Researchers shut down Time4Popcorn’s vulnerable updater to curb botnet risk
Researchers disabled an abandoned Popcorn Time fork’s updater after finding it could let attackers take control of devices and build a botnet. The intervention reduced a security risk for users, though it raised ethical questions about researchers sending software updates without direct consent.
The Time4Popcorn updater was still active on Windows, macOS and Android devices, contacting abandoned domains over unencrypted connections and using an outdated version of Chrome. Eye Security registered one of the domains and sent an update that disabled the updater on Windows and macOS; Android users were not covered because installing an update there required their interaction. The researchers said they had sent more than two million update downloads by March, then transferred the domains to the Shadowserver Foundation.
In short
- An abandoned updater left Popcorn Time users exposed to possible remote attacks.
- Eye Security sent an update to disable it on Windows and macOS.
- More than two million update downloads were sent before the domains were transferred.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The intervention addressed an active security weakness in software that was still contacting abandoned domains, potentially exposing users to device takeover and botnet abuse. With the original developers absent and the updater reaching a large number of devices, sending a protective update may have been a proportionate way to reduce harm, especially on systems where users could not readily act on the risk themselves.
The case against
Even when intended to protect users, researchers sending software updates without their direct consent raises questions about authority, transparency and control over people’s devices. Users may have had different preferences or relied on the software, and an intervention by outside researchers could set a precedent for others to alter devices remotely; clearer notice and consent would better respect user autonomy.
Explained simply
Time4Popcorn was an unofficial version of Popcorn Time, a service for watching films and television over the internet. Its updater remained on users’ devices after the project was abandoned, even though it relied on outdated software and contacted domains without encryption.
That left a route attackers could potentially use to send harmful updates and take control of devices, including linking them into a botnet. Security researchers took over one of the updater’s domains and used it to disable the updater on Windows and Mac computers. The case matters because it shows how abandoned software can remain a security risk, and raises questions about when researchers should change software on users’ devices without their direct consent.
Entertainment Film Horror Music Software Technology TV
Read the full article at the source →
Originally published by The Verge as “Abandoned Popcorn Time apps had to be disabled to prevent a zombie army”.