Security researchers at Eye Security discovered that an outdated updater associated with a Popcorn Time fork called “Time4Popcorn” remained active on millions of Windows, macOS, and Android devices globally. The updater was phoning home to abandoned web domains over unencrypted HTTP and ran an outdated version of Chrome, creating significant security vulnerabilities.
According to Eye Security researcher Niels Teusink, the updater’s architecture could have allowed malicious actors to install and execute arbitrary software with full system privileges. This vulnerability could have been exploited through domain takeovers, man-in-the-middle attacks targeting specific devices, or surveillance operations to identify affected machines. The inactive update process posed an ongoing risk despite no longer serving any legitimate function.
To address the threat, Eye Security registered one of the domains used by the updater and deployed their own update instructing the software to disable itself. The researchers acknowledged ethical considerations surrounding this approach but stated that inaction would have left users exposed to greater risks. On Windows systems, the fix disabled the service through the Service Control Manager without removing files. For macOS, a shell script blocked the update process from initiating. Android devices required additional user interaction to install the update.
After the update was submitted to VirusTotal, security software flagged it as malware and blocked its distribution, leaving the original vulnerable updater operational. Eye Security reported deploying over 2 million update downloads by March, at which point they ceased distribution and transferred the registered domains to the Shadowserver Foundation, a nonprofit web security organization. The exact number of affected devices remained unclear, though the scale of affected systems underscored the ongoing risks posed by abandoned software infrastructure.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI