BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//hack-lu-2026//speaker//FZ8PJL
BEGIN:VTIMEZONE
TZID:Europe/Luxembourg
BEGIN:DAYLIGHT
DTSTART:20251022T000000
TZNAME:CEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T030000
RDATE:20261025T030000
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T030000
RDATE:20270328T030000
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Operation IXIM: Preventing a botnet of millions of PopCorn Time us
 ers - Niels Teusink
DTSTART;TZID=Europe/Luxembourg:20261022T170000
DTEND;TZID=Europe/Luxembourg:20261022T173000
DTSTAMP:20261009T050055Z
UID:pretalx-hack-lu-2026-FAGXJE@pretalx.com
DESCRIPTION:PopCorn Time was once one of the most popular BitTorrent strea
 ming clients in the world. While the software has been abandoned for years
 \, one of the forked versions (Time4Popcorn) has an update mechanism that 
 never stopped running. During routine threat hunting\, we discovered that 
 millions of systems worldwide still have the updater process running in th
 e background\, connecting to domains that were no longer registered.\n\nIn
 trigued\, we registered one of these domains and were shocked to discover 
 the number of requests that started pouring in every second. Over several 
 months\, we observed millions of unique hardware IDs across various platfo
 rms.\nAfter taking a closer look at the closed-source updater binaries\, w
 e confirmed the worst: the update mechanism is horribly insecure. Anyone w
 ho registered the right domain could instantly compromise millions of mach
 ines\, including systems on government\, military\, and corporate networks
 . This vulnerability was assigned CVE-2026-30612.\n\nSince taking over all
  domains was not viable\, we were faced with an unprecedented decision: do
  nothing and leave millions at risk or take matters into our own hands. Jo
 in our talk to find out what we did and why.
LOCATION:Europe
URL:https://pretalx.com/hack-lu-2026/talk/FAGXJE/
END:VEVENT
END:VCALENDAR