Eye Security Neutralizes Dormant Time4Popcorn Updater
A global patch was deployed to stop an active, unsecured service that could have compromised millions of idle computers.
By Aiko Yamamoto ·
Eye Security recently completed a global intervention that disabled the background updater for Time4Popcorn, a fork of the once-popular streaming application Popcorn Time. By registering the web domains the service relied upon, the research team delivered a specific command to millions of devices, effectively turning off a component that had been running silently since the software’s development ceased. This action prevents a dormant piece of technology from becoming an active vector for large-scale network attacks.
The underlying issue stems from the fact that while Popcorn Time itself has been unmaintained for years, copies remain installed on a vast number of Windows, macOS, and Android systems. Researchers identified that the Time4Popcorn updater was still communicating with external servers. These connections were made over unencrypted HTTP protocols and utilized an outdated version of the Chrome browser engine, creating a significant security gap that persisted for an extended period.
Niels Teusink of Eye Security explained that the vulnerability allowed an attacker to install and execute any software with full administrative privileges. By seizing control of one of the abandoned domains, a malicious actor could have constructed a botnet from the affected machines. Alternatively, targeted man-in-the-middle attacks could have been used to compromise specific devices, while the presence of the updater provided a way to identify which users still had the software installed.
The decision to intervene was not without ethical complexity. The team acknowledged the difficulty of modifying software on user devices without explicit permission. However, they determined that the update process was non-functional and only created risk, meaning inaction was the only other option. They proceeded to register the domains and push an update that instructed the service to disable itself.
The implementation varied by operating system. On Windows, the update stops the service through the Service Control Manager without deleting files. On macOS, a shell script executes a command to prevent the update process from launching. Android devices were excluded from this round because applying the fix would require direct user interaction, which the automated process could not guarantee.
A technical hiccup occurred when the initial update was uploaded to VirusTotal. Security programs flagged the patch as malware and blocked it, leaving vulnerable machines unprotected until the team adjusted the code. By March, the researchers had distributed over two million update downloads before ceasing distribution. They subsequently transferred the controlled domains to the Shadowserver Foundation, a web security non-profit, to ensure long-term stability.
This event highlights the residual risk of abandoned software that remains active on user devices. As streaming habits evolve, the lifecycle of background services becomes a critical component of digital hygiene. The coordination between researchers and non-profit entities now manages these domains, reducing the immediate threat to the global network.
Source: The Verge
