Abandoned Popcorn Time software poses security risks for users
Security researchers have identified that defunct versions of the Popcorn Time streaming application remain active on millions of devices, leaving users vulnerable to malicious hijacking.
The application known as Popcorn Time, a platform for streaming torrented media that gained popularity in the 2010s, is presenting a significant security threat long after its active development ceased. Research from Eye Security reveals that versions of the software, specifically a fork titled "Time4Popcorn," continue to operate on Windows, macOS, and Android systems.
These residual applications are programmed to periodically check abandoned web domains for updates. Because these domains are no longer secured and use unencrypted HTTP connections, they provide an entry point for cybercriminals. By hijacking these domains, attackers can push malicious updates to the millions of devices still running the outdated software.
The danger is compounded by the application's reliance on an outdated, insecure version of the Chrome browser. According to Eye Security researcher Niels Teus, the vulnerability effectively turns active installations into potential nodes for a botnet, allowing bad actors to control devices remotely. Users are advised to remove all versions of the software to eliminate the risk of unauthorized system access.