Security Firm Neutralizes Dormant Streaming Updater to Prevent Botnet Formation

Researchers at Eye Security have successfully disabled a dormant software updater that threatened to turn millions of idle computers into a botnet. The vulnerability existed in Time4Popcorn, a fork of Popcorn Time, a streaming application that allowed users to watch movies and television shows via torrents. Although the original software drew significant attention from the Motion Picture Association of America in the 2010s, development ceased years ago. Despite this abandonment, copies of the program remain installed on a vast number of devices worldwide, leaving them exposed to potential exploitation.

The core issue lay in the active updater for the Time4Popcorn fork, which continued to run on Windows, macOS, and Android systems. This component communicated with web domains that had been left unmanaged. The connections occurred over unencrypted HTTP, and the updater relied on an outdated and insecure version of the Chrome browser engine. Niels Teusink of Eye Security described the weakness as serious, noting that the mechanism could have been leveraged to install and execute nearly any software with full system privileges.

An attacker could have recruited these machines into a botnet by simply acquiring one of the abandoned domains. Alternatively, specific devices could have been targeted through man-in-the-middle attacks. The vulnerability also enabled surveillance, allowing an adversary to identify which machines were still running the software. To mitigate this risk, the research team decided to intervene by registering one of the relevant domains themselves.

The researchers delivered a custom update through the controlled domain that instructed the updater to disable itself. While acknowledging the ethical complexities of modifying software without explicit user consent, the team stated that the only alternative was to do nothing. They emphasized that the update process had ceased to provide any functional benefit and was instead creating risk for users. This approach allowed them to remove the threat without requiring direct user intervention on most platforms.

The implementation varied by operating system. For Windows, the update stopped and disabled the service through the Service Control Manager without deleting files or making other changes. On macOS, a shell script executed a command that prevented the update process from starting. Android devices were excluded from the fix because installing an update on those systems would still require manual action from the user, making remote remediation less effective.

The process was not without complications. After uploading the update to VirusTotal, security programs flagged the file as malware and blocked its execution. This reaction left the vulnerable updater running on machines where the update was blocked, necessitating adjustments to the distribution method. The team had to refine their approach to ensure the patch could reach its intended targets despite automated security filters.

The total number of devices at risk remains unclear. Eye Security reported sending out over two million update downloads by March, at which point the company stopped distributing the update. Following this period, the organization transferred the domains it had utilized to the Shadowserver Foundation, a non-profit dedicated to web security. This handover ensures that the infrastructure remains under the stewardship of a specialized entity rather than returning to an unmanaged state.

This incident highlights the security risks associated with abandoned software that remains active on user devices. By taking proactive measures to disable the vulnerable component, the researchers aimed to reduce the attack surface for potential botnet operators. The resolution serves as a case study in managing legacy technology risks in a landscape where users often retain applications long after their developers have moved on.