Eye Security Disables Dormant Popcorn Time Updater on Two Million Devices

Eye Security pushed a silent update to disable the dormant updater for the Time4Popcorn application on more than two million devices. The software, a fork of the once-popular Popcorn Time streaming client, had not seen active development for years but remained installed on systems worldwide.

The researchers discovered that the updater continued to contact web domains that had since been abandoned. These connections occurred over unencrypted HTTP and relied on an outdated version of the Chrome browser engine. Niels Teusink of Eye Security stated that the configuration allowed an attacker to install and run nearly any software with full privileges on the host machine.

An adversary could have taken control of a botnet by simply registering one of the abandoned domains. They could also have targeted specific computers using a man-in-the-middle attack or identified which devices were running the software for surveillance purposes. The team noted that the update process was not performing any functional task for the user and was only creating security risks.

To stop the risk, Eye Security registered one of the abandoned domains and delivered an update that instructed the updater to turn itself off. The company acknowledged the ethical concerns of pushing a change without user consent but argued that doing nothing was the only alternative. They emphasized that the process was solely creating risk for users.

On Windows systems, the update stops and disables the service through the Service Control Manager without deleting files. On macOS, a shell script prevents the update process from starting. Android devices were not included in this phase because installing an update there requires direct user action.

The distribution process required adjustments after the team uploaded the update to VirusTotal. Security programs flagged the original file as malware and blocked it, which left the vulnerable updater active on some machines. By March, the company had sent out over two million update downloads before it stopped distributing the patch.

Eye Security subsequently transferred the domains it had used to the Shadowserver Foundation, a web security non-profit. The total number of devices that were originally at risk remains unclear, as the company only confirmed the count of updates delivered before halting distribution.