Eye Security Switches Off an Abandoned Popcorn Time Fork's Updater

Eye Security has disabled a still-running updater for Time4Popcorn, a fork of the Popcorn Time streaming app, by pushing its own update to the affected machines. The updater was found on Windows, macOS and Android devices worldwide, according to The Verge.

Development of Popcorn Time itself has been abandoned for years, yet the software remains installed on millions of devices. The Time4Popcorn updater was still contacting web domains that have since been abandoned, and it did so over unencrypted HTTP, so the traffic could be read or altered in transit. The updater also ran an outdated, insecure version of Chrome.

Those weaknesses made the updater a serious liability. Eye Security researcher Niels Teusink said it could have been used to install and run "basically any software with full privileges." The traffic was plaintext, the domains were unowned, and the client accepted whatever it was served. Anyone who acquired a lapsed domain could, in principle, have pointed the updater at a payload of their choosing.

Eye Security took the opposite course. It registered one of the abandoned domains and used it to send an update instructing the updater to disable itself. The implementation differed by platform:

• On Windows, the update stops and disables the service through the Service Control Manager, the Windows component that manages background services, without deleting any files.
• On macOS, the update uses a shell script to block the update process from starting.
• On Android, installing the update would still require actual user interaction.

Eye Security sent more than 2 million update downloads before it stopped sending the update in March. It then transferred the domains it had used to the Shadowserver Foundation, a web security non-profit.

The rollout did not go cleanly. Uploading the update to VirusTotal, a service that scans files with multiple antivirus engines, caused security programs to flag it as malware and block it. The vulnerable updater therefore kept running on machines where the update was blocked. Eye Security had to tweak the update after upload before it could be delivered as intended.

In my view, the episode is a useful case study in how orphaned software becomes a supply-chain problem that outlives its developers. The updater was built to trust a network endpoint that no one maintained. The only party able to close that gap was one that could claim a domain, deliver a trusted payload, and get past the same detection heuristics that flag malware. Cleaning up a fleet that nobody maintains depends on that kind of improvisation.

The broader context here is the detection problem. A defensive update that disables a service and blocks a process looks, to a heuristic engine, much like the behavior it is meant to remove. The VirusTotal episode shows that defenders cleaning up at scale have to anticipate their own tooling flagging them. That is an operational lesson, not a verdict on any party.

There is also a more constructive reading. Eye Security relied on the updater's existing update mechanism rather than a new install path, and it targeted the component itself rather than the user. For operators managing abandoned clients, the update channel can serve as a remediation path when the original developers are gone. It is a precedent with limits, since it depended on a domain that was still reachable and a client that still polled it, but it is a workable one.

The Popcorn Time software itself is still installed on millions of machines. Removing the updater's ability to fetch code does not uninstall the application, so users and administrators with those installs still have to decide whether to remove them.