Eye Security Forces Time4Popcorn Updater Offline on Two Million Devices

Eye Security has disabled the automatic updater for Time4Popcorn on more than two million Windows and macOS devices. The company acted to stop a dormant component of the old streaming software that continued to contact abandoned web servers. This action aimed to prevent attackers from hijacking the communication channel to compromise user machines.

Time4Popcorn is a fork of Popcorn Time, a popular torrent streaming interface that faced legal pressure from the MPAA in the 2010s. Development on the project stalled years ago, yet the updater remained active on devices running Windows, macOS, and Android. Eye Security researcher Niels Teusink stated that the updater connected to web domains over unencrypted HTTP and relied on an outdated version of Chrome. This configuration allowed the updater to install and run software with full privileges.

The primary risk was the potential creation of a botnet. An attacker who registered one of the abandoned domains could have pushed malicious code to all connected devices. Targeted attacks were also possible through man-in-the-middle techniques. Teusink noted that the setup allowed for surveillance by identifying which specific machines still ran the software. The company argued that the updater no longer performed any useful function and only created security risks.

To resolve the issue, Eye Security registered one of the abandoned domains and deployed a patch that instructed the updater to disable itself. The team acknowledged ethical questions about unilaterally changing software behavior. They stated the alternative was to do nothing. The Windows update used the Service Control Manager to stop the service without deleting files. On macOS, a shell script prevented the update process from starting. Android devices were excluded because the patch required manual user action to install.

The rollout faced technical hurdles. After uploading the patch to VirusTotal, security tools flagged the file as malware and blocked it on some systems. This forced Eye Security to adjust the update to avoid false positives. The company stopped distributing the update in March. By that time, it had delivered over two million update downloads. Eye Security then transferred the domains to the Shadowserver Foundation, a web security non-profit.

The exact number of vulnerable devices remains unclear. The two million figure represents the total number of update downloads sent out by March. The company did not provide a final count of unique devices successfully patched. The domains used for the update are no longer under Eye Security control.