Millions of Devices at Risk Prompt Shutdown of Dormant Streaming Updater
Security researchers have moved to neutralize a lingering software component from a defunct torrent application to prevent it from being used to compromise vulnerable machines.
By Lina Lewis ·
More than 2 million update packages were distributed by security firm Eye Security in an effort to disable a dormant software component tied to the defunct Popcorn Time application. The initiative targeted a specific updater associated with a version called Time4Popcorn, which remained active on numerous Windows, macOS, and Android devices worldwide. While the original movie and TV streaming client fell into disuse years ago, the lingering software infrastructure created a significant security gap that researchers moved to close.
The timeline of this vulnerability begins with the 2010s, when Popcorn Time drew significant attention from the Motion Picture Association of America for allowing users to stream torrents. Although development on the application eventually stopped, millions of installations remained on devices. According to researchers from Eye Security, the updater for the Time4Popcorn fork continued to reach out to web domains that had since been abandoned. These connections were made over unencrypted HTTP and relied on an outdated, insecure version of Chrome, leaving devices exposed.
Niels Teusink of Eye Security stated that the weakness was serious. Because the updater could install and run software with full privileges, the vulnerability posed a severe threat. An attacker could have seized one of the abandoned domains to install malware, or engaged in a man-in-the-middle attack to target specific devices. The situation also posed a surveillance risk, as the activity of machines running the software could be identified and monitored.
Faced with the potential for a botnet, researchers decided to intervene. They registered one of the abandoned domains themselves and used it to issue an update instructing the updater to disable itself. The team acknowledged ethical concerns regarding this approach but argued that the alternative was to do nothing. They further noted that the update process wasn't doing anything functional anyway, it was only creating risk for users.
The method for disabling the software varied by operating system. On Windows, the update simply stops and disables the service via the Service Control Manager, leaving files and other settings intact. On macOS, a shell script executes a command preventing the update process from starting. However, Android devices were not addressed in this effort, because installing an update on those devices would still require action from the user.
The research team encountered difficulties in distributing the solution. After uploading the file to VirusTotal, security programs flagged the original update as malware and blocked it. This response left vulnerable updaters running on machines protected by those security programs. Consequently, Eye Security adjusted its update to bypass these protections. The total number of devices at risk remains unclear, though Eye Security sent out over 2 million update downloads by March.
Following the distribution window, Eye Security transferred the domains used in the operation to the Shadowserver Foundation, a non-profit organization dedicated to web security. This transfer effectively hands over the infrastructure associated with the vulnerability to a group focused on internet safety, concluding the active phase of the neutralization effort.
