Security Team Disables Silent Updater on Millions of Forgotten Streaming Devices

Eye Security has forced millions of dormant streaming applications to shut down their own update services.

The company targeted Time4Popcorn, a fork of the torrent-based movie player Popcorn Time. The original software gained notoriety in the 2010s before development ceased, yet copies remain installed on a vast number of Windows, macOS, and Android devices.

Researchers identified that the application's updater remained active on these machines. The code contacted web domains that had been abandoned by their original owners. It communicated over unencrypted HTTP and relied on an outdated, insecure version of Chrome.

Niels Teusink of Eye Security stated that the updater held full privileges. An attacker could have installed and run any software on affected systems simply by taking over one of the dead domains. They could also have built a botnet or performed man-in-the-middle attacks to target specific devices.

To fix the issue, the research team registered one of the abandoned domains themselves. They used it to deliver a final update that instructed the updater to disable itself. The team acknowledged ethical concerns about forcing an update but noted the alternative was to do nothing. They added that the process was not functional and only created risk for users.

The Windows update stops the service via the Service Control Manager without deleting files. On macOS, a shell script prevents the update process from starting. The team did not address Android devices because those systems require user action to install updates. The team adjusted its code after antivirus programs on VirusTotal flagged the original update as malware. This blocked the fix on some machines and left the vulnerable updater running.

Eye Security distributed over 2 million update downloads by March, when it stopped the distribution. The company then transferred the domains it used to the Shadowserver Foundation, a web security non-profit. The total number of devices at risk remains unclear.