Abandoned Popcorn Time updater posed a botnet risk
Eye Security says it disabled an abandoned Popcorn Time updater after finding that forgotten installations could have been hijacked to build a botnet.
Researchers at Eye Security disabled the vulnerable update mechanism used by an abandoned Popcorn Time fork after finding that millions of old installations could potentially be turned into a botnet. The work focused on Time4Popcorn, a closed-source variant whose updater was still running on Windows, macOS and Android devices long after users had stopped using the software.1
The abandoned updater
Eye Security says its investigation began when a client laptop was found running an Updater.exe process that was contacting an unregistered domain over unencrypted HTTP. The researchers identified the process as part of Time4Popcorn, one of several forks that continued using the Popcorn Time name after the original project was shut down.
The danger was not that the forgotten app was still streaming films. The updater remained active in the background and could have been redirected to install software with full privileges if an attacker had taken control of the abandoned domain. Eye Security says that would have created a route to surveillance or a large botnet without requiring the owner to open the old application.12
The researchers registered one of the domains and used it to send an update instructing the vulnerable updater to disable itself. On Windows, the update stopped and disabled the relevant service through the Service Control Manager. On macOS, it used a shell script to prevent the updater from launching. Android devices were treated differently because installation would still require user interaction.1
A fix with uncomfortable trade-offs
Eye Security says it sent more than two million update downloads before stopping the operation and transferring the domains to the Shadowserver Foundation. The researchers describe the intervention as an ethical dilemma: they executed code on systems they did not own, but believed that leaving the updater exposed would have created a greater risk.1
The fix also ran into a practical problem. After the update was uploaded to VirusTotal, security products flagged it as malware, leaving some vulnerable updaters active. Eye Security had to adjust the update so it could reach the machines it was intended to protect.1
The researchers stress that their findings do not apply to a newer project using the Popcorn Time name to build a legal streaming alternative. The risk concerns old installations of the Time4Popcorn fork and its updater, not every application carrying the Popcorn Time name.1
Our opinion
This is a useful reminder that uninstalling software is not always the same as removing its risk. An abandoned updater with domain access can become more dangerous as the years pass, particularly when it runs with broad privileges and nobody is watching it. The scale of Eye Security's intervention also shows how quickly a forgotten consumer application can become a security problem for people who no longer remember installing it.
The uncomfortable part is that the researchers had to behave like attackers to prevent an attack. That does not make the approach automatically acceptable, but it explains why the case deserves scrutiny rather than a simple celebration. The durable lesson for users is less dramatic: remove obsolete software, check for background updaters and do not assume a dormant application is harmless just because you no longer open it.