{"id":655147,"date":"2026-10-23T21:04:09","date_gmt":"2026-10-23T21:04:09","guid":{"rendered":"https:\/\/www.newsbeep.com\/il\/655147\/"},"modified":"2026-10-23T21:04:09","modified_gmt":"2026-10-23T21:04:09","slug":"abandoned-popcorn-time-apps-had-to-be-disabled-to-prevent-a-zombie-army","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/il\/655147\/","title":{"rendered":"Abandoned Popcorn Time apps had to be disabled to prevent a zombie army"},"content":{"rendered":"

Remember Popcorn Time<\/a>, the app that served as an easy-to-use front end for streaming torrents of movies and TV shows? Development of the MPAA\u2019s least-favorite app of the 2010s has been abandoned for years<\/a>, but the \u201cNetflix of Piracy\u201d software is still installed on millions of devices that are just waiting to join a bot army. Researchers at Eye Security<\/a> found the updater for a Popcorn Time fork called \u201cTime4Popcorn\u201d still running on tons of Windows, macOS, and Android devices located around the world, phoning home to now-abandoned web domains over unencrypted HTTP and running an outdated, insecure version of Chrome.<\/p>\n

Eye Security\u2019s Niels Teusink says the updater could have been used to install and run basically any kind of software with full privileges, easily enabling someone to create a botnet just by taking over one of the domains, using a man-in-the-middle attack to target specific devices, or perform surveillance by identifying the machines running the software.<\/p>\n

Their solution was to register one of the domains and use it to send their own update that instructed the updater to disable itself. Despite ethical concerns about the fix, the researchers say their only alternative \u201cwas to do nothing,\u201d pointing out, \u201cThe update process wasn\u2019t doing anything functional anyway, it was only creating risk for users.\u201d<\/p>\n

Eye Security said on Windows devices, their update \u201csimply stops and disables the service via the Service Control Manager\u201d without deleting any files or anything else. On macOS, it uses a shell script to execute a command that blocks the update process from starting. They didn\u2019t address the software on Android devices, where installing the update would still require actual user interaction first.<\/p>\n

They had to tweak their update after it was uploaded to VirusTotal, causing security programs to flag it as malware and block it while leaving the vulnerable updater running. It\u2019s unclear exactly how many devices were at risk, but Eye Security says it \u201csent out over 2 million update downloads\u201d by March, when they stopped sending the update and transferred the domains they used to the Shadowserver Foundation<\/a>, a web security non-profit.<\/p>\n","protected":false},"excerpt":{"rendered":"Remember Popcorn Time, the app that served as an easy-to-use front end for streaming torrents of movies and…\n","protected":false},"author":2,"featured_media":655148,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[146,85,46,43,140,9028,920,125],"class_list":["post-655147","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-entertainment","tag-il","tag-israel","tag-news","tag-security","tag-streaming","tag-tech","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/655147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/comments?post=655147"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/655147\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media\/655148"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media?parent=655147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/categories?post=655147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/tags?post=655147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}