Eye Security Researchers Shut Down Active Popcorn Time Updater to Prevent Botnet Formation

Eye Security researchers have successfully disabled a dormant software updater associated with Popcorn Time, a once-popular streaming application for movies and TV shows. The team acted to neutralize a potential threat that could have allowed attackers to recruit millions of computers into a botnet. By taking control of abandoned web domains, the researchers delivered a specific update designed to stop the vulnerable process on affected devices. This move addresses a security gap that persisted for years after the original software lost active development.

The software in question is a fork of Popcorn Time known as Time4Popcorn. Although the app has not been updated in years, copies remain installed on a vast number of Windows, macOS, and Android systems. The specific vulnerability lay in the background updater, which continued to check for new versions. It did so by connecting to web domains that were no longer maintained. These connections occurred over unencrypted HTTP protocols and relied on an outdated and insecure version of the Chrome browser engine.

Niels Teusink of Eye Security described the weakness as significant. The updater had the capability to install and execute nearly any software with full privileges. This meant an attacker could have easily built a botnet by purchasing one of the abandoned domains. Alternatively, they could have targeted specific machines through a man-in-the-middle attack. The exposure also allowed for potential surveillance by identifying which devices were still running the software in the background.

To fix the issue, the researchers registered one of the abandoned domains themselves. They used this control to push an update that instructed the updater to disable itself. Teusink acknowledged the ethical complexities of modifying a system without user consent. However, he noted that the alternative was simply doing nothing. He emphasized that the update process was not performing any functional tasks for users. Instead, it was solely creating risk by maintaining an active connection to vulnerable servers.

The implementation details varied by operating system. On Windows, the update stops and disables the service through the Service Control Manager. It does not delete files or make other significant changes to the system. For macOS users, a shell script runs a command that prevents the update process from starting. The team did not address Android devices in this intervention. This was because installing an update on that platform would still require direct action from the user, making a silent fix impossible.

The rollout of the fix faced a technical hurdle. After the team uploaded the initial version of the update to VirusTotal, security programs flagged it as malware. This caused those systems to block the update, leaving the vulnerable updater active on those machines. The researchers had to adjust the update package to bypass these false positives. This ensured that the fix could reach the intended devices without being intercepted by antivirus software.

The total number of devices at risk remains unclear. However, Eye Security reported sending out over two million update downloads by March of this year. The company stopped distributing the update at that time to allow the process to stabilize. Following the intervention, the team transferred the domains they had used to the Shadowserver Foundation. This web security non-profit will now manage the addresses, ensuring the updater remains disabled for future installations.

This incident highlights the lingering security risks of abandoned software. Even when an application is no longer developed, its background components can continue to pose threats. The proactive approach by Eye Security serves as a case study in managing legacy code vulnerabilities. It also underscores the importance of monitoring inactive services that may still hold keys to user systems. The resolution of this specific threat reduces the immediate risk of a large-scale botnet emerging from this particular software fork.