Researchers shut down Time4Popcorn over botnet creation risk — The Verge

Researchers at Eye Security registered one of the abandoned domains associated with Time4Popcorn and sent an update through it to disable the outdated updater. They sought to eliminate the risk that abandoned Popcorn Time applications could be used to create a botnet, The Verge reports.

Vulnerable update mechanism

Time4Popcorn is one of the forks of Popcorn Time, a program that made it easier to watch movies and TV series through torrent networks. Development of this software was discontinued several years ago, but according to researchers, it is still installed on millions of devices.

Eye Security specialists found that the Time4Popcorn updater continued to operate on Windows, macOS, and Android devices in various countries. It accessed abandoned web domains via an unencrypted HTTP connection and used an outdated and insecure version of Chrome.

More current news is available on the UA.News Telegram channel Telegram.

Risk of device takeover

According to Eye Security researcher Niels Teusink, this mechanism could potentially allow virtually any software to be installed and run with full privileges. An attacker could have exploited it by taking over one of the domains or conducting a man-in-the-middle attack on individual devices. The mechanism could also have enabled surveillance of devices running this software.

Eye Security acknowledged that its method of disabling the updater raises ethical questions, but said that inaction was the only alternative. On Windows devices, the update it sent stops and disables the service through Service Control Manager without deleting files or other content.