Dead app updater quietly disabled

Millions of computers and phones likely had a silent background process stopped this week. This change affects people who installed Popcorn Time years ago and never removed it. The software is no longer updated, but the old files can still run. Researchers acted to prevent these dormant apps from becoming a security risk for everyday users.

The core issue involves a fork of the original program called Time4Popcorn. Eye Security found that its updater was still active on Windows, macOS, and Android devices. The updater checked for new files by contacting web addresses that were no longer owned by anyone. It used unencrypted connections and relied on an old, insecure version of Chrome. This setup left the door open for attackers to install any software with full control over the machine.

An attacker could have taken over one of the abandoned web addresses to build a botnet. They could also have targeted specific devices using a man-in-the-middle attack. This would have allowed them to monitor which machines were running the software. Niels Teusink from Eye Security described the weakness as serious because it granted such high levels of access.

The team decided to register one of the abandoned domains themselves. They used it to send a final update that told the software to turn itself off. They admitted this approach raised ethical questions. However, they stated the only other option was to do nothing. They noted that the update process was not providing any useful function and was only creating risk.

The Windows update simply stops the service through the system controls. It does not delete files or make other changes. On macOS, a script prevents the update process from starting. Android devices were left alone because they require user action to install updates. The team had to tweak their update after security software flagged the original file as malware. This initially blocked the fix on some machines.

The total number of at-risk devices remains unknown. Eye Security reported sending out more than two million update downloads by March. They stopped distributing the update at that time. The company then handed the web addresses to the Shadowserver Foundation, a non-profit focused on web security.

This incident highlights the long tail of abandoned software. Even when developers stop working on an app, the code on your device can still connect to the internet. Users who installed these tools in the 2010s may not realize the background processes were still active. The fix removes the immediate risk of remote takeover for the Windows and Mac users who received the update.