Security Team Forces Old Streaming Tool to Shut Down
Researchers registered abandoned web domains to push a silent update that disabled a vulnerable updater on millions of dormant devices.
By Julian Kobayashi ·
Millions of computers still run a background process for a movie streaming app that has not been updated for years. That process contained a security flaw that could have allowed attackers to turn those machines into a botnet.
Researchers at Eye Security identified the vulnerability in the updater for Time4Popcorn, a fork of the original Popcorn Time application. The software remained installed on many Windows, macOS, and Android systems worldwide. The updater connected to web domains that had been abandoned by their owners. It used unencrypted HTTP connections and relied on an old, insecure version of the Chrome browser engine.
Niels Teusink of Eye Security explained that the flaw allowed the updater to install and run any software with full privileges. An attacker could have seized one of the abandoned domains to recruit devices into a botnet. They could also have performed man-in-the-middle attacks to target specific machines or track which users had the software installed.
To fix the problem, the researchers registered one of the abandoned domains themselves. They used it to send an update that instructed the updater to disable itself. Teusink noted that the team considered the ethical implications of this action. He stated that the only other option was to do nothing. He added that the update process was not performing any functional tasks and was only creating risk for users.
The update worked differently on each operating system. On Windows, it stopped and disabled the service through the Service Control Manager without deleting files. On macOS, a shell script prevented the update process from starting. The team did not address Android devices because updating those systems would still require user action.
The rollout faced a technical hurdle. After uploading the original update to VirusTotal, security programs flagged it as malware and blocked it. This left the vulnerable updater running on some machines. The team adjusted the update to resolve the issue.
The total number of affected devices is unknown. Eye Security reported sending out over 2 million update downloads by March. The company stopped distributing the update at that time and transferred the domains it used to the Shadowserver Foundation.
Source: The Verge
