Researchers Disable Abandoned Popcorn Time Updater to Head Off Potential Botnet

Popcorn Time, the streaming front end for movie and TV torrents that drew the ire of the MPAA in the 2010s, has been left without development for years. Yet copies of the software remain installed on millions of devices, and researchers say those machines could have been recruited into a botnet.

Eye Security researchers found that the updater for a Popcorn Time fork called Time4Popcorn was still active on a large number of Windows, macOS and Android devices around the world. The updater contacted web domains that had since been abandoned, did so over unencrypted HTTP, and relied on an outdated and insecure version of Chrome.

According to Eye Security's Niels Teusink, the weakness was serious. The updater could have been used to install and run practically any software with full privileges. An attacker could have built a botnet simply by taking over one of the abandoned domains, or targeted specific devices through a man-in-the-middle attack. Surveillance would also have been possible by identifying which machines were running the software.

The researchers chose to register one of the domains themselves and use it to deliver an update that told the updater to disable itself. They acknowledged ethical concerns about that approach, but said the only alternative "was to do nothing." They also noted that "the update process wasn't doing anything functional anyway, it was only creating risk for users."

Eye Security said the Windows version of its update "simply stops and disables the service via the Service Control Manager" and does not delete files or make other changes. On macOS, a shell script runs a command that prevents the update process from starting. Android devices were not addressed, because installing an update there would still require action from the user.

The team had to adjust its update after uploading it to VirusTotal. Security programs flagged the original as malware and blocked it, which left the vulnerable updater running on those machines.

The total number of devices at risk is unclear. Eye Security said it "sent out over 2 million update downloads" by March, when it stopped distributing the update. The company then transferred the domains it had used to the Shadowserver Foundation, a web security non-profit.