Abandoned Popcorn Time updater left millions of devices open to botnet takeover

Eye Security found the updater for the Time4Popcorn fork still running on millions of Windows, macOS and Android devices, contacting abandoned domains over unencrypted HTTP and launching an outdated Chrome. Hijacking a domain could have let attackers install any software with full privileges; the researchers registered one and pushed an update that disables the updater.

• Time4Popcorn updater phoned home over HTTP and ran an outdated Chrome
• Hijacking a domain could install any software with full privileges and build a botnet
• Eye Security sent over 2 million update downloads before stopping in March
• The domains were handed to the Shadowserver Foundation