Researchers disabled a Popcorn Time updater to prevent a botnet

Researchers at Eye Security disabled an abandoned Popcorn Time updater to reduce the risk that it could be used to create a botnet. The updater belonged to a fork called Time4Popcorn and was still running on Windows, macOS and Android devices around the world.

Eye Security found that the updater contacted abandoned web domains over unencrypted HTTP and ran an outdated, insecure version of Chrome. Researcher Niels Teusink said an attacker could have taken over one of the domains, used a man-in-the-middle attack, or identified devices running the software. The updater could then install and run software with full privileges.

Eye Security registered one of the domains and sent an update that instructed the updater to disable itself. On Windows, the update stops and disables the service through the Service Control Manager without deleting files. On macOS, a shell script blocks the update process from starting. The researchers did not address Android devices, where installing the update still required user interaction.

Eye Security said it sent out over 2 million update downloads by March, when it stopped sending the update and transferred the domains it used to the Shadowserver Foundation. The exact number of devices at risk is unclear. The researchers said doing nothing was their only alternative, while acknowledging ethical concerns about their fix.