Researchers stop Popcorn Time updater before botnet threat

Researchers have taken action to stop an abandoned Popcorn Time updater from becoming a potential botnet. The updater, which was still active on millions of devices, could have been used to install any software with full privileges. The domains it contacted were unencrypted and outdated, making it vulnerable to attacks.

The updater for a Popcorn Time fork called Time4Popcorn was still active on a large number of Windows, macOS and Android devices around the world. The domains it contacted had been abandoned, and the connection was unencrypted, using an outdated version of Chrome. These weaknesses made it possible for an attacker to build a botnet by taking over one of the domains or by targeting specific devices through a man-in-the-middle attack.

Eye Security researchers identified the risk and chose to register one of the domains themselves. They used it to deliver an update that told the updater to disable itself. This action was necessary because the update process was not doing anything functional, it was only creating risk for users.

On Windows, the update stops and disables the service via the Service Control Manager. On macOS, a shell script runs a command that prevents the update process from starting. Android devices were not addressed because installing an update there would still require action from the user.

The researchers had to adjust their update after uploading it to VirusTotal. Security programs flagged the original as malware and blocked it, which left the vulnerable updater running on those machines. The total number of devices at risk is unclear, but the researchers sent out over 2 million update downloads before stopping the distribution.

Eye Security transferred the domains it had used to the Shadowserver Foundation, a web security non-profit. This action was taken to ensure that the threat was fully contained and that the updater could no longer be used to create a botnet.