Abandoned Popcorn Time apps had to be disabled to prevent a zombie army — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Eye Security registered an abandoned domain used by Time4Popcorn to push a self-disabling update to vulnerable clients, preventing potential exploitation via man-in-the-middle attacks or domain takeover
- Time4Popcorn updater phoned home over unencrypted HTTP using an outdated Chrome version, exposing millions of Windows, macOS, and Android devices to remote code execution with full privileges
- Niels Teusink at Eye Security stated the update mechanism no longer served a functional purpose and only introduced risk, justifying the intervention despite ethical concerns about remote modification
- On Windows, the security update stopped and disabled the updater service via the Service Control Manager without deleting files, while on macOS, a shell script blocked the process from launching
- Eye Security sent over 2 million update downloads by March before transferring control of the domains to the Shadowserver Foundation, a nonprofit focused on internet security
- The update was initially flagged as malware after being uploaded to VirusTotal, requiring adjustments to bypass security software that blocked the patch while leaving the vulnerable software active
Why it matters: Millions of devices remained exposed to botnet recruitment through a defunct app’s insecure updater, and with no official maintainer, Eye Security’s intervention was the only way to close the attack surface at scale—preventing large-scale compromise that could have leveraged trusted software for malicious ends.
Ask SkimNews
