Updater Exploit Could Have Turned Dormant Apps Into Botnet

Popcorn Time has not been developed for years, but copies of the software remain installed on millions of Windows, macOS and Android machines. Eye Security researchers found the updater for a fork called Time4Popcorn still contacting abandoned web domains over unencrypted HTTP, relying on an outdated version of Chrome. That combination could have turned dormant installations into a botnet.

Niels Teusink of Eye Security said the updater could install and run software with full privileges on affected machines. An attacker who took over one of the abandoned domains could have recruited devices, or mounted a man-in-the-middle attack against specific targets. Identifying which machines run the software would also have enabled surveillance.

Rather than wait for the software's owners to act, the researchers registered one of the domains and used it to send an update that instructed the updater to shut itself down. They acknowledged the approach raised ethical questions but said the only alternative "was to do nothing." They also noted "the update process wasn't doing anything functional anyway, it was only creating risk for users."

On Windows, the update stops and disables the service through the Service Control Manager, leaving files and other system settings unchanged. On macOS, a shell script prevents the update process from launching. Android devices were left alone because disabling the updater there would still require a step from the user.

The team revised the update after uploading it to VirusTotal, where security programs flagged the original version as malware and blocked it. That left the vulnerable updater running on machines protected by those programs.

Eye Security said it distributed over 2 million update downloads before stopping in March. The company then transferred the domains used in the effort to the Shadowserver Foundation, a web security non-profit. The total number of devices at risk remains unclear.