Researchers silence dormant app on two million computers
A security team pushed a quiet patch to stop an abandoned movie streaming tool from being hijacked into a botnet.
By Jason Kovalenko ·
Security researchers have pushed a silent update to more than two million devices running an old version of a movie streaming app, effectively cutting off its connection to the internet. The move, carried out by the firm Eye Security, disables a dormant updater for Time4Popcorn, a fork of the once-popular Popcorn Time platform. The company confirmed the update was distributed by March of this year, though the exact total number of affected machines remains unknown.
Popcorn Time gained a reputation in the 2010s as a tool for streaming torrents of films and television shows, drawing complaints from the Motion Picture Association of America. Development on the project stopped years ago, yet copies of the software persist on millions of Windows, macOS, and Android systems. Eye Security discovered that the updater for the Time4Popcorn variant remained active. It contacted web domains that had been left unmanaged and communicated over unencrypted HTTP. The process also relied on an outdated, insecure version of the Chrome browser engine.
Niels Teusink of Eye Security described the vulnerability as severe. The updater had the capability to install and execute nearly any software with full administrative privileges. An attacker could have seized control of the abandoned domains to recruit these machines into a botnet. Alternatively, they could have targeted specific users through man-in-the-middle attacks or monitored which computers were running the software to track their locations.
To mitigate the risk, the researchers registered one of the abandoned domains themselves. They used it to send a command instructing the updater to turn itself off. The team acknowledged the ethical dilemma of pushing software onto user devices without explicit permission. They noted that the only other option was to take no action. Teusink stated that the update process "wasn't doing anything functional anyway, it was only creating risk for users."
The implementation required technical adjustments. On Windows systems, the update stops the service through the Service Control Manager without deleting files. On macOS, a shell script prevents the process from starting. Android devices were excluded because the update would have required manual user interaction. The team initially uploaded the patch to VirusTotal, but security software flagged it as malware and blocked it. This forced the researchers to modify the update to ensure it would not be intercepted by antivirus programs.
After distributing the updates, Eye Security transferred the control of the domains to the Shadowserver Foundation, a non-profit organization focused on web security. The foundation will now manage the infrastructure. The company ceased distributing the update in March after sending out over two million downloads. The dormant updater no longer communicates with the internet on the patched systems.
The intervention leaves the software installed on the devices but silent. Users on Windows and macOS do not need to take further action. The Android version of the updater remains active because it lacks a remote kill switch. The Shadowserver Foundation will monitor the domains for any future activity.
