Security researchers at Eye Security have successfully neutralized a significant vulnerability associated with the abandoned streaming application Popcorn Time. The firm registered abandoned web domains used by the software’s updater to send a command that disabled the service on millions of Windows, macOS, and Android devices.
The Popcorn Time application, which gained notoriety in the 2010s for providing easy access to pirated movies and television shows through torrent technology, has not been actively developed for years. Despite the cessation of official support, the software remains installed on a vast number of computers and mobile devices worldwide. Researchers discovered that a fork of the application known as Time4Popcorn still contained an active updater component that communicated with now-defunct servers.
Time4Popcorn Vulnerability
Niels Teusink, a researcher at Eye Security, identified that the updater for Time4Popcorn was still running on numerous devices across Windows, macOS, and Android platforms. The software was connecting to abandoned web domains over unencrypted HTTP connections. Furthermore, the application was running an outdated and insecure version of the Chrome browser engine.
The primary concern was not the piracy aspect of the software, but the security risk posed by the updater. Because the updater operated with full system privileges and communicated over unencrypted channels, it presented a severe security hole. Teusink noted that an attacker could have exploited this mechanism to install and run arbitrary software on affected devices.
Potential attacks included the creation of a botnet, surveillance of users by identifying specific machines, or man-in-the-middle attacks targeting specific devices. The researchers emphasized that the update process was not performing any functional tasks for users; it was solely creating a risk vector for malicious actors.
Disabling the Service
To mitigate this risk, Eye Security decided to take control of the abandoned domains. They registered one of the domains and used it to distribute a custom update. This update instructed the updater to disable itself. The researchers acknowledged ethical concerns regarding this intervention but stated that their only alternative was to do nothing, leaving the vulnerable updater running.
The method for disabling the service varied by operating system. On Windows devices, the update stopped and disabled the service via the Service Control Manager without deleting any files. On macOS, a shell script was used to execute a command that blocked the update process from starting. The researchers did not address the software on Android devices, noting that installing the update would still require actual user interaction on that platform.
The operation faced a technical hurdle when the update file was uploaded to VirusTotal. This action caused security programs to flag the file as malware, which blocked the update from installing on vulnerable devices and left the updater running. The researchers had to tweak their update to bypass these detections.
By March, Eye Security reported that the update had been downloaded over two million times. At that point, the firm stopped sending the update and transferred the domains they had registered to the Shadowserver Foundation, a web security non-profit organization. The exact number of devices at risk remains unclear, but the intervention effectively removed the immediate threat of the updater being exploited to create a zombie army of infected machines.
Source: The Verge
