Eye Security forces dormant Popcorn Time updater offline

A hidden update service for an old movie streaming app has been shut down to prevent attackers from controlling millions of computers.

Eye Security researchers identified that the updater for Time4Popcorn, a fork of the Popcorn Time streaming client, remained active on many devices. The company reported that it distributed more than two million update downloads by March of this year. These updates instructed the software to stop running automatically in the background.

The vulnerable software had been installed on Windows, macOS, and Android systems. The updater communicated with web domains that were no longer in use. It sent data over unencrypted HTTP connections and relied on an old, insecure version of the Chrome browser. Niels Teusink of Eye Security stated that this setup allowed an attacker to install and run nearly any software with full privileges. An attacker could have built a botnet by taking over one of the abandoned domains. Targeted attacks via man-in-the-middle techniques and device surveillance were also possible.

The security team registered one of the abandoned domains to send the disabling update. They acknowledged ethical concerns about modifying software without user consent. However, the group noted that the only alternative was to do nothing. Teusink added that the update process was not performing any functional task and was only creating risk for users.

The Windows update stops and disables the service through the Service Control Manager. It does not delete files or make other system changes. On macOS, a shell script runs a command that prevents the update process from starting. The team did not address Android devices because installing an update there would require manual user action.

The team adjusted the update after uploading it to VirusTotal. Security programs flagged the original file as malware and blocked it, which left the vulnerable updater running on those machines. Eye Security later transferred the domains it used to the Shadowserver Foundation, a web security non-profit.