Researchers Disable Abandoned Popcorn Time Updater to Prevent Botnet Use

The software, once an easy-to-use front end for streaming torrents of movies and TV shows, had been abandoned for years. The researchers found that the updater for a fork called Time4Popcorn was still running on many devices around the world, contacting now-abandoned web domains over unencrypted HTTP and running an outdated, insecure version of Chrome.

Eye Security’s Niels Teusink said the updater could have been used to install and run almost any kind of software with full privileges. That would have made it possible to create a botnet simply by taking over one of the domains, to use a man-in-the-middle attack to target specific devices, or to conduct surveillance by identifying the machines running the software.

The researchers’ solution was to register one of the abandoned domains and use it to send their own update that instructed the updater to disable itself. Despite ethical concerns about the fix, the researchers said their only alternative “was to do nothing.” They added: “The update process wasn’t doing anything functional anyway, it was only creating risk for users.”

Eye Security said that on Windows devices, its update “simply stops and disables the service via the Service Control Manager” without deleting any files or anything else. On macOS, it uses a shell script to execute a command that blocks the update process from starting. The researchers did not address the software on Android devices, where installing the update would still require user interaction first.

They had to adjust the update after it was uploaded to VirusTotal, causing security programs to flag it as malware and block it while leaving the vulnerable updater running. It is unclear exactly how many devices were at risk. Eye Security said it “sent out over 2 million update downloads” by March, when it stopped sending the update and transferred the domains it used to the Shadowserver Foundation, a web security non-profit.