Security Team Delivers Two Million Updates to Kill Old Movie App
Researchers forced a dormant updater to disable itself, removing a backdoor that allowed attackers to control millions of Windows and Mac computers.
By Chinedu Schneider ·
A dormant movie streaming app left a backdoor open on millions of computers. Attackers could have exploited this gap to take control of devices without user knowledge. Security researchers intervened to close the hole.
Popcorn Time was a popular front end for downloading movies and TV shows via torrents. The project stopped receiving updates years ago, but the software remained installed on many machines. Researchers at Eye Security discovered that the updater for a version called Time4Popcorn was still running.
The updater contacted abandoned web servers using unencrypted connections. It also relied on an old, insecure version of Chrome. Niels Teusink of Eye Security stated that the flaw allowed the updater to install any software with full privileges. An attacker could have seized the abandoned domains to build a botnet. Alternatively, they could have targeted specific computers or tracked users through surveillance.
The team registered one of the abandoned domains themselves. They used it to send an update that instructed the software to turn itself off. The researchers noted that doing nothing was the only other option. They added that the update process was not providing any functional service and only created risk for users.
On Windows, the update stopped the service through the Service Control Manager. It did not delete files or make other changes. On macOS, a shell script ran a command to prevent the update process from starting. Android devices were skipped because installing the fix required manual action from the user.
The team had to fix the update after antivirus software flagged the original file as malware. Security programs blocked the first version, leaving vulnerable devices unprotected. Eye Security said it sent out over 2 million update downloads by March. The company then handed the domains to the Shadowserver Foundation.
The exact number of devices at risk is unknown. The update distribution ended in March. The domains are now under the management of a web security non-profit.
Source: The Verge
