Quiet fix stops old streaming app from becoming a botnet

Millions of computers and phones still carry a dormant piece of software that could have been turned into a massive network of compromised machines. The app in question is Popcorn Time, a streaming tool for movies and TV that became famous in the 2010s. Although the original project stopped development years ago, copies remain installed on many devices. Researchers recently moved to disable a specific updater associated with the software to close a significant security gap before an attacker could exploit it.

Experts from the firm Eye Security discovered that the updater for a version called Time4Popcorn was still active on Windows, macOS, and Android systems worldwide. This updater reached out to web addresses that had been left unattended. It did so using unencrypted connections and relied on an older, less secure version of the Chrome browser. Niels Teusink from the research team explained that this setup allowed the software to install and run almost any program with full privileges. A hacker could have taken over an abandoned web address to build a botnet or used a man-in-the-middle attack to target specific devices.

To solve the problem, the researchers registered one of the unused web domains themselves. They used it to send a new update that told the updater to turn itself off. The team admitted this method raised ethical questions about changing software without user consent. However, they argued that the alternative was to do nothing. They also pointed out that the update process was not providing any real function and was only creating risk for users.

The fix worked differently on each platform. On Windows, the update stops and disables the service through the Service Control Manager. It does not delete files or make other changes to the system. On macOS, a shell script runs a command that prevents the update process from starting. The team did not address Android devices because installing an update there would still require the user to take action manually.

The process was not without hiccups. The team had to adjust the update after uploading it to VirusTotal. Security programs flagged the original file as malware and blocked it. This left the vulnerable updater running on some machines. The total number of devices that were at risk remains unclear. Eye Security said it sent out over two million update downloads by March, when it stopped distributing the patch.

After completing the distribution, the company transferred the domains it used to the Shadowserver Foundation. This is a non-profit organization dedicated to web security. The move ensures that the web addresses are now managed by a group focused on monitoring and protecting the internet. For most users, the change is invisible. Their devices are no longer contacting abandoned servers, reducing the chance that their hardware could be quietly recruited for a cyberattack.