Popcorn Time: abandoned updater disabled over botnet risk

Update components can remain active long after software has been abandoned. The Verge reports that Eye Security discovered the updater for Time4Popcorn, a variant of Popcorn Time, on Windows, macOS and Android devices. It contacted abandoned domains over unencrypted HTTP and used an old, vulnerable version of Chrome.

According to Niels Teusink of Eye Security, this mechanism could have allowed software to be installed and executed with full privileges. Taking over a domain or intercepting communications could thus have opened the way to a botnet or surveillance. The account describes a potential exploit; it does not establish that such an attack took place.

The researchers registered a domain and sent an update intended to disable the mechanism. On Windows, Eye Security says it stopped and disabled the service without deleting files. On macOS, a script blocks it from starting. Android was not addressed, as installation there requires user intervention.

The operation also encountered an obstacle: after the update was submitted to VirusTotal, security software blocked it, prompting the researchers to adjust it. Eye Security says it delivered more than 2 million update downloads through March, then transferred the domains to the Shadowserver Foundation. The exact number of devices at risk remains uncertain.

This case highlights a maintenance issue: ending development is not enough to remove components capable of receiving remote instructions.