Security firm silences dormant movie app on two million computers

Eye Security deployed a silent update to more than two million devices to disable a dormant software component. The patch targeted the updater for Time4Popcorn, a fork of the former Popcorn Time streaming application. The company stopped distributing the update in March.

The Time4Popcorn updater remained active on Windows, macOS, and Android systems despite the main application being abandoned for years. Eye Security researchers found the updater contacted abandoned web domains over unencrypted HTTP. It also relied on an outdated, insecure version of Chrome.

Niels Teusink of Eye Security stated the vulnerability allowed attackers to install and run software with full privileges. An adversary could have built a botnet by taking over one of the abandoned domains. Targeted attacks were also possible through man-in-the-middle tactics.

The researchers registered one of the abandoned domains themselves to deliver the disabling update. They acknowledged ethical concerns about this approach. Teusink noted the alternative was to do nothing. He added that the update process was not functional and only created risk for users.

The Windows update stops and disables the service via the Service Control Manager. It does not delete files or make other changes. On macOS, a shell script runs a command that prevents the update process from starting. Android devices were excluded because installing an update there requires user action.

The team had to adjust its update after uploading it to VirusTotal. Security programs flagged the original version as malware and blocked it. This left the vulnerable updater running on those specific machines.

Eye Security transferred the domains it used to the Shadowserver Foundation, a web security non-profit. The total number of at-risk devices remains unclear. The company confirmed it sent out over two million update downloads before halting the distribution.