Researchers sent an update to disable abandoned Popcorn Time apps’ updater and prevent a zombie army

A forgotten updater remained active

Popcorn Time offered a simple way to stream torrents of movies and TV shows. Although development had stopped years earlier, Eye Security found the updater for a fork called Time4Popcorn still operating on devices around the world.

The updater contacted abandoned web domains over unencrypted HTTP and ran an outdated, insecure version of Chrome. Researcher Niels Teusink said it could install and run software with full privileges.

How attackers could exploit it

Taking over one of the old domains could have let someone create a botnet, target specific devices through a man-in-the-middle attack, or identify machines running the software for surveillance. Eye Security said the updater no longer performed a useful function, leaving users exposed to risk without a corresponding benefit.

Researchers disabled the updater

The researchers registered one of the domains and used it to send an update telling the updater to stop. On Windows, the update disabled the service without deleting files; on macOS, a shell script blocked the update process from starting.

They did not address Android devices, where installing the update still required user interaction. Eye Security said security programs flagged its update as malware after it was uploaded to VirusTotal, while the vulnerable updater remained active, so the researchers had to revise it.

More than two million downloads

Eye Security said it had sent out over 2 million update downloads by March, when it stopped sending the update. The number of devices at risk remains unclear. The researchers then transferred the domains they had used to the Shadowserver Foundation, a web security nonprofit.