Eye Security pushes silent update to two million devices to kill dormant updater
The move disables an active component of the abandoned Popcorn Time streaming app that security experts said could have allowed attackers to build a large-scale botnet.
By Michael Lombardi ·
Eye Security researchers forced the updater for the abandoned streaming app Popcorn Time to shut down on millions of computers. The security firm acted to neutralize a dormant threat that had persisted for years on Windows, macOS, and Android systems.
The team distributed updates to more than 2 million devices by March of this year. They stopped pushing the patch at that time and subsequently handed over the web domains used for the update to the Shadowserver Foundation. The total number of vulnerable machines remains unknown because the original developers never tracked the full user base.
The target software was a fork of Popcorn Time known as Time4Popcorn. The application had not received development for years, yet its updater remained active. Eye Security found that this updater contacted abandoned web servers using unencrypted HTTP connections. It also relied on an outdated and insecure version of the Chrome browser engine.
Niels Teusink, a researcher at Eye Security, stated that the flaw allowed the updater to install and run any software with full privileges. An attacker could have seized control of the abandoned domains to turn the connected devices into a botnet. They could also have used man-in-the-middle attacks to target specific computers or identified which machines were running the software for surveillance purposes.
The researchers registered one of the abandoned domains themselves to deploy the disabling update. They acknowledged the ethical complexities of modifying software without user permission but noted that the alternative was to do nothing. The team argued that the update process was not performing any useful function and was only creating risk for users.
The Windows version of the fix stops and disables the service through the Service Control Manager without deleting files. On macOS, a shell script runs a command that prevents the update process from starting. Android devices were excluded from the patch because installing the fix would require manual action from the user.
Source: The Verge
