Eye Security disables insecure Popcorn Time updater on multiple operating systems

Eye Security registered a domain to distribute an update that disables the Time4Popcorn updater on Windows, macOS, and Android devices. The original Popcorn Time development was abandoned for several years, yet the updater continued to function.
The updater communicated with abandoned web domains using unencrypted HTTP and ran an insecure, outdated version of Chrome. Niels Teusink stated the updater could have been used to install and run basically any kind of software with full privileges.
On Windows, the update stops and disables the service via the Service Control Manager, while the macOS version uses a shell script to block the process from starting. Eye Security did not address the software on Android devices, but security programs on VirusTotal flagged the update as malware and blocked it.
Over 2 million update downloads were sent out by March, and Eye Security subsequently transferred the domains to the Shadowserver Foundation.





