Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Source SecurityWeek
Mentions 1 CVE
Mentioned vulnerabilities
Description
The Popcorn Time fork Time4Popcorn included an insecure updater that ran at system boot and polled update domains over unencrypted HTTP, executing any code served with full system privileges. The updater lacked code signing and was abandoned, leaving millions of Windows, macOS, and Android systems exposed to potential takeover by attackers serving malicious updates. Eye Security researchers registered abandoned update domains and pushed an update to disable the updater on Windows and macOS, significantly reducing risk. However, the underlying application remains vulnerable, and Android systems require user interaction to disable the updater. The recommendation is to uninstall Popcorn Time due to its outdated and insecure architecture.