Eye Security Closes Loophole in Abandoned Popcorn Time Updater

A software updater connected to the once-popular torrent streaming application Popcorn Time has been shut down by security researchers aiming to prevent a potential cyberattack.

Eye Security identified that the update mechanism for a specific version of the program, known as Time4Popcorn, was still active on millions of Windows, macOS, and Android devices worldwide. Although the original developers stopped maintaining the software years ago, these old installations were still attempting to reach web domains that have since been left unregistered. The connection was made over an insecure protocol and relied on an outdated browser engine, creating a dangerous opening for cybercriminals.

Niels Teusink of Eye Security explained that the flaw offered attackers a high level of control over affected machines. Because the updater could install and run arbitrary software with full privileges, a bad actor could have compromised a device simply by registering one of the abandoned domains or intercepting the communication. Such a weakness could allow for the creation of a botnet, a network of hijacked computers used for malicious purposes, or facilitate surveillance of specific users.

In response, researchers claimed the abandoned domains and sent a command instructing the updater to deactivate itself. The team acknowledged that altering software on a user's device raised ethical questions but stated that the only alternative was to do nothing, noting that the update process was not performing any useful function and only created risk for users.

The shutdown process was designed to be as unobtrusive as possible. On Windows systems, the service simply stops running through the Service Control Manager without deleting any files or making other changes. On macOS, a script prevents the update process from launching again. Android devices were not targeted by this operation because any update on those platforms would require the user to manually approve the installation.

The initial attempt to distribute the shutdown command encountered a hurdle when security programs flagged the file as malware. After adjusting the update and resubmitting it to VirusTotal, a service that analyzes files for viruses, the researchers were able to proceed with the distribution. By March, Eye Security reported that it had facilitated over two million downloads of the update before stopping the distribution process.

Following the completion of the operation, Eye Security transferred the domains used for the shutdown to the Shadowserver Foundation, a non-profit organization focused on internet security. The total number of devices that remain at risk is unknown, as the original distribution of the software was widespread.