Leak In Popcorn Time Left To Take Over MITM Attacker Computers

A vulnerability in the popular video streaming service for movies and TV series Popcorn Time made ​​it possible for an attacker to take computers at worst completely. An attacker must in this case be located between the user and the Internet, said researcher Antonios Chariton who discovered the vulnerability.

It involved around two problems. First, it appeared the application over HTTP to connect to the content delivery network (CDN) of CloudFlare. An attacker could via a Man-in-the-middle attack customize the request and from CloudFlare. In addition, the validity of the received data has not been verified. It also showed that this Popcorn Time also made two errors in a NodeJS application.

An attacker could therefore perform cross-site scripting attacks, read files on the computer and eventually execute arbitrary code. In case an attacker is able to increase its local rights, he might even be able to get root privileges on the system. After Chariton Popcorn Time briefed the streaming service came a day later with a solution .

1900 Roku Media Streamers Accessible Via The Internet

Around 1,900 Roku media streamers are publicly available on the Internet, while this probably is not the intention of the owners. The Roku is actually a small computer for streaming media such as music and movies to a television and especially in the US very popular .

The device features an API (application programming interface) to be controlled via a smartphone. This is to not use any form of authentication. The idea behind the API is that it is applied locally use only and can not be accessed over the internet.Recently discovered a researcher to incorrectly set Roku media streamers are indeed accessible via the internet and that anyone who can give commands via the API.

John Matherly search engine Shodan therefore decided to scan the Internet, the number of Roku media streamers which is accessible via the web. His scan yielded some 1,900 devices. Matherly according to the number, however, differ depending on the time zone that the scan is performed. Using the scan was also discovered which several Roku media streamers are using it, which versions are installed, Netflix is the most popular channel and that many users do not update the apps and channels on their device.