Millions of Devices at Risk as Researchers Halt Abandoned Streaming Updater

A long-dormant vulnerability in a popular streaming application has been neutralized by security researchers who acted to prevent a potential mass compromise of consumer devices. The intervention targets the automatic update mechanism for a specific version of Popcorn Time, a tool that once allowed users to stream movies and television shows via torrents. Although the software has seen no new development for several years, millions of computers and smartphones still run it, creating a significant surface area for attackers.

The primary concern identified by the team at Eye Security is the lingering activity of an updater component within a fork known as Time4Popcorn. This updater remained active on Windows, macOS, and Android systems across the globe. It was configured to communicate with web domains that had been abandoned by their original owners. Furthermore, these connections were made over unencrypted HTTP, and the process relied on an outdated and insecure version of the Chrome browser engine. This combination of factors created a fragile link between millions of private devices and the open internet.

Niels Teusink of Eye Security explained that the flaw was severe enough to allow an attacker to install and execute virtually any software with full system privileges. By seizing control of one of the abandoned domains, a bad actor could have effectively recruited these devices into a botnet. Alternatively, they could have targeted specific machines using man-in-the-middle attacks. The presence of the software also offered a surveillance opportunity, as it would have been possible to identify which devices were running the application.

To mitigate the risk, the research team decided to register one of the abandoned domains themselves. They then used this domain to push an update that instructed the updater to disable itself. The researchers acknowledged the ethical complexities of modifying software without the explicit consent of the developers or users. However, they argued that inaction was the only other option, and that the update process was not providing any functional benefit to users, only adding risk.

The implementation of the fix varied by operating system. On Windows, the update simply stops and disables the service through the Service Control Manager without deleting files or making other changes. For macOS users, a shell script executes a command that prevents the update process from starting. Android devices were excluded from this specific push because installing an update on that platform typically requires direct action from the user.

The rollout was not without technical hurdles. After the team uploaded the update to VirusTotal, security programs flagged the original payload as malware. This caused the software to be blocked on some machines, leaving the vulnerable updater active on those systems. The team had to adjust the update to overcome these false positives and ensure it could be delivered successfully.

The total number of devices that were at risk remains unclear. Eye Security reported sending out over two million update downloads by March, at which point they stopped distributing the patch. The company subsequently transferred the domains it had used to the Shadowserver Foundation, a non-profit organization focused on web security. This handoff ensures that the domains remain secure and that the updater remains disabled for future users.

This incident highlights the persistent risk posed by abandoned software that remains installed on consumer devices. While the immediate threat has been addressed for the specific fork in question, it underscores the need for better lifecycle management of popular applications. Users who installed these tools years ago may not realize their devices are still communicating with the internet, potentially exposing them to risks they did not anticipate.

The resolution of this issue serves as a case study in proactive cybersecurity. By taking control of the communication channels, the researchers were able to shut down a potential vector for attack before it could be exploited. It is a reminder that even when software is no longer maintained, its components can continue to interact with the network, creating hidden vulnerabilities that require specialized attention to resolve.