Legacy Streaming Risk: Silent Update Stops Dormant Botnet Threat
Eye Security disabled an active updater for the abandoned Popcorn Time app, affecting over 2 million devices.
By Larissa Shah ·
A dormant software updater that posed a botnet risk has been permanently disabled on millions of computers.
Popcorn Time, a streaming tool for movie and TV torrents, stopped receiving development years ago. The MPAA targeted the service in the 2010s, but copies remain installed on many Windows, macOS, and Android devices. Researchers identified that a specific fork called Time4Popcorn still had an active updater on these machines.
The updater contacted abandoned web domains using unencrypted HTTP and relied on an outdated version of Chrome. Niels Teusink from Eye Security explained that this configuration allowed attackers to install software with full privileges. An adversary could have recruited devices into a botnet by taking over one of the abandoned domains. Alternatively, a man-in-the-middle attack could have targeted specific machines, and surveillance was possible by identifying which devices ran the software.
Eye Security engineers registered one of the abandoned domains to deliver a final update. This update instructed the updater to disable itself. The team acknowledged ethical concerns about the method but stated that doing nothing was the only alternative. They noted that the update process was not functional and only created risk for users.
The Windows update stops and disables the service via the Service Control Manager without deleting files. On macOS, a shell script prevents the update process from starting. Android devices were excluded because the update would require manual user action. The team adjusted the update after it was flagged as malware by security programs on VirusTotal, which had blocked the original version.
Eye Security sent out over 2 million update downloads by March before stopping distribution. The company then transferred the domains it had used to the Shadowserver Foundation, a web security non-profit. The total number of devices at risk remains unclear, but the active threat from the updater has been neutralized for the targeted platforms.
