Eye Security Halts Dormant Popcorn Time Updater to Prevent Botnet Threat

For over a decade, Popcorn Time served as a popular interface for streaming movie and television torrents, a tool that frequently clashed with the Motion Picture Association of America. Although the project has lacked active development for years, copies of the software remain on millions of devices, creating a latent security risk that researchers recently addressed.

The core issue involved the update mechanism for a specific fork of the software known as Time4Popcorn. Specialists at Eye Security discovered that this updater was still active on numerous Windows, macOS, and Android systems globally. The component reached out to web domains that had been abandoned by their original owners. It communicated over unencrypted HTTP and depended on an old, insecure version of Chrome to function.

Niels Teusink of Eye Security described the vulnerability as significant. The updater had the capability to install and execute nearly any software with full administrative privileges. A malicious actor could have formed a botnet simply by seizing control of one of the defunct domains. Alternatively, an attacker could have targeted specific machines through a man-in the middle attack. The gap also allowed for surveillance, as it would have been possible to identify exactly which devices were running the software.

To mitigate the risk, the research team registered one of the abandoned domains themselves. They used this domain to push an update that instructed the updater to disable itself. The researchers acknowledged the ethical complexity of modifying software on user devices without direct permission. However, they stated that the only other option was to leave the risk in place. They added that the update process was no longer serving a functional purpose and was instead generating risk for users.

The implementation of the fix varied by operating system. For Windows, the update stopped the service through the Service Control Manager and disabled it. This method did not delete files or alter other parts of the system. On macOS, a shell script executed a command to prevent the update process from launching. The team did not address Android devices in this specific fix, as applying an update on that platform would still require manual action from the user.

The rollout encountered a technical hurdle. After the team uploaded the update file to VirusTotal, various security programs identified the original file as malware. These programs then blocked the fix, which left the vulnerable updater active on those particular machines. The team had to adjust the update file to bypass these detections and ensure the patch reached the intended devices.

The total number of vulnerable devices remains unknown. Eye Security reported that it distributed over 2 million update downloads by March. At that point, the company stopped sending out the update. The organization subsequently transferred the domains it had temporarily held to the Shadowserver Foundation, a non-profit organization focused on web security.

This incident highlights the ongoing security challenges posed by abandoned software that remains installed on user devices. While the immediate threat from the Time4Popcorn updater has been neutralized on many systems, the case underscores the potential for dormant components to become entry points for large-scale attacks.

The response by Eye Security offers a model for handling such legacy issues. By taking control of the communication channels and delivering a targeted patch, the researchers were able to reduce the attack surface without forcing users to uninstall the application entirely. This approach balances the need for security with the practical realities of user behavior and software dependency.