Eye Security Disables Abandoned Popcorn Time Updater to Stop Botnet Threat

Popcorn Time, a popular streaming tool for torrents, has not received code updates in years. However, Eye Security researchers found that its updater component remained active on millions of devices. This dormant software posed a hidden risk to users who still had the program installed.

The specific fork, Time4Popcorn, relied on an outdated version of Chrome and unencrypted HTTP connections. The updater contacted web domains that were no longer maintained. Niels Teusink of Eye Security noted that an attacker could have taken over one of these domains. This access would have allowed the installation of any software with full privileges.

The vulnerability enabled the creation of a botnet or targeted surveillance. An attacker could identify which machines ran the software through a man-in-the-middle attack. Teusink described the weakness as serious because it granted high-level system access. The team decided to intervene before an adversary could exploit the gap.

Eye Security registered the abandoned domains to deliver a corrective update. The update instructed the updater to disable itself. The team acknowledged ethical concerns about changing software without user consent. They stated that the only alternative was to do nothing. They added that the update process was not performing any functional tasks for users.

The implementation varied by operating system. On Windows, the update stopped and disabled the service through the Service Control Manager. No files were deleted or altered during this process. On macOS, a shell script ran a command to prevent the update process from starting. Android devices were excluded because they required manual user action to install updates.

The team encountered an obstacle after uploading the update to VirusTotal. Security programs flagged the original file as malware and blocked it. This left vulnerable updaters running on affected machines. The researchers adjusted the update to bypass these blocks and ensure successful delivery.

Eye Security distributed the update until March of this year. The company recorded over 2 million update downloads during that period. After stopping distribution, the team transferred the domains to the Shadowserver Foundation. This web security non-profit now manages the infrastructure previously used for the update.