Eye Security Hijacks Orphaned Time4Popcorn Updater to Shut It Down

Eye Security has disabled a still-running updater for Time4Popcorn, a fork of the Popcorn Time streaming app, by pushing its own update to the affected machines. The updater was found on Windows, macOS and Android devices worldwide, according to The Verge.

Development of Popcorn Time itself has been abandoned for years, yet the software remains installed on millions of devices. The Time4Popcorn updater was still phoning home to web domains that have since been abandoned, and it did so over unencrypted HTTP. The updater also ran an outdated, insecure version of Chrome.

Those weaknesses made the updater a serious liability. Eye Security researcher Niels Teusink said it could have been used to install and run "basically any software with full privileges." The traffic was plaintext, the domains were unowned, and the client accepted whatever it was served. Anyone who acquired a lapsed domain could, in principle, have pointed the updater at a payload of their choosing.

Eye Security took the opposite course. It registered one of the abandoned domains and used it to send an update instructing the updater to disable itself. The implementation differed by platform:

• On Windows, the update stops and disables the service through the Service Control Manager without deleting any files.
• On macOS, the update uses a shell script to block the update process from starting.
• On Android, installing the update would still require actual user interaction.

Eye Security sent out more than 2 million update downloads before it stopped sending the update in March. It then transferred the domains it had used to the Shadowserver Foundation, a web security non-profit.

The rollout did not go cleanly. Uploading the update to VirusTotal caused security programs to flag it as malware and block it, which meant the vulnerable updater kept running on machines where the update was blocked. Eye Security had to tweak the update after upload before it could be delivered as intended.

In my view, the episode is a useful case study in how orphaned software becomes a supply-chain problem that outlives its developers. The updater was built to trust a network endpoint that no one maintained, and the only party able to close the gap was one that could claim a domain, deliver a signed-or-trusted payload, and get past the same detection heuristics that flag malware. Remediation of a fleet that nobody maintains depends on that kind of improvisation.

The broader context here is the detection problem. A defensive update that disables a service and blocks a process looks, to a heuristic engine, much like the behavior it is meant to remove. The VirusTotal episode shows that defenders attempting cleanup at scale have to anticipate their own tooling flagging them. That is an operational lesson, not a verdict on any party.

There is also a more constructive reading. Eye Security's approach relied on the updater's existing update mechanism rather than on a new install path, and it targeted the component itself rather than the user. For operators managing abandoned clients, that suggests the update channel can serve as a remediation path when the software's own developers are gone. It is a precedent with limits, since it depended on a domain that was still reachable and a client that still polled it, but it is a workable one.

What remains for the affected devices is the Popcorn Time software itself, which is still installed on millions of machines. Removing the updater's ability to fetch code does not uninstall the application, so users and administrators with those installs still have to decide whether to remove them.