2 Million Update Downloads Sent to Kill Dormant Movie App Service
Security researchers hijacked an abandoned domain to disable an outdated updater on Windows, macOS, and Android devices.
By Adewale Fletcher ·
Popcorn Time, the streaming interface that once drew complaints from the MPAA, has seen no development for years, yet its updater still runs on millions of machines. Eye Security researchers identified that the updater for a fork called Time4Popcorn remained active on Windows, macOS, and Android systems globally, creating a potential entry point for attackers.
The vulnerability stemmed from the updater contacting abandoned web domains over unencrypted HTTP. It also relied on an outdated, insecure version of Chrome. Niels Teusink of Eye Security explained that an attacker could have installed software with full privileges by taking over one of these domains. A man-in-the-middle attack could have targeted specific devices, and the system allowed for surveillance by identifying which machines ran the software.
To address the risk, the research team registered one of the abandoned domains themselves. They used it to deliver a silent update that instructed the updater to disable itself. Teusink noted that the only alternative was to do nothing, adding that the update process was not performing any functional tasks and was only creating risk for users.
The implementation required adjustments after the initial upload was flagged as malware by security programs on VirusTotal. This blocked the update on some machines, leaving the vulnerable updater running. The team revised the payload to ensure it could be delivered successfully to the remaining devices.
The fix varied by operating system. On Windows, the update stopped and disabled the service via the Service Control Manager without deleting files. On macOS, a shell script prevented the update process from starting. Android devices were not included in the automated fix because installing an update on that platform requires manual user action.
Eye Security reported sending out over 2 million update downloads by March, when it ceased distribution. The company subsequently transferred the domains it had used to the Shadowserver Foundation, a web security non-profit. The total number of devices that were at risk remains unclear.
The project ended with the domains in the hands of a non-profit organization. No further updates are scheduled, and the dormant updater is now inactive on the devices that received the patch.
