Popcorn Time Apps Shut Down to Stop Potential Zombie Army Threat

Remember Popcorn Time, the app that made streaming torrents of movies and TV shows a breeze? Although development on this notorious app has been dormant for years, it remains installed on millions of devices, potentially turning them into a bot army. Researchers at Eye Security discovered that the updater for a Popcorn Time fork known as “Time4Popcorn” is still active on numerous Windows, macOS, and Android devices worldwide. This updater connects to abandoned web domains using unencrypted HTTP and operates on an outdated, insecure version of Chrome.

Niels Teusink from Eye Security noted that this updater could be exploited to install and run virtually any software with full privileges, making it easy for someone to create a botnet by taking control of one of the domains, executing a man-in-the-middle attack on specific devices, or conducting surveillance on machines running the software.

To tackle the issue, they registered one of the domains and sent out their own update instructing the updater to disable itself. Despite ethical dilemmas surrounding this approach, the researchers felt their only other option was inaction, emphasizing that the update process was non-functional and posed risks to users.

For Windows devices, their update simply halts and disables the service via the Service Control Manager without deleting any files. On macOS, it employs a shell script to execute a command that prevents the update process from initiating. They did not address the situation on Android devices, where user interaction is still required to install the update.

After uploading their update to VirusTotal, they had to modify it due to security programs flagging it as malware, which resulted in the vulnerable updater remaining active. While the exact number of at-risk devices is unclear, Eye Security reported distributing over 2 million update downloads by March, when they ceased updates and transferred the domains to the Shadowserver Foundation, a non-profit focused on web security.