Security researchers had to step in and shut down an update mechanism tied to an abandoned Popcorn Time fork after discovering it left large numbers of devices open to takeover. The updater for Time4Popcorn was still running on Windows, macOS, and Android devices around the world, according to Eye Security, which found the software contacting web domains that no longer had owners. The same updater also bundled an outdated and insecure version of Chrome.
Eye Security researcher Niels Teusink said the updater had the ability to install and run virtually any software with full privileges. That meant an attacker could build a botnet simply by taking over one of the abandoned domains, use a man-in-the-middle attack to target particular devices, or conduct surveillance by identifying which machines were running the software. Popcorn Time itself, a front end for streaming torrents of movies and TV shows, was abandoned years ago but remains installed on millions of devices.
To close the hole, the researchers registered one of the domains and used it to deliver an update that told the updater to disable itself. They acknowledged ethical concerns about the approach but said doing nothing was the only alternative, noting that the update process served no functional purpose and only created risk for users. On Windows, the update stops and disables the service through the Service Control Manager without deleting files or anything else, while on macOS it runs a shell script that blocks the update process from starting. The researchers did not address Android, where installing the update would still require the user to act first.
The fix ran into a snag after it was uploaded to VirusTotal, where security programs flagged it as malware and blocked it, leaving the vulnerable updater in place. Eye Security said it adjusted the update in response. The researchers did not establish exactly how many devices were at risk, but they said they sent out more than 2 million update downloads by March, when they stopped sending the update and handed the domains they had used to the Shadowserver Foundation, a web security non-profit.
The episode highlights a broader exposure facing US consumers and businesses: old, forgotten software can keep running on machines long after the product behind it has been dropped. In this case, the abandoned updater sat on Windows, macOS, and Android devices and answered to domains anyone could have claimed. The researchers' intervention cut off one path to those devices, but the underlying pattern, orphaned code left behind on millions of systems, is not unique to Popcorn Time.
More software news from TechManNews.
