Abandoned Popcorn Time Updater Left Millions of Computers Open to Takeover

Eye Security has disabled the flawed updater for most affected machines, but Android users must act themselves and the app should be removed.

Eye Security found that an abandoned Time4Popcorn fork, distributed as Popcorn Time, ran a background updater that fetched and executed code over unencrypted HTTP from domains that were lapsed or parked by third parties. Registering one of those domains let the researchers see millions of machines checking in, roughly 2.5 to 3 million on Windows plus 250,000 to 350,000 on macOS and under 200,000 on Android, including networks belonging to governments and militaries. Because nobody maintains the project, Eye Security registered 15 domains and pushed an update that disabled the mechanism, reaching about 2 million systems and cutting update requests by 98 percent. Android users still need to act themselves, and the Shadowserver Foundation has since taken over the domains. The researchers advise uninstalling the application, since its 2014-era Chromium base remains exposed to other risks.