Security Team Shuts Down Dormant Torrent App Updater

Eye Security researchers have disabled the update mechanism within an older version of the Popcorn Time media application after determining that the dormant software posed a significant security threat to users. The operation was conducted to prevent the vulnerable component from being exploited by malicious actors seeking to control devices remotely. While the application itself has not been in active development for years, copies of the software remain installed on millions of devices worldwide, creating a widespread risk that researchers acted to mitigate.

Popcorn Time operated as a front end for streaming movie and television torrents and attracted significant attention from the MPAA during the 2010s. Although the main project is no longer maintained, the specific fork known as Time4Popcorn has left behind active components on Windows, macOS, and Android systems. Researchers identified that the updater for this fork continued to function on a large number of machines, contacting web domains that had since been abandoned. The process relied on unencrypted HTTP connections and an outdated, insecure version of Chrome, leaving the communication channels open to manipulation.

The vulnerability was severe because the updater component possessed full privileges on the host machines. According to Niels Teusink of Eye Security, the weakness could be exploited to install and execute practically any software without restriction. An attacker could potentially construct a botnet by taking control of the abandoned domains or could target specific machines through a man-in-the-middle attack. The setup also allowed for the identification and surveillance of machines running the software, as the updater contacted the internet to function.

The research team chose to register one of the abandoned domains themselves. By doing so, they were able to deliver an update instructing the software to disable itself. The researchers acknowledged the ethical considerations involved in taking control of a dormant domain, stating that the only other option available was to do nothing. They further noted that the update process was not performing any functional tasks for the user and was creating risk solely by existing.

The mitigation efforts targeted Windows and macOS systems to shut down the update service. On Windows, the update stops and disables the service via the Service Control Manager, leaving files intact and making no other changes to the system. For macOS, a shell script executes a command preventing the update process from starting again. Android devices were not addressed during this operation, as installing an update on that platform requires action from the user rather than a silent background change.

After uploading the disablement update to VirusTotal, the team was forced to adjust their approach. Security programs flagged the original file as malware and blocked it from executing. This failure to run meant that the vulnerable updater would have remained active on machines protected by those specific security programs, requiring a revision to the update file to bypass the block.

The scope of the exposure remains unclear, as the total number of devices at risk has not been publicly detailed. Eye Security stated that it distributed over 2 million update downloads before halting the process in March. Following the operation, the company transferred the domains used during the mitigation process to the Shadowserver Foundation, a web security non-profit organization, to ensure continued control over the infrastructure.