The Time4Popcorn app has long been abandoned, but its updater is still running on Windows, macOS, and Android devices around the world. It contacts an old domain over unencrypted HTTP and uses an outdated, insecure version of Chrome.
Eye Security warned that the updater could be used to install virtually any software with full system privileges, potentially turning devices into part of a botnet or enabling surveillance of targeted machines. They therefore sent an update instructing the updater to shut itself down, since the update process no longer served any purpose and only increased users’ risk. On Windows, it stops the service; on macOS, it blocks the process from starting.
When an Old Movie App Becomes a Gateway to a Botnet
An old app may still be sitting on a device even after its development team stopped maintaining it years ago. In the case of Time4Popcorn, the updater still contacts an abandoned domain over unencrypted HTTP while using an outdated and insecure version of Chrome.
For ordinary users, this is like leaving a back door open on Windows, macOS, and Android. The device is not merely running a movie app; it is also receiving connections from an update system that no one maintains anymore.
Eye Security said the risk comes from the updater continuing to run even though the app itself has been abandoned. Old software can therefore become a point of entry for others to access a device without the owner noticing.
An Abandoned App That Has Not Stopped Working
Time4Popcorn is a fork of Popcorn Time, an app that once served as an interface for watching movies through torrents. Its development was abandoned several years ago.
The problem is that its updater is still active on Windows, macOS, and Android devices worldwide, despite having no team maintaining it. The software continues trying to contact an old domain over unencrypted HTTP while using an outdated and insecure version of Chrome.
The Risk Hidden on an Old Computer
Have you ever installed Popcorn Time to watch movies and then forgotten that it was still on your device? Although the app was abandoned years ago, its updater is still running and attempting to contact an old domain over unencrypted HTTP.
The risk is not limited to watching movies. The updater can install and launch almost any type of software with full system privileges. If someone takes over the old domain or intercepts the connection, they could turn the device into part of a botnet or use it for surveillance.
Where Time4Popcorn Fits Into the Story
Popcorn Time was an app that served as an interface for streaming movies and TV shows through torrents, earning it the nickname “Netflix of Piracy.” However, its development was abandoned long ago.
Time4Popcorn is a fork of Popcorn Time, not a new product with an active development team. The still-running updater is an old component of this fork and has become a separate security risk from using the original app.
From a Streaming App to Software That Should Be Disabled
Popcorn Time was once a user-friendly front end for streaming movies and TV shows through torrents, earning it the nickname “Netflix of Piracy.” Today, however, Time4Popcorn is left with an abandoned updater, and the update process no longer serves any necessary purpose.
| Factor | Popcorn Time during active use | Time4Popcorn updater today |
|---|---|---|
| Role | Front end for streaming torrents | Update component of an abandoned fork |
| Benefit identified by the source | Provided access to movies and TV shows | No longer performs a necessary function |
| Risk | Software for streaming | Creates risks through HTTP and insecure software |
How the Risk Works in Real-World Situations
-
Old domain and HTTP: The updater still contacts an abandoned domain over unencrypted HTTP. If someone takes over the domain or intercepts the communication, they could send a malicious update file.
-
Targeting specific devices: A man-in-the-middle attack makes it possible to target selected devices instead of distributing the attack to everyone.
-
Elevated privileges: The updater may install and run almost any software with full system privileges, creating the possibility of turning these devices into part of a botnet.
-
Identifying devices for surveillance: The callback connection can also reveal which devices have the software installed, allowing attackers to select target devices for surveillance.
No Competitors to Compare, but Options for Responding
The source provides no information about competing products or alternative software, so additional details should not be invented. Instead, this table compares the approaches described in the report.
| Factor | Leave the updater running | Send an update to disable it | Transfer the domain to the Shadowserver Foundation |
|---|---|---|---|
| Effect on risk | Continues to create risk | Reduces the updater’s activity | Places it under the care of a security organization |
| Action taken | Do nothing | Send an update through the domain | Transfer the domain in use |
| Status in the report | The original option | Used by Eye Security | Transferred after updates were stopped |
Pros and Cons of Eye Security’s Solution
The solution stops the risk from the abandoned updater. On Windows, it simply stops and disables the service without deleting the files. On macOS, it uses a command to block the update process from starting. In addition, the original updater no longer performs any necessary function.
Pros
- +Stops the service on Windows without deleting the files
- +Blocks the update process on macOS
- +Reduces the risk from an updater with no necessary function
Cons
- −Android users still need to install the update themselves
- −The update was detected as malware by security software
- −The update had to be modified so it could be delivered
The Price Users Pay Without a Price Tag
The cost of this old app is not an app fee, but the risk created by an updater with elevated privileges that could be used to install and launch unwanted software on a device if the domain were taken over or a man-in-the-middle attack were carried out.
Users could also have their devices identified for surveillance and may need to check which old programs are still running. This burden exists even though the updater no longer performs any necessary function, and the source does not state the financial value of any potential damage.
When Shutting Down Software Becomes Controversial
Eye Security registered Time4Popcorn’s domain and sent an update instructing the updater to shut itself down. The action is controversial because researchers altered the behavior of software on users’ devices, even though the goal was to stop the risk.
Eye Security explained that the alternative was to “do nothing,” since the update process no longer served any purpose. However, that would leave an opening for malicious actors to install software and take control of devices. On Windows, the update only stops and disables the service without deleting the files. On macOS, it uses a command to block the update process from starting.
Lessons from an Unmaintained Updater
The key lesson is that risks do not always come from popular apps currently under active development. They may also be hidden in old software that users have forgotten to uninstall and that still connects to its original domain over unencrypted HTTP.
Check old programs on Windows, macOS, and Android to see whether they are still installed, especially apps that are no longer being developed. A forgotten updater could become a gateway for a device to join a botnet.