Popcorn Time Apps Disabled to Prevent Security Risks

Popcorn Time might evoke nostalgia for those who remember streaming their favorite movies and TV shows easily, but it also raises concerns for cybersecurity as it remains installed on countless devices worldwide. Known for its user-friendliness, this app has been inactive for years; however, researchers recently discovered that its vulnerabilities could lead to a potential bot army.

Discovery of Vulnerabilities

Experts from Eye Security conducted an investigation into a particular version of Popcorn Time known as “Time4Popcorn.” They found that its updater was still operational on numerous systems, including Windows, macOS, and Android devices, making connections to outdated web domains via unencrypted HTTP. Notably, this updater runs on an obsolete and insecure version of Chrome, heightening the risks for users.

Niels Teusink from Eye Security highlighted that this vulnerability could be exploited by malicious actors to install harmful software on affected devices with full privileges. Through methods like domain takeover or man-in-the-middle attacks, cybercriminals could have effortlessly created botnets or conducted intrusive surveillance.

An Ethical Solution

To address this glaring issue, the researchers made a bold move by registering one of the abandoned domains linked to Popcorn Time. They dispatched an update that effectively instructed the outdated updater to disable itself. Despite having reservations about the ethical implications of this fix, they believed in taking action rather than leaving users exposed. Teusink mentioned, “The update process wasn’t doing anything functional anyway; it was only creating risk for users.”

For Windows users, the update was straightforward: it simply halted and disabled the service through the Service Control Manager without touching any existing files. On macOS, a shell script was employed to stop the updater from initiating. However, the researchers did not implement a solution for Android users, as an update on those devices would still require user interaction prior to installation.

Overcoming Technical Challenges

After uploading their update to VirusTotal, the researchers faced an unexpected issue. Security systems flagged their update as potential malware, resulting in many programs blocking it while allowing the insecure updater to remain active. The exact number of devices at risk remains unclear, but Eye Security noted that they had sent out over 2 million download requests for the update by March before ceasing these efforts and transferring the domains to the Shadowserver Foundation, a respected non-profit focused on web security.

This situation serves as a reminder for users of aging applications like Popcorn Time. It's crucial to remain informed about security threats and take necessary precautions to protect personal information.