A forgotten updater inside an old Popcorn Time fork was still running on millions of devices. Researchers say it could have been turned into a botnet.
Popcorn Time was a simple front end for streaming torrents of films and shows. Development stopped years ago, but the software never really went away.
Security researchers at Eye Security found the updater for a fork called Time4Popcorn still active. It ran on Windows, macOS and Android machines around the world.
The updater was phoning home to web domains that no longer had owners. Traffic moved over unencrypted HTTP, and the app bundled an outdated version of Chrome.
Full control, no permission slip
Eye Security’s Niels Teusink said the updater could install and run almost any software. It did so with full privileges on the host machine.
That access opened three routes for an attacker. Someone could seize one of the abandoned domains and push malicious updates to every device. A man-in-the-middle attack could target specific machines. The traffic could also map which devices still ran the software.
None of this needed a fresh vulnerability. The trust relationship was already broken, because the software trusted a domain that nobody controlled.
The fix was to switch it off
Eye Security took an unusual route. The researchers registered one of the abandoned domains themselves. From there they served an update telling the updater to disable itself.
The team acknowledged the awkward ethics of pushing code to devices without consent. They argued the only alternative was to do nothing. In their words, the update process was not doing anything functional anyway. It was only creating risk for users.
On Windows, the update stops and disables the service through the Service Control Manager. No files are deleted and nothing else on the machine is touched.
The lesson for everyone else
Abandoned software with a live update channel is a standing liability. The original owners walked away, but the trust the app was granted never expired.
Most people have no idea what is still phoning home from an old laptop or phone. Auditing installed apps for dead projects is worth the effort, especially on devices you have stopped updating.
The same supply chain risk keeps surfacing elsewhere. It sits behind the push for tighter limits on how Google uses personal data, and behind the scrutiny of single-vendor control over critical satellite networks.
Source: The Verge — Abandoned Popcorn Time apps had to be disabled to prevent a zombie army
The Netherlands, for internationals
One email a week: the week's news for internationals in the Netherlands, new practical guides and what changed in the cities. No spam, unsubscribe any time.
