A Dead App, a Live Update Channel, and a Two-Million-Update Fix

When a piece of software is abandoned by its developers, the infrastructure it left behind rarely disappears quietly. That was the situation Dutch security firm Eye Security confronted last year with Time4Popcorn, a long-abandoned fork of Popcorn Time — the free application that once let users stream pirated films and television shows over BitTorrent. According to The Hacker News, the firm spent roughly five months pushing more than 2 million updates to machines it did not own, all in an effort to switch off a background updater that researchers believed could be abused to take control of the host computer.

Why an Abandoned Updater Is Dangerous

Popcorn Time's core functionality depended on a background updater that periodically checked a remote server for new versions and installed them automatically. Once the project was abandoned, that updater became an orphaned trust channel: the client still trusted whatever the update endpoint told it to install, but nobody with legitimate authority was watching the server side.

That combination — automatic code execution plus an unmaintained distribution channel — is precisely the kind of weakness that botnet operators look for. An attacker who gained control of the update mechanism could, in principle, deliver arbitrary payloads to every installed copy, quietly converting a media player into a large, distributed network of compromised machines. The researchers' concern was not hypothetical malware already in the wild, but the latent capability sitting on user systems.

Turning the Weapon Into the Fix

Rather than attempt to contact individual users — an impractical task given that the software was distributed outside official channels and had no reliable user base to notify — Eye Security chose to work through the updater itself. Between November 2025 and March 2026, the firm delivered over 2 million updates through the same mechanism, each one designed to disable the updater and neutralize the risk.

The approach is a familiar one in vulnerability research: demonstrating that a hijacked update channel is exploitable often means using that channel to push a benign, defensive change. It is also ethically delicate. Pushing code to systems without the owners' consent is, on its face, unauthorized access — the researchers' justification rests on the argument that the alternative was leaving millions of installations exposed to whoever moved first, and that the delivered change only removed functionality rather than adding any.

The Broader Lesson: Orphaned Software Is Attack Surface

The episode highlights a category of risk that traditional vulnerability management tends to miss. CVE databases track flaws in supported products; they say little about software that has been abandoned but remains installed. Yet abandoned applications frequently retain auto-update routines, telemetry endpoints, and hardcoded domains — any of which can become a foothold if the associated infrastructure lapses or is acquired by someone with different intentions.

For organizations, the practical takeaways are straightforward:

  • Inventory what is actually installed. Shadow IT and consumer-grade applications on corporate endpoints are common, and abandoned software often hides in plain sight.
  • Treat auto-updaters as privileged components. An updater runs with the user's privileges and installs executable code; it deserves the same scrutiny as any remote code execution path.
  • Retire software deliberately. When an application is no longer needed, removing it eliminates the update channel along with it.
  • Monitor outbound update traffic. Unexpected connections to unfamiliar domains from endpoints are a useful detection signal.

What Remains Unclear

The reporting does not establish how many distinct machines received the updates, nor whether the update endpoint was ever actually compromised by a third party. It also leaves open the question of consent: users who installed Time4Popcorn never agreed to receive code from Eye Security, even code intended to protect them. That tension — between the collective benefit of defusing a dormant threat and the principle that systems belong to their owners — is likely to keep resurfacing as more abandoned projects leave live infrastructure behind.

What the case does demonstrate clearly is that the lifecycle of software does not end when its developers walk away. Someone, eventually, has to deal with what they left running.

Source: The Hacker News