Security Team Deactivates Dormant Streaming App Updater
Experts stopped a hidden component in old movie software from being hijacked by cybercriminals.
By Malik Salazar ·
Millions of computers and phones that still have an older movie streaming app installed are no longer vulnerable to a specific type of cyber attack. A security team recently disabled a hidden update mechanism in the software, removing the risk that hackers could take control of these devices. This action protects users who may not even know they still have the program on their systems.
The software in question is a front end for downloading and watching torrents. It gained notoriety in the 2010s when the MPAA targeted it. Development stopped years ago, yet copies remain active on many machines. The researchers discovered that a fork of the app called Time4Popcorn was still communicating with the internet through an outdated updater.
This updater was connected to web addresses that no one owned anymore. It used unencrypted connections and relied on an old, insecure version of Chrome. Niels Teusink from Eye Security explained that this setup allowed an attacker to install any kind of software with full permissions. They could have created a botnet or spied on specific users by simply buying one of the abandoned web addresses.
To fix the problem, the security team registered one of the old domains themselves. They sent a signal to the software telling it to turn itself off. They admitted this approach raised ethical questions, but noted that doing nothing was the only other option. The update process was not providing any real benefit to users and only added risk.
The fix worked differently on each platform. On Windows, the update stopped the service through the system control manager without deleting files. On macOS, a simple script prevented the process from starting. Android devices were left alone because users would have to manually install an update.
The team had to adjust their method after security software flagged the original fix as malware. This caused some machines to miss the patch. By March, when they stopped sending updates, they had delivered the fix to over two million devices. They then handed the web addresses over to the Shadowserver Foundation, a non-profit focused on web security.
The total number of affected devices is not known. However, the move prevents a potential botnet from forming out of these forgotten applications. Users do not need to take any specific action now that the updater is disabled, but the episode highlights the risks of leaving old software on their machines.
