Security firm pushes silent update to two million devices to stop old movie app

Eye Security deployed a silent update to over two million Windows and macOS devices this year to disable the dormant updater for Time4Popcorn, a fork of the torrent streaming service Popcorn Time. The firm registered abandoned web domains used by the software and pushed a patch that instructed the updater to stop running, effectively silencing a component that had been active for years without maintenance.

Popcorn Time gained prominence in the 2010s as a front end for downloading movies and TV shows via torrents. Although the project has seen no development for years, copies remain installed on millions of devices. Eye Security researchers, including Niels Teusink, identified that the Time4Popcorn updater continued to contact these abandoned domains over unencrypted HTTP connections. The software also relied on an outdated and insecure version of Chrome, creating a significant vulnerability.

Teusink explained that an attacker could have taken control of one of the abandoned domains to install and run arbitrary software with full privileges on user machines. This setup would have allowed the creation of a botnet or enabled targeted attacks through man-in-the-middle tactics. Surveillance of specific devices was also possible because the updater revealed which systems were running the software.

The security team addressed ethical concerns about modifying software on user devices without permission by noting that the only alternative was inaction. They stated that the update process was not performing any functional tasks and was solely creating risk. For Windows systems, the update disabled the service via the Service Control Manager without deleting files. On macOS, a shell script prevented the update process from starting. Android devices were excluded from the push because applying the update required manual user intervention.

The deployment process encountered obstacles when the team uploaded their update file to VirusTotal. Security programs flagged the original file as malware and blocked it, which left vulnerable updaters running on those specific machines. The researchers adjusted the update to resolve these detection issues before continuing the distribution.

Eye Security stopped distributing the update in March and transferred the registered domains to the Shadowserver Foundation, a web security non-profit. The total number of devices at risk remains unclear, but the firm confirmed that it sent out more than two million update downloads before ceasing the operation.