updaters.
The infamous Popcorn Time application, once a popular tool for streaming movies and TV shows, has been rendered obsolete for years. However, its legacy continues to linger, raising cybersecurity concerns as the software remains installed on millions of devices globally.
Uncovering Security Flaws
Researchers from Eye Security recently investigated a variant known as “Time4Popcorn.” They discovered that the updater for this version was still active across various platforms, including Windows, macOS, and Android. Alarmingly, it was making connections to outdated web domains through unsecured HTTP, relying on an insecure version of Chrome, further amplifying the danger to users.
Niels Teusink from Eye Security indicated that these vulnerabilities posed a significant risk. Malicious users could exploit the outdated updater to gain full privileges on compromised devices, potentially creating a botnet through methods such as domain hijacking or man-in-the-middle attacks.
Taking a Stand
In light of these findings, the researchers decided to take proactive measures. They registered one of the vulnerable domains linked to Popcorn Time and sent an update instructing the outdated updater to disable itself. While this action raised ethical questions, the researchers felt it was necessary. As Teusink remarked, “The update process wasn’t doing anything functional anyway; it was only creating risk for users.”
The solution varied by operating system. Windows users received a straightforward update that stopped and disabled the updater service via the Service Control Manager without deleting any files. For macOS users, a shell script was used to prevent the updater from starting. Unfortunately, the situation was different for Android devices, as user interaction was still required to implement the update.
Challenges and Outcomes
After submitting their update to VirusTotal, the researchers faced unforeseen hurdles. Security software flagged their solution as malware, leading to concerns that the vulnerable updater would continue to run unhindered. Eye Security estimated that they had dispatched over 2 million updates by March before halting their efforts and handing over the domains to the Shadowserver Foundation, a non-profit organization dedicated to enhancing web security.
This incident serves as a vital reminder for users still employing outdated applications like Popcorn Time. It’s essential to stay updated on security threats and take proactive measures to safeguard personal information.
