Security Team Halts Old App Updater

Eye Security researchers disabled a dormant software updater to prevent the formation of a large-scale botnet.

Popcorn Time, a streaming application for torrented movies and television, ceased development years ago but remained installed on millions of computers. The specific vulnerability existed in a fork of the software called Time4Popcorn. Its updater component continued to run on Windows, macOS, and Android systems worldwide. The updater contacted web domains that were no longer maintained. These connections occurred over unencrypted HTTP protocols. The process also utilized an outdated version of the Chrome browser.

Niels Teusink of Eye Security described the security flaw as severe. An attacker could have installed arbitrary software with full privileges on connected machines. Taking control of one of the abandoned domains would have allowed the creation of a botnet. Alternatively, attackers could have targeted specific devices through man-in-the-middle attacks or identified users through surveillance. The researchers registered one of the abandoned domains to deliver a custom update. This update instructed the software to disable itself. Teusink noted that the only other option was to take no action. He added that the update process served no functional purpose and only created risk for users.

The implementation varied by operating system. On Windows, the update stopped and disabled the service through the Service Control Manager. It did not delete files or alter other system settings. On macOS, a shell script executed a command to prevent the update process from starting. The team did not address Android devices because those systems required user action to install updates. The initial update upload to VirusTotal caused security programs to flag it as malware. This error blocked the update on some machines, leaving the vulnerable updater active. The team adjusted the code to resolve the issue.

Eye Security distributed the update until March, at which point it ceased distribution. The company reported sending over two million update downloads. The researchers transferred the domains they had used to the Shadowserver Foundation, a web security non-profit. The total number of at-risk devices remains unclear.