Leak In Popcorn Time Left To Take Over MITM Attacker Computers

A vulnerability in the popular video streaming service for movies and TV series Popcorn Time made ​​it possible for an attacker to take computers at worst completely. An attacker must in this case be located between the user and the Internet, said researcher Antonios Chariton who discovered the vulnerability.

It involved around two problems. First, it appeared the application over HTTP to connect to the content delivery network (CDN) of CloudFlare. An attacker could via a Man-in-the-middle attack customize the request and from CloudFlare. In addition, the validity of the received data has not been verified. It also showed that this Popcorn Time also made two errors in a NodeJS application.

An attacker could therefore perform cross-site scripting attacks, read files on the computer and eventually execute arbitrary code. In case an attacker is able to increase its local rights, he might even be able to get root privileges on the system. After Chariton Popcorn Time briefed the streaming service came a day later with a solution .

Popcorn Time Warns Consumers For False Sites

The popular video streaming service for movies and TV series Popcorn Time has users warned of the "competition" that offer scams, not working programs and even malware. Popcorn Time can be found on various websites, including PopcornTime.io and PopcornTime.se .

The original software was created by a group of developers from Argentina, who last March stopped it. A number of other development teams decided to take the original source code and themselves develop. This "forks" but are still under the name Popcorn Time. Thus, on Popcorntime.io offered a free open source version of the original Popcorn Time. Another variant of Popcorn Time is via Popcorn-time.se to download.

Now warns PopcornTime.io however there are numerous websites that are almost identical in appearance to the website of Popcorntime.io but contain advertisements or pay a monthly amount. According to the developers, the "Popcorn Time" brand by many malicious characters used to make money. It may involve websites that offer non-working software, but some of these sites distribute malware. Therefore, the developers have put some links online so consumers can check whether they are in the right website. In addition, there is also created a flow diagram which should help in making the right choice.