Eye Security Disables 2 Million Popcorn Time Updaters to Block Botnet Risk
Updated
Updated · The Verge · Oct 23
Eye Security Disables 2 Million Popcorn Time Updaters to Block Botnet Risk
3 articles · Updated · The Verge · Oct 23
Summary
Over 2 million update downloads were sent to vulnerable Time4Popcorn installations, letting Eye Security disable abandoned updaters on Windows and macOS devices before they could be hijacked.
The researchers found the software still contacting dead domains over unencrypted HTTP and using an outdated Chrome component, flaws that could have let an attacker push code with full privileges or build a botnet.
Eye Security registered one of the abandoned domains and delivered a shutdown update; on Windows it stopped the service, while on macOS it blocked the updater from starting without deleting files.
Android devices were not remotely fixed because installation still required user interaction, and the team had to revise its update after antivirus tools initially flagged it as malware.
By March, Eye Security had stopped sending the update and handed the domains to Shadowserver, underscoring how long-abandoned software can remain a large-scale security risk.