Old Popcorn Time App Left Hundreds of Thousands of Macs at Risk

Security firm Eye Research has detailed a significant vulnerability affecting users who installed an unofficial version of the once-popular movie streaming app Popcorn Time years ago. Parts of the application may still be running in the background, leaving systems open to potential cyberattacks even if the app hasn't been opened in years.

• The app left behind a background update checker that scanned for updates every time the Mac started up.
• The helper tool blindly trusted whatever it downloaded and granted it full permissions to modify the system.
• Because developers abandoned the project long ago, the website addresses used by the helper were expiring.
• Researchers disabled the vulnerable checker on over a million devices and handed domains to Shadowserver.

The Danger of Abandoned Software and Vulnerable Updaters

The specific variant in question is Time4Popcorn, an unofficial distribution that utilized the Popcorn Time name. Its update mechanism contacted external servers upon every system boot without proper authentication or validation of downloaded files, giving any malicious payload full administrative privileges over the macOS environment.

With the original developers having abandoned the project years prior, the domain names utilized by the helper utility were beginning to lapse. This meant malicious actors could potentially seize control of these addresses to distribute malware to affected machines. Fortunately, Eye Research reported no evidence that criminals exploited this oversight.

Scope of the Issue and Mitigation Efforts

Researchers estimate that between 250,000 and 350,000 Mac computers were directly affected by the vulnerability. With no official developer available to issue a security patch, the research team was forced to weaponize the update mechanism itself to disable the threat across more than a million total Mac and Windows machines.

Following the intervention, the researchers transferred control of the reclaimed domain addresses to the Shadowserver Foundation, a nonprofit cybersecurity organization. Despite these measures, the fix does not resolve all underlying vulnerabilities present within the legacy software.

What This Means for Users

Because some updated addresses remain outside of the researchers' control and other software flaws persist, security experts advise a straightforward solution: completely uninstall the application. Since Time4Popcorn was distributed under the main Popcorn Time moniker, users may not necessarily know if their specific installation is compromised.

Conducting a thorough cleanup of legacy applications and removing abandoned streaming tools is strongly recommended to protect personal systems from potential botnet recruitment and unauthorized access.