Abandoned Software Update Disabled

Copies of a streaming application called Popcorn Time remain installed on millions of devices worldwide, even though the software has not seen active development for years. While the application itself is dormant, researchers discovered a security flaw that could have put user machines at risk. By intervening, the team shut down a mechanism that could have been used to compromise computers running the old software.

The danger originated with an automatic updater component inside a version of the application known as Time4Popcorn. This updater was programmed to contact specific web addresses to check for new content. Because the project was abandoned, those addresses were no longer owned by anyone, and the connection between the computer and the empty address was unencrypted. Researchers at Eye Security identified this gap, noting that the updater also relied on an outdated version of the Chrome browser.

This setup created a serious opening for malicious activity. According to Niels Teusink of Eye Security, the updater had the ability to install and run software with full administrative privileges. This means someone who gained control of one of the abandoned web addresses could have pushed malicious code onto user machines, effectively turning them into a botnet. Such an attack could also target specific computers through a man-in-the-middle interception or allow for the surveillance of machines running the software.

To prevent this, the research team registered one of the abandoned domains and used it to push an update. This update instructed the software to stop running and disable its own update service. The team acknowledged ethical concerns regarding this method but argued that doing nothing was not a viable choice because the update process was not performing any function and was only creating risk. The modification affected Windows and macOS systems by stopping the service or preventing it from starting. Android devices were not modified because any change there would require user action.

The researchers encountered a technical hurdle when they submitted their update file to VirusTotal for analysis. Security programs flagged the file as malware and blocked it, which would have left the vulnerable updater active on protected machines. The team had to modify the update to get past these blocks. Eye Security distributed more than 2 million update downloads by March before stopping the distribution. The domains used for this operation were then transferred to the Shadowserver Foundation, a web security non-profit.

The total number of devices at risk remains unknown. Popcorn Time, which drew the ire of the MPAA in the 2010s, has been without development for years. However, copies of the software are still present on millions of machines. Eye Security stated that the update process was not doing anything functional and was only creating risk for users.