Eye Security disables dormant Popcorn Time updater to neutralize botnet risk

Eye Security, a web security firm, executed a proactive takedown of a dormant software component associated with the streaming application Popcorn Time. The company registered abandoned web domains to push a final update that disables the automatic updater on millions of devices. This move was designed to eliminate a significant supply chain vulnerability that could have allowed attackers to recruit these machines into a large scale botnet.

The issue traces back to a fork of the original Popcorn Time software known as Time4Popcorn. While the original service gained notoriety in the 2010s for its torrent based streaming features and its conflict with the MPAA, development has ceased for years. Despite the lack of maintenance, copies of the software remain installed on a vast number of Windows, macOS, and Android systems worldwide. The core problem lay in the updater service, which continued to communicate with web servers that had been left unattended by their owners.

The technical architecture of this updater presented several critical weaknesses. It transmitted data over unencrypted HTTP protocols, leaving the communication open to interception. Furthermore, it relied on an outdated and insecure version of the Chrome browser engine. Niels Teusink of Eye Security described the weakness as severe, noting that the updater had the capability to install and execute practically any software with full system privileges. This level of access meant an attacker could have easily established a foothold on these devices.

The threat model included two primary attack vectors. First, an adversary could have simply taken over one of the abandoned domains, thereby gaining control over the update process for all connected clients. Second, a man in the middle attack could have allowed for targeted compromises of specific devices. Additionally, the active communication provided a method for surveillance, enabling attackers to identify exactly which machines were still running the legacy software.

In March of this year, the researchers decided to intervene. They registered one of the abandoned domains and deployed a new update package. This update instructed the local updater service to disable itself. The team acknowledged the ethical complexities of pushing an update without the original developer's consent. However, they stated that the alternative was to do nothing, leaving users exposed. They also pointed out that the update process was no longer functional in any useful way and was primarily a source of risk.

The implementation of the fix varied by operating system. For Windows devices, the update used the Service Control Manager to stop and disable the service. This approach did not delete files or make other significant changes to the system. On macOS, a shell script executed a command to prevent the update process from starting. Android devices were left unaddressed in this specific campaign because pushing an update to those mobile devices would still require manual action from the user to complete the process.

The rollout encountered unexpected hurdles. After the researchers uploaded the update to VirusTotal, a popular online scanning service, security programs flagged the original file as malware. Consequently, many systems blocked the update before it could run. This left the vulnerable updater active on those machines, requiring the team to adjust the update to bypass these automatic blocks.

The scale of the exposure remains difficult to pinpoint with precision. Eye Security reported that it sent out over two million update downloads before ceasing distribution in March. Following the completion of the operation, the company transferred the domains it had used to the Shadowserver Foundation. This non profit organization specializes in web security and will now monitor the infrastructure to ensure the risk does not return.

The incident highlights the financial and operational risks associated with abandoned software products. For working families and businesses that rely on older tech stacks, dormant updaters can act as silent liabilities. By taking control of the update channel, Eye Security effectively closed a backdoor that had been left open for years. The move underscores the growing importance of managing the end of life for digital tools to protect user data and system integrity.