Eye Security Forces Dormant Time4Popcorn Updater to Stop on Two Million Devices

A dormant software component for the movie streaming app Popcorn Time posed a hidden risk to millions of computers until security researchers intervened. The updater for a fork known as Time4Popcorn remained active on Windows, macOS, and Android systems, maintaining contact with web servers that were no longer maintained. This connection created a pathway for attackers to potentially seize control of these machines.

The vulnerability operated over unencrypted HTTP and relied on an outdated version of Chrome. Researchers from Eye Security determined that the updater could install and run software with full privileges. An attacker who took over one of the abandoned domains could have built a botnet or used man-in-the-middle attacks to target specific devices. They could also identify which machines were running the software to enable surveillance.

Niels Teusink of Eye Security described the weakness as serious due to the level of access it granted. The team decided to register one of the abandoned domains themselves to deliver an update that told the updater to disable itself. They acknowledged the ethical concerns of taking this step but stated that the alternative was to do nothing. They noted that the update process was not performing any functional role and was only creating risk for users.

The implementation varied by operating system. On Windows, the update stops and disables the service via the Service Control Manager without deleting files. On macOS, a shell script prevents the update process from starting. Android devices were not addressed in this specific update because installing a patch there would still require action from the user. The team had to adjust the update after uploading it to VirusTotal, as security programs flagged the original version as malware and blocked it.

By March, Eye Security sent out over two million update downloads before stopping the distribution. The company then transferred the domains it had used to the Shadowserver Foundation, a web security non-profit. The total number of devices that were at risk remains unclear, though the scale of the distribution indicates a widespread installation base.

The intervention ended the active threat posed by the abandoned updater on the systems that received the patch. The domains now belong to a non-profit organization dedicated to web security. The software components on the devices are no longer contacting external servers to check for updates.