2 Million Downloads: Security Firm Forces Dormant Movie App Updater Offline

Millions of computers running an outdated movie streaming tool are no longer vulnerable to remote hijacking. Eye Security researchers intervened to disable a dormant updater for Time4Popcorn, a fork of the Popcorn Time application. The action stopped the software from contacting abandoned web servers, closing a gap that could have allowed attackers to take control of user devices.

Popcorn Time gained notoriety in the 2010s as a front end for movie and TV torrents. Although development ceased years ago, copies remained installed on Windows, macOS, and Android systems. The Time4Popcorn updater continued to function, sending requests over unencrypted HTTP to domains that no one actively maintained. It also relied on an outdated version of Chrome, creating a security risk for users who were unaware the software was still active in the background.

Niels Teusink of Eye Security explained that the vulnerability allowed for the installation of any software with full privileges. An attacker could have seized one of the abandoned domains to build a botnet or targeted specific machines through a man-in-the-middle attack. The researchers noted that the update process was not providing any functional value to users, only creating risk. They decided the only alternative to intervening was doing nothing.

The team registered one of the abandoned domains and used it to push an update that instructed the updater to shut down. By March, the firm had sent out over two million update downloads before stopping distribution. The Windows update stops and disables the service through the Service Control Manager without deleting files. On macOS, a shell script prevents the process from starting. Android devices were not patched because the update required manual user action.

The rollout faced technical hurdles. When the team uploaded the initial patch to VirusTotal, security programs flagged it as malware and blocked it. This left the vulnerable updater running on those specific machines. The researchers adjusted the update to address the false positive. After stopping the distribution, Eye Security transferred the domains to the Shadowserver Foundation, a web security nonprofit.

The total number of devices at risk remains unclear because the researchers stopped counting after March. The intervention ensures that the remaining installations do not automatically download future payloads from the compromised domains.