Popcorn Time, a popular application used for downloading and streaming pirate movies, could be vulnerable to a hack that could allow criminals to execute code remotely on a target machine.
A blog post by Greek security researcher Antonios Chariton demonstrated how a hacker “can get complete control of a computer assuming they have a Man In The Middle position in the network.”
The hack is based on the way Popcorn Time circumvents blocks placed by ISPs on pirated content. The application connects to CloudFlare instead. This means if the ISP wanted or needed to block Popcorn Time, it would have to ban CloudFlare. However, as millions of websites rely on CloudFlare’s cloud-based caching technology, this is not something that ISPs would easily embark on.
The real problem is that the connection to CloudFlare is made over HTTP instead of HTTPs.
“HTTP is insecure,” said Chariton. “There’s nothing you can do to change this. Please, use HTTPS everywhere, especially in applications that don’t run inside a web browser.”
“Second, sanitise your input. Even if you receive something over TLS v1.2 using a Client Certificate, it still isn’t secure! Always perform client-side checks of the server response,” he added.
Chariton said it took around an hour to find the flaw, devise a means of exploiting it and writing the necessary code to do so.
view the full story here
