Eye Security disables dormant Popcorn Time updater to stop botnet risk

Eye Security researchers disabled a dormant software updater on millions of devices this week. The move prevents a potential botnet from forming on machines running a fork of the old Popcorn Time streaming app. The team acted after finding the updater was still active on Windows, macOS, and Android systems.

The Popcorn Time project has lacked development for years, yet copies of the software remain installed on many computers. The specific fork, Time4Popcorn, used an updater that contacted web domains over unencrypted HTTP. These domains had been abandoned by their original owners. The updater also relied on an outdated version of Chrome.

Niels Teusink of Eye Security stated the weakness was serious. An attacker who took control of one of the abandoned domains could have installed and run any software with full privileges. This would have allowed the creation of a botnet or targeted surveillance of specific devices. Teusink noted that identifying which machines were running the software would have been possible through the active connection.

The researchers registered one of the abandoned domains themselves. They used it to deliver an update that instructed the updater to disable itself. The team acknowledged ethical concerns about modifying software without user consent. They said the only alternative was to do nothing, arguing that the update process was not doing anything functional and was only creating risk for users.

The update worked differently across operating systems. On Windows, the update stops and disables the service via the Service Control Manager without deleting files. On macOS, a shell script runs a command that prevents the update process from starting. Android devices were not addressed because installing an update there would still require action from the user.

Security programs initially flagged the original update as malware after the team uploaded it to VirusTotal. This blocked the update on many machines, leaving the vulnerable updater active. The team adjusted the update to resolve the issue. By March, Eye Security had sent out over 2 million update downloads before stopping distribution.

The total number of devices at risk remains unclear. Eye Security has transferred the domains it used to the Shadowserver Foundation, a web security non-profit. The project ended once the updates were distributed and the domains were handed off.