Millions of dormant devices protected after silent app updater disabled

Users of Windows, macOS, and Android computers may have had an uninvited helper running in the background for years. Eye Security researchers recently disabled the automatic update mechanism for a version of the Popcorn Time streaming app, a move that prevents attackers from taking over the software on millions of idle machines.

Popcorn Time, a tool for streaming torrent-based movies and TV shows, stopped receiving regular development in the 2010s. However, the Time4Popcorn fork remained installed on a large number of devices. The updater component of this fork continued to contact web servers over unencrypted HTTP. It also relied on an outdated version of the Chrome browser engine to function.

Niels Teusink of Eye Security explained that the design allowed an attacker to install and run any software with full administrative privileges. By seizing control of one of the abandoned domains the app contacted, a bad actor could have built a botnet. Targeted surveillance was also possible by identifying which specific machines were still running the code.

To fix the issue, the research team registered one of the domains themselves. They delivered an update that instructed the updater to disable itself. Teusink noted that the update process was not providing any functional benefit to users and was only creating risk. The team acknowledged the ethical complexity of forcing a change on dormant devices but stated the only alternative was to do nothing.

The update for Windows systems stops and disables the service through the Service Control Manager without deleting files. On macOS, a shell script prevents the update process from starting. The researchers did not address Android devices because applying the fix there would require manual user action.

The rollout faced a technical hurdle when security programs flagged the initial update as malware. This caused the vulnerable updater to remain active on some machines. The team adjusted the update to resolve the conflict. By March, Eye Security had sent out over two million update downloads before stopping distribution.

The company has transferred the domains it used for the update to the Shadowserver Foundation, a web security non-profit. The exact total number of devices currently protected is unclear, as many installations may have already been removed or updated.