Abandoned Popcorn Time apps had to be disabled to prevent a zombie army

Remember Popcorn Time, the app that served as an easy-to-use forefront end for streaming torrents of movies and TV shows? Development of the MPAA’s least-favorite app of the 2010s has been abandoned for years, but the “Netflix of Piracy” application is motionless installed on millions of devices that are fair waiting to associate a bot army. Researchers at Eye Security established the updater for a Popcorn Time fork called “Time4Popcorn” motionless operating on lots of Windows, macOS, and Android devices located about the world, phoning residence to now-abandoned web domains complete unencrypted HTTP and operating an outdated, insecure type of Chrome.

Eye Security’s Niels Teusink says the updater could have been used to instal and run basically any benevolent of application alongside complete privileges, effortlessly enabling person to create a botnet fair by taking complete among the domains, using a man-in-the-middle assault to mark particular devices, or execute surveillance by identifying the machines operating the software.

Their resolution was to enroll among the domains and use it to dispatch their own update that instructed the updater to disable itself. Despite ethical concerns concerning the fix, the researchers say their lone substitute “was to do nothing,” pointing out, “The update procedure wasn’t doing item functional anyway, it was lone creating hazard for users.”

Eye Security stated on Windows devices, their update “simply stops and disables the assistance via the Service Control Manager” without deleting any records or item else. On macOS, it uses a casing manuscript to execute a command that blocks the update procedure from starting. They didn’t location the application on Android devices, anywhere installing the update would motionless necessitate genuine person communication first.

They had to tweak their update following it was uploaded to VirusTotal, causing safety programs to emblem it as malware and obstacle it during leaving the susceptible updater running. It’s unclear exactly how many devices were at risk, but Eye Security says it “sent out complete 2 myriad update downloads” by March, whenever they stopped sending the update and transferred the domains they used to the Shadowserver Foundation, a web safety non-profit.