Eye Security shuts down dormant Popcorn Time updater

A quiet threat lurked on millions of computers and phones around the world. Popcorn Time, a popular streaming tool from the 2010s, has not been updated in years. Yet the software remained installed on many machines. Researchers warned that these abandoned devices were prime targets for hackers looking to build a botnet. The risk was high because the software's update mechanism was still active and exposed.

The vulnerability centered on a specific fork of the program called Time4Popcorn. This version ran on Windows, macOS, and Android systems. The updater checked in with web servers that had been left unmanaged. It did so over unencrypted connections. It also relied on an old and insecure version of the Chrome browser. These factors combined to create a significant security gap.

Niels Teusink of Eye Security described the weakness as serious. An attacker could have installed any software with full privileges on these machines. They could have simply taken over one of the abandoned domains to recruit the devices into a botnet. Alternatively, they could have targeted specific machines using a man-in-the-middle attack. Hackers could also have identified which users were running the software for surveillance purposes.

The research team decided to act before the threat became real. They registered one of the abandoned domains themselves. They then delivered a special update to the devices. This update instructed the updater to disable itself. The team acknowledged ethical questions about intervening in this way. They noted that doing nothing was the only other option. They also pointed out that the update process was not providing any functional benefit and was only adding risk.

The fix varied by operating system. On Windows, the update stopped the service through the Service Control Manager. It did not delete any files or make other changes. On macOS, a shell script ran a command to prevent the update process from starting. Android devices were not included in the initial fix. Installing an update on those phones required manual action from the user, which made the process less straightforward.

The team faced a technical hurdle during the rollout. They uploaded the update to VirusTotal for testing. Security programs flagged the original file as malware. This caused those security tools to block the update. As a result, the vulnerable updater remained active on those specific machines. The researchers had to adjust the update to fix this issue.

The total number of affected devices remains unclear. Eye Security reported sending out over two million update downloads. They stopped distributing the update by March. The company then transferred the domains it had used to the Shadowserver Foundation. This web security non-profit will manage the domains going forward. The move ensures the update mechanism remains disabled for all connected devices.