Eye Security engineers shut down dormant Popcorn Time updater to prevent botnet recruitment

Engineers at Eye Security have completed a complex intervention that effectively switches off a dormant software component found on millions of computers and phones. The move was designed to neutralize a specific vulnerability in the Popcorn Time ecosystem, a streaming tool that has not seen active development in years but remains installed on a massive scale. By taking control of abandoned web addresses, the researchers delivered a final update that instructs the software to stop checking for new versions, thereby cutting the lifeline that could have been used to build a large-scale botnet.

The issue stems from a fork of the original application called Time4Popcorn. Despite the project being inactive, its updater component remained active on Windows, macOS, and Android devices worldwide. This component was configured to communicate with web domains that were no longer maintained. Furthermore, the communication occurred over unencrypted HTTP connections, and the process relied on an outdated and insecure version of the Chrome browser. This combination of factors created a significant security hole that went unnoticed for a considerable time.

Niels Teusink, a researcher at Eye Security, described the weakness as serious. He explained that the updater had the capability to install and run practically any software with full privileges. An attacker could have taken over one of the abandoned domains to recruit these devices into a botnet. Alternatively, a man-in-the-middle attack could have allowed for targeted intrusion. The setup also enabled surveillance, as attackers could identify exactly which machines were running the software.

The decision to intervene was not made lightly. The team acknowledged the ethical implications of modifying software on user devices without direct consent. However, they argued that the alternative was to do nothing. They noted that the update process was not performing any functional tasks for the users and was only creating risk. The researchers registered one of the domains themselves and used it to distribute the disabling update.

The implementation varied by operating system. For Windows machines, the update simply stops and disables the service through the Service Control Manager. It does not delete files or make other changes to the system. On macOS, a shell script runs a command that prevents the update process from starting. Android devices were not included in the initial distribution because installing an update on that platform would still require manual action from the user.

The rollout process encountered a technical hurdle. When the team uploaded the update to VirusTotal, security programs flagged the original file as malware and blocked it. This reaction left the vulnerable updater running on those specific machines. The team had to adjust the update to overcome this detection issue before it could be widely distributed.

The total number of devices that were at risk remains unclear. Eye Security reported that it sent out over 2 million update downloads by March, at which point it stopped distributing the update. The company has since transferred the domains it used to the Shadowserver Foundation, a web security non-profit. This handover ensures that the domains remain under management even as the active distribution phase concludes.