Abandoned Popcorn Time apps had to be disabled to prevent a zombie army

Abandoned Popcorn Time apps had to be disabled to prevent a zombie army. What old and vulnerable software might be running on your PC right now?

为了防止僵尸网络大军的形成，废弃的 Popcorn Time 应用程序必须被禁用。你的电脑上现在可能运行着哪些陈旧且易受攻击的软件？

Remember Popcorn Time, the app that served as an easy-to-use front end for streaming torrents of movies and TV shows? Development of the MPAA’s least-favorite app of the 2010s has been abandoned for years, but the “Netflix of Piracy” software is still installed on millions of devices that are just waiting to join a bot army.

还记得 Popcorn Time 吗？这款应用程序曾作为流媒体电影和电视节目种子文件的易用前端。尽管这款 2010 年代美国电影协会（MPAA）最痛恨的应用程序早已停止开发多年，但这款“盗版界的 Netflix”软件仍安装在数百万台设备上，随时可能沦为僵尸网络的一部分。

Researchers at Eye Security found the updater for a Popcorn Time fork called “Time4Popcorn” still running on tons of Windows, macOS, and Android devices located around the world, phoning home to now-abandoned web domains over unencrypted HTTP and running an outdated, insecure version of Chrome.

Eye Security 的研究人员发现，一款名为“Time4Popcorn”的 Popcorn Time 分支版本的更新程序仍在全球数以万计的 Windows、macOS 和 Android 设备上运行。它通过未加密的 HTTP 协议向现已废弃的网络域名发送请求，并运行着过时且不安全的 Chrome 版本。

Eye Security’s Niels Teusink says the updater could have been used to install and run basically any kind of software with full privileges, easily enabling someone to create a botnet just by taking over one of the domains, using a man-in-the-middle attack to target specific devices, or perform surveillance by identifying the machines running the software.

Eye Security 的 Niels Teusink 表示，该更新程序可被利用来以完全权限安装并运行任何类型的软件。攻击者只需接管其中一个域名、利用中间人攻击针对特定设备，或通过识别运行该软件的机器进行监控，就能轻易建立一个僵尸网络。

Their solution was to register one of the domains and use it to send their own update that instructed the updater to disable itself. Despite ethical concerns about the fix, the researchers say their only alternative “was to do nothing,” pointing out, “The update process wasn’t doing anything functional anyway, it was only creating risk for users.”

他们的解决方案是注册其中一个域名，并利用它发送自己的更新，指示更新程序自行禁用。尽管这一修复方案引发了伦理方面的担忧，但研究人员表示，他们唯一的选择就是“什么都不做”，并指出：“更新过程本身并没有任何实际功能，只会给用户带来风险。”

Eye Security said on Windows devices, their update “simply stops and disables the service via the Service Control Manager” without deleting any files or anything else. On macOS, it uses a shell script to execute a command that blocks the update process from starting. They didn’t address the software on Android devices, where installing the update would still require actual user interaction first.

Eye Security 表示，在 Windows 设备上，他们的更新“只是通过服务控制管理器停止并禁用了该服务”，而不会删除任何文件或其他内容。在 macOS 上，它使用 shell 脚本执行命令，阻止更新进程启动。他们没有处理 Android 设备上的软件，因为在这些设备上安装更新仍需要用户的实际操作。

They had to tweak their update after it was uploaded to VirusTotal, causing security programs to flag it as malware and block it while leaving the vulnerable updater running. It’s unclear exactly how many devices were at risk, but Eye Security says it “sent out over 2 million update downloads” by March, when they stopped sending the update and transferred the domains they used to the Shadowserver Foundation, a web security non-profit.

在更新程序被上传到 VirusTotal 后，他们不得不对其进行调整，因为安全程序将其标记为恶意软件并进行了拦截，导致易受攻击的更新程序依然在运行。目前尚不清楚具体有多少设备面临风险，但 Eye Security 表示，截至 3 月份，他们已经“发送了超过 200 万次更新下载”，随后停止了更新发送，并将所使用的域名移交给了网络安全非营利组织 Shadowserver Foundation。