Security Team Neutralizes Dormant Software Updater

Millions of silent computers around the world just lost their hidden connection to a digital past.

Eye Security researchers recently disabled an active updater for Time4Popcorn, a popular fork of the once famous Popcorn Time streaming application. Although the original software attracted attention from the MPAA in the 2010s and has seen no new development for years, many devices still carry the code. The team discovered that this dormant software was not truly asleep. The updater component remained active on Windows, macOS, and Android systems. It continued to reach out to web domains that owners had long since abandoned. These connections used unencrypted HTTP protocols and relied on an outdated version of Chrome that lacked modern security protections.

Niels Teusink of Eye Security described the vulnerability as a significant risk. The updater held enough authority to install and run almost any software with full privileges. An attacker could have seized one of the abandoned domains to recruit these machines into a botnet. Alternatively, they could have targeted specific devices through man-in the middle attacks. This setup also allowed for surveillance, letting observers identify which computers were still running the software.

To fix the problem, the research team registered one of the abandoned domains themselves. They used it to send a final update that instructed the updater to disable itself. The team acknowledged the ethical questions surrounding this unannounced intervention. However, they argued that doing nothing was the only other option. They noted that the update process was not providing any functional benefit to users and was only adding risk to their systems.

The implementation varied by platform. On Windows, the update stops and disables the service through the Service Control Manager without deleting files or making other changes. On macOS, a simple shell script prevents the update process from starting. The team did not address Android devices because installing an update there would have required manual action from the user, which they could not guarantee.

The team faced a technical hurdle after uploading their patch to VirusTotal. Security programs flagged the original file as malware and blocked it. This left the vulnerable updater active on those specific machines. The researchers had to adjust their update to bypass these false positives. By March, Eye Security reported that it had sent out over two million update downloads before stopping the distribution. The company then transferred the domains it had used to the Shadowserver Foundation, a non-profit organization focused on web security.

The exact number of devices that remain at risk is still unclear. The total count of installations worldwide is not public. This incident highlights the lingering footprint of abandoned software. It also demonstrates the proactive steps security teams must take to protect users who may not even know the code is still running on their machines.