Silent Patch Stops Old Movie App From Checking In
Eye Security pushed a self-disabling update to over two million Windows, macOS, and Android devices running abandoned Popcorn Time software.
By Nadia Almasi ·
A dormant movie app updater is no longer checking in with servers around the world.
Popcorn Time, a streaming front end for torrents, stopped receiving updates years ago. The MPAA targeted the platform in the 2010s, but the software remains installed on millions of computers. A fork called Time4Popcorn kept an active updater running on Windows, macOS, and Android systems. That updater contacted abandoned web domains over unencrypted HTTP. It also relied on an outdated version of Chrome.
Niels Teusink of Eye Security identified the flaw in the system. He stated that the updater could install and run software with full privileges. An attacker could have seized one of the abandoned domains to build a botnet. They could also have targeted specific machines through a man-in-the-middle attack. The setup allowed for surveillance by identifying which devices were active.
The researchers registered one of the abandoned domains themselves. They used it to push an update that told the updater to disable itself. The team acknowledged ethical questions about the method. They noted that doing nothing was the only alternative. Teusink explained that the update process was not doing anything functional. It was only creating risk for users.
The Windows version of the patch stops the service via the Service Control Manager. It does not delete files or make other changes. On macOS, a shell script runs a command to prevent the update process from starting. The team did not address Android devices because those updates require user action.
The initial upload to VirusTotal caused a problem. Security programs flagged the original patch as malware and blocked it. This left the vulnerable updater running on affected machines. The researchers adjusted the update to fix the issue.
Eye Security distributed over two million update downloads by March. The company stopped distributing the update at that time. It then transferred the domains it used to the Shadowserver Foundation, a web security non-profit.
Source: The Verge
