Using this attack we can show fake messages or even do something smarter. “We have injected malicious JavaScript and the client application executed the code. Using the same technique, Charlton could change any other information in Popcorn Time, but chose a method by which he could demonstrate the trick easily. The third mistake is that they make the previous two mistakes in a NodeJS application.”Ĭharlton exploited this vulnerability as a proof-of-concept, performing a “content spoofing” attack which changed the name of movie Hot Pursuit to Hello World: That means, there are no checks in place to ensure the validity of the data received. “The second mistake is that there is no input sanitization whatsoever. That means both the request and the response can be changed by someone with a Man In The Middle position (Local Attacker, Network Administrator, ISP, Government, etc.),” Chariton explained.
“First of all, the request to Cloudflare is initiated over plain HTTP. Popcorn Time uses Cloudflare to bypass ISP-level blocking in the UK – “a really smart” technique, according to Charlton – but the lack of layered security on top of that system is what leaves Popcorn Time open to attack.
“First of all, I know many people who have installed this application on their personal computers and use it, and second of all, by pure accident: I was setting up my computer firewall when I noticed the network traffic initiated by Popcorn Time.” “There are two reasons that made me look into Popcorn Time,” Charlton said. Antonios Chariton (aka ‘DaKnOb’), a Security Engineer & Researcher living in Greece, found the vulnerability in at least one fork of Popcorn Time’s code, and warn users that using the software in its present form could be a risky proposition.
A security engineer has found a vulnerability in popular pirate movie application Popcorn Time that could leave users’ devices open to being hacked by a “man-in-the-middle” attacker.
0 kommentar(er)
