Dormant App Vulnerability: Researchers Shut Down Silent Popcorn Time Updater

For over a decade, Popcorn Time served as a convenient gateway for fans to stream movies and television series directly from torrent networks, often drawing attention from major studios. Although the original project has not seen active development in years, millions of computers and phones still carry remnants of the software.

Security researchers from Eye Security recently identified a significant threat lurking in Time4Popcorn, a fork of the original application. They discovered that an automatic updater was still active on a vast number of Windows, macOS, and Android systems. This component reached out to web addresses that had been left behind by their owners. Furthermore, it communicated over unencrypted connections and depended on an old, vulnerable version of the Chrome browser.

Niels Teusink from Eye Security explained that the flaw was severe. The active updater had enough power to install and execute nearly any software with full system privileges. A malicious actor could have seized control of one of the abandoned web addresses to build a botnet. Alternatively, they could have used man-in-the-middle tactics to target specific machines or identify which users still had the application installed for surveillance purposes.

To stop the threat, the research team registered one of the dormant web addresses themselves. They then pushed an update that instructed the software to turn itself off. The group admitted there were ethical questions about modifying software without user permission. However, they argued that inaction was the only other option. They noted that the update process was not serving a useful function and only added risk for the people using the app.

The technical implementation varied by platform. On Windows, the update used the Service Control Manager to stop and disable the service without deleting any files. For macOS, a simple shell script prevented the update process from launching. The team did not address Android devices because applying the fix there would have required the user to take manual action.

The rollout was not without hiccups. After the team uploaded the fix to VirusTotal, several security programs flagged it as malicious. This caused some systems to block the update, leaving the vulnerable component active on those machines. The team had to adjust the package to resolve the false positives.

The exact number of devices at risk remains unknown. Eye Security reported distributing over two million update downloads by the time they halted the campaign in March. They have since handed the web addresses they used over to the Shadowserver Foundation, a non-profit organization focused on web security.