Eye Security Pushes Self-Disabling Patch to 2 Million Computers Running Abandoned Movie App
The update targets a dormant updater for Time4Popcorn that maintained active connections to abandoned domains via unencrypted traffic, leaving systems exposed to potential remote compromise.
By Ahmed Peterson ·
For years, copies of the Popcorn Time streaming client have lingered on user devices, even as development on the project ceased. Security researchers recently identified that a specific fork of the software, known as Time4Popcorn, retained an active updater on a global scale. This residual functionality created a silent channel between millions of Windows, macOS, and Android machines and a series of abandoned web domains.
Niels Teusink of Eye Security described the vulnerability as severe because the updater communicated over unencrypted HTTP and relied on an outdated version of Chrome. He explained that an attacker who seized control of one of the dormant domains could install arbitrary software with full privileges. The flaw also allowed for targeted man-in-the-middle attacks or passive surveillance of which devices were running the legacy software.
To mitigate the risk, Eye Security registered one of the abandoned domains themselves. They used this domain to distribute a patch instructing the updater to disable itself. Teusink noted that the team faced ethical questions about this intervention but stated the alternative was to do nothing. He added that the update process was not providing any functional benefit to users, only generating exposure to risk.
The implementation varied by operating system. On Windows, the update stopped and disabled the service through the Service Control Manager without deleting files. On macOS, a shell script executed a command to prevent the update process from starting. Android devices were excluded from the initial rollout because applying the fix would require manual user action.
The distribution process encountered technical obstacles. When the team uploaded the update to VirusTotal, security programs flagged the file as malware and blocked it. This caused the vulnerable updater to remain active on affected machines until the team adjusted the code to bypass the detection.
Eye Security reported sending over two million update downloads by March, at which point they ceased distribution. The company subsequently transferred the domains they had registered to the Shadowserver Foundation, a non-profit dedicated to web security. The total number of devices at risk remains unconfirmed due to the decentralized nature of the software installation.
Source: The Verge
