Two Million Computers Told to Stop Checking for Old Movie Updates
Security researchers forced a dormant updater for an abandoned streaming app to shut down to prevent potential botnet recruitment.
By Chioma Kuznetsov ·
Eye Security pushed updates to more than two million devices by March, halting the distribution cycle once the count reached that figure. The intervention targeted a dormant updater associated with Time4Popcorn, a fork of the once-popular streaming front end Popcorn Time. The software had not seen development in years, yet its updater component remained active on Windows, macOS, and Android systems worldwide.
The updater contacted web domains that were no longer maintained. It used unencrypted HTTP connections and relied on an outdated version of Chrome. Niels Teusink, a researcher at Eye Security, stated that this configuration allowed an attacker to install and run any software with full privileges. An adversary could have claimed one of the abandoned domains to build a botnet or used man-in-the-middle attacks to target specific machines. The setup also enabled surveillance by identifying which devices still ran the software.
The researchers decided to register one of the abandoned domains themselves. They used that domain to deliver a signal telling the updater to disable itself. Teusink acknowledged the ethical complexities of acting without permission from the original developers. He noted that the alternative was to do nothing. The team also observed that the update process had ceased to function usefully, serving only to create risk for users.
The implementation varied by operating system. On Windows, the update stopped and disabled the service through the Service Control Manager without deleting files. On macOS, a shell script executed a command to prevent the update process from starting. Android devices were excluded from the initial push because the update mechanism required manual user action to install.
The team faced a technical hurdle when they uploaded the initial update file to VirusTotal. Security programs flagged the file as malware and blocked it, which left the vulnerable updater active on affected machines. The researchers adjusted the code to bypass these flags before resuming the rollout.
The total number of at-risk devices remains unclear. Eye Security reported sending out over two million update downloads before stopping distribution in March. The company subsequently transferred the domains it had used to the Shadowserver Foundation, a web security non-profit.
