A Security Firm Switched Off a Forgotten Streaming App's Updater

A security company has switched off a still-running updater for Time4Popcorn, a fork of the Popcorn Time streaming app. It did so by sending its own update to the affected computers. The updater was found on Windows, macOS and Android devices around the world, according to The Verge.

Nobody has worked on Popcorn Time for years. The software is still installed on millions of devices.

The Time4Popcorn updater kept contacting web addresses that had been abandoned. It sent that traffic without encryption, so anyone on the same network could read it. It also ran an old, insecure version of Chrome, the web browser engine.

That made the updater a serious risk. Niels Teusink, a researcher at Eye Security, said it could have been used to install and run "basically any software with full privileges." The traffic could be read, the domains had no owner, and the program accepted whatever it was sent. Anyone who bought one of those lapsed domains could, in principle, have sent it software of their choice.

Think of a delivery driver who follows any instructions left at an old address, without checking who wrote them.

Eye Security did the opposite. It registered one of the abandoned domains and used it to send an update telling the updater to turn itself off. The method differed by platform:

• On Windows, the update stops and disables the service using a built-in Windows tool. No files were deleted.
• On macOS, the update runs a shell script that stops the update process from starting.
• On Android, the user would still have to take action before the update installed.

Eye Security sent more than 2 million update downloads before it stopped in March. It then handed the domains to the Shadowserver Foundation, a web security non-profit.

The rollout did not go smoothly. When the update was uploaded to VirusTotal, a service that scans files with many security programs, some of those programs flagged it as malware and blocked it. As a result, the vulnerable updater kept running on machines that blocked the fix. Eye Security had to adjust the update after uploading it before it could be delivered as planned.

In my view, this episode shows how old software can become a security problem that outlives the people who wrote it. The updater was built to trust an online address that nobody looked after. The only party able to close that gap was one that could claim the domain, send a trusted update, and get past the same detection tools that catch malware. Cleaning up software that no one maintains depends on that kind of improvisation.

The broader context here is the detection problem. A fix that turns off a service and blocks a process looks, to an automated scanner, much like the malware it is meant to remove. The VirusTotal episode suggests that anyone cleaning up at scale should expect their own tools to raise alarms. That is a practical lesson, not a judgment about anyone involved.

In my view, there is also a more hopeful reading. Eye Security used the updater's existing update system instead of installing something new, and it targeted the software itself rather than the user. For people who manage abandoned programs, that suggests the update channel can be a way to fix things after the original developers are gone. It has limits. It worked because a domain was still reachable and the program still checked it. Even so, it is a workable approach.

What remains is the Popcorn Time software itself. Stopping the updater from downloading code does not remove the app. Users and administrators who have it installed still need to decide whether to uninstall it.