Millions of PCs at Risk from Abandoned 'Piracy Netflix'

Millions of Windows, macOS, and Android devices are unknowingly running vulnerable, abandoned software, according to recent research. The updater for a Popcorn Time fork, once notorious as the 'Netflix of Piracy,' continues to operate on these machines. This outdated component connects via unencrypted HTTP to defunct domains, posing a significant security risk.

Researchers from Eye Security found that this updater could be exploited to install arbitrary software with full privileges. This vulnerability could enable attackers to easily establish botnets or conduct surveillance on targeted devices. The team took the unusual step of registering one of the abandoned domains.

They then deployed their own update instructing the vulnerable updater to disable itself, thereby neutralizing the threat. This ethical intervention was deemed necessary as the only alternative was inaction. The update service was effectively defunct, only posing a risk to users by its mere existence. The researchers successfully pushed over two million update downloads before transferring the domains to a security non-profit.