Eye Security pushes silent patch to stop dormant Time4Popcorn updater

Eye Security researchers registered abandoned web domains to disable a dormant updater for the movie streaming app Time4Popcorn. The move affected over two million devices running Windows, macOS, and Android. The company acted to prevent the software from becoming a vector for botnets or surveillance.

Time4Popcorn is a fork of Popcorn Time, a torrent streaming front end that faced legal pressure from the MPAA in the 2010s. Development on the original project ceased years ago, leaving copies installed on millions of machines. The updater for the Time4Popcorn fork remained active on these devices despite the lack of maintenance.

The vulnerability centered on the updater's use of unencrypted HTTP connections to contact web domains that had since been abandoned. It also relied on an outdated, insecure version of Chrome. Niels Teusink of Eye Security noted that the weakness allowed an attacker to install and run software with full privileges. An adversary could have seized one of the abandoned domains to build a botnet or used man-in-the-middle attacks to target specific machines.

To fix the issue, the team registered one of the domains and delivered an update that instructed the updater to disable itself. Teusink acknowledged the ethical complexity of the approach, stating the only alternative was to do nothing. The firm argued that the update process was not functioning properly and was only creating risk for users.

The implementation varied by operating system. On Windows, the update stopped and disabled the service via the Service Control Manager without deleting files. On macOS, a shell script prevented the update process from starting. Android devices were excluded because installing an update on those systems would have required direct user action.

The team faced technical hurdles during distribution. After uploading the patch to VirusTotal, security programs flagged the original file as malware. This caused the vulnerable updater to remain active on those specific machines until the team adjusted the code. By March, Eye Security had sent out over two million update downloads before stopping distribution.

The company transferred the domains it had used to the Shadowserver Foundation, a web security non-profit. The total number of at-risk devices remains unclear, as the firm only reported the count of update downloads delivered. The process leaves the dormant updater disabled on the patched machines.