Remember Popcorn Time, the app that served as an easy-to-use front end for streaming torrents of movies and TV shows? Development of the MPAA’s least-favorite app of the 2010s has been abandoned for years, but the “Netflix of Piracy” software is still installed on millions of devices that are just waiting to join a bot army. Researchers at Eye Security found the updater for a Popcorn Time fork called “Time4Popcorn” still running on tons of Windows, macOS, and Android devices located around the world, phoning home to now-abandoned web domains over unencrypted HTTP and running an outdated, insecure version of Chrome.
Eye Security’s Niels Teusink says the updater could have been used to install and run basically any kind of software with full privileges, easily enabling someone to create a botnet just by taking over one of the domains, using a man-in-the-middle attack to target specific devices, or perform surveillance by identifying the machines running the software.
Their solution was to register one of the domains and use it to send their own update that instructed the updater to disable itself. Despite ethical concerns about the fix, the researchers say their only alternative “was to do nothing,” pointing out, “The update process wasn’t doing anything functional anyway, it was only creating risk for users.”
Eye Security said on Windows devices, their update “simply stops and disables the service via the Service Control Manager” without deleting any files or anything else. On macOS, it uses a shell script to execute a command that blocks the update process from starting. They didn’t address the software on Android devices, where installing the update would still require actual user interaction first.
They had to tweak their update after it was uploaded to VirusTotal, causing security programs to flag it as malware and block it while leaving the vulnerable updater running. It’s unclear exactly how many devices were at risk, but Eye Security says it “sent out over 2 million update downloads” by March, when they stopped sending the update and transferred the domains they used to the Shadowserver Foundation, a web security non-profit.