Tashlab qo'yilgan Popcorn Time ilovasi millionlab qurilmalarni RCE hujumlariga duchor qildi
Bill Toulas tomonidan
2026-yil 23-oktabr
16:55
0
Tadqiqotchilar tashlab qo'yilgan Time4Popcorn ilovasidagi zaif yangilovchini masofadan o'chirib qo'yishdi. Bu Popcorn Time BitTorrent mijozining bir tarmog'i bo'lib, millionlab kompyuterlarda yuqori imtiyozlar bilan zararli kodni bajarishga imkon beradigan xavfsizlik zaifligini yopdi.
CVE-2026-30612 sifatida kuzatilgan zaiflik Windows va macOS yangilovchilariga ta'sir qiladi. Ular ilovaning tashlab qo'yilgan domeniga (popcorntimeupd.xyz) shifrlanmagan HTTP orqali murojaat qilgan va raqamli imzolarni tekshirmasdan bajariladigan fayllarni qabul qilgan.
Yangilash domenini nazorat qilgan har kim HTTP trafikni manipulyatsiya qilib, Windows'da SYSTEM sifatida va macOS'da root sifatida kodni bajarishi mumkin edi.
Popcorn Time ilovasi Netflix uslubidagi interfeysga ega bo'lib, BitTorrent yuklab olishlarini integratsiya qilgan va foydalanuvchilarga noqonuniy kontentni to'g'ridan-to'g'ri ilova ichida iste'mol qilish imkonini bergan.
Loyihani qonuniy sabablarga ko'ra tashlab qo'yishgan, keyin esa qonuniy kontent-striming ilovasi sifatida qayta ishga tushirishgan. Biroq Time4Popcorn kabi tarmoqlar Popcorn Time nomi ostida paydo bo'lib, tezda millionlab foydalanuvchilarni jalb qilgan.
Eye Security tadqiqotchilari popcorntimeupd.xyz domenini ro'yxatdan o'tkazgandan so'ng xavfsizlik xavfini aniqlashdi va Time4Popcorn'ga Windows'dan 3 milliongacha va macOS'dan 350 000 gacha mijoz ulanishlarini kuzatishdi.
Time4Popcorn foydalanuvchilarining joylashuvi Manba: Eye Security
Ulanishlar turar-joy ISP'laridan hamda korporativ, davlat va harbiy tarmoqlardan kelgan. Biroq foydalanuvchilarning hech biri ilovani faol ishlatmayotganga o'xshardi, bu esa uning o'rnatilgan va unutilganligini ko'rsatadi.
"Agar biz yangilashni yubora olsak, millionlab tizimlarda kod bajarish imkoniyatiga ega bo'lar edik," deb ta'kidlaydi Eye Security, "agar bu noto'g'ri qo'llarga tushsa, ta'sir jiddiy bo'lar edi."
Ushbu kashfiyotdan so'ng tadqiqotchilar xizmat bilan bog'liq yana 14 ta domenni ro'yxatdan o'tkazishdi.
Tizimlarni himoyalash
2025-yil noyabr va 2026-yil mart oylari orasida Eye zaif yangilash mexanizmidan foydalanib, yangilovchini to'xtatib va o'chirib qo'yadigan tuzatish kodini yetkazib berdi.
Ularning yuklamasi hech qanday xost ma'lumotlari yoki telemetriyani to'plamagan va foydalanuvchilarning kompyuterlaridan hech qanday faylni o'chirmagan, bu esa ularning harakatlarini to'liq qonuniy kontekstda saqlagan.
Eye tushuntirishicha, sinov paytida antivirus mahsulotlari xizmatni o'chirish uchun uni belgilaganligi sababli yuklamani o'zgartirishga majbur bo'lishgan.
Tuzatish joylashtirilgandan so'ng Eye 2 million yangilash yuklab olishlarini qayd etdi va joriy yilning 1-martiga kelib yangilash domeniga so'rovlar 98% ga kamaydi.
Tuzatish operatsiyasi muvaffaqiyatli yakunlangandan so'ng domen egaligi notijorat xavfsizlik tashkiloti The Shadowserver Foundation'ga topshirildi.
Ushbu muvaffaqiyatga qaramay, tadqiqotchilar ilova foydalanuvchilari uchun xavf to'liq bartaraf etilmaganligi haqida ogohlantirishdi.
Birinchidan, Android foydalanuvchilari hali ham ochiq qolmoqda, chunki yangilashni o'rnatish foydalanuvchi o'zaro ta'sirini talab qiladi va tadqiqotchilar mobil platforma uchun yangilovchini masofadan o'chira olishmadi.
Ikkinchidan, Time4Popcorn ilovasi 2014-yildan qolgan jiddiy eskirgan Chrome dvigatelidan foydalanadi, hech qanday sandbox himoyasi yo'q, bu esa hujumlarda ishlatilishi mumkin.
Eng yaxshi yo'l foydalanuvchilar uchun dasturiy ta'minotni tizimlaridan butunlay o'chirish bo'ladi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% i bloklanadi Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda oldini olish keskin pasayadi. Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi. Hisobotni oling Tegishli maqolalar: Ochiq GitLab loyihasi elektron pochta manzillari hujumchilarga kodni yuborish imkonini beradi IPTV xizmatlarini pirat qilish orqali 1,3 million dollar topgan 68 yoshli shaxs qamoqqa olindi
Abandoned Popcorn Time app exposed millions of device to RCE attacks
By Bill Toulas
October 23, 2026
04:55 PM
0
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers.
The vulnerability, tracked as CVE-2026-30612, affects Windows and macOS updaters that contacted the app's abandoned domain (popcorntimeupd.xyz) over unencrypted HTTP and accepted executables without verifying digital signatures.
Anyone controlling the update domain could manipulate HTTP traffic and execute code as SYSTEM on Windows and as root on macOS.
The Popcorn Time app featured a Netflix-style interface that integrated BitTorrent downloads, allowing users to consume illegal content right directly inside the app.
The project was abandoned for legal reasons but later relaunched as a legitimate content-streaming app. However, forks such as Time4Popcorn emerged under the Popcorn Time name, quickly attracting millions of users.
Researchers at Eye Security discovered the security risk after registering the popcorntimeupd.xyz domain and observed up to 3 million Windows and 350,000 macOS client connections to Time4Popcorn.
Location of Time4Popcorn users
Source: Eye Security
Connections came from residential ISPs and corporate, government, and military networks. However, none of the users appeared to be actively using the app, suggesting it had been installed and forgotten.
“If we were able to send an update, we could potentially get code execution on millions of systems,” Eye Securit notes, adding that “the impact would be severe if this were to fall into the wrong hands.”
Following this discovery, the researchers registered 14 more domains associated with the service.
Securing the systems
Between November 2025 and March 2026, Eye used the vulnerable update mechanism to deliver remediation code that stopped and disabled the updater.
Their payload collected no host data or telemetry, and deleted no files on the users’ computers, keeping their actions within a fully legal context.
Eye explains that it had to modify its payload during testing to evade antivirus products that flagged it for disabling a service.
After deploying the remediation, Eye recorded 2 million update downloads, and by March 1 this year, requests to its update domain dropped by 98%.
Following the successful completion of the remediation operation, domain ownership was passed to the non-profit security organization The Shadowserver Foundation.
Despite this success, the researchers warned that the risk is not fully eliminated for users of the app.
First, Android users remain exposed as installing an update would require user interaction, and researchers could not disable the updater remotely for the mobile platform.
Second, the Time4Popcorn app uses a severely outdated Chrome engine from 2014, with no sandbox protections, which could be exploited in attacks.
The best course of action would be for users to remove the software entirely from their systems.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Related Articles:
Exposed GitLab project email addresses let attackers push code
68-year-old imprisoned after making $1.3 million by pirating IPTV services