Abandoned Software Updaters Pose Million-Machine Risk
A decade-old vulnerability in an abandoned BitTorrent client's updater was patched by researchers, preventing attackers from hijacking millions of Windows and Mac machines.
Security researchers at Eye Security have successfully patched a critical vulnerability in a decade-old, abandoned software project, preventing a potential widespread compromise of millions of user machines. The vulnerability resided within the update mechanism of a modified version of Popcorn Time, a BitTorrent client originally released in 2014. Despite the software being long abandoned by its original developers, its persistent updater continued to run on an estimated 2.5 million Windows machines and 300,000 Macs, actively checking for new software.
The core issue stemmed from the updater's reliance on domains that were no longer actively managed by the original developers. These domains had become available for registration, creating a significant security risk. An attacker could register these abandoned domains and then control the update process, effectively distributing malicious software with high privileges to millions of unsuspecting users. Eye Security noted that users installed Popcorn Time, but they did not consent to having a forgotten updater running in the background, ready to execute arbitrary code.
This incident highlights a growing problem of "undead" software projects and their associated legacy infrastructure. As developers abandon projects or sell off their assets, the domains and update servers they relied upon can become targets for opportunistic attackers. This practice, often referred to as "dropcatching," involves registering domains that were previously associated with legitimate services. Researchers have previously found millions of HTTP requests still being made to abandoned cloud storage buckets, demonstrating the persistent reach of old infrastructure.
The increasing sophistication of AI tools is exacerbating this threat. Attackers can leverage AI to more efficiently analyze software projects, identify abandoned infrastructure, and discover potential backdoors. AI can assist in reverse engineering, identifying software communication patterns, and pinpointing unregistered or hijacked domains, thereby lowering the barrier to entry for such exploitation.
Eye Security's researchers took proactive steps to mitigate the risk. By reverse-engineering the updater, they were able to modify its code to point to a safe executable, effectively neutralizing the threat. They emphasized that the process involved no code signing and occurred over HTTP, making it vulnerable to man-in-the-middle attacks if not for their intervention. It is important to note that this issue is unrelated to a separate, legitimate streaming service project also named Popcorn Time, launched in 2025.
This situation underscores the critical need for organizations to maintain visibility into the domains their employees' software communicates with, especially in remote work environments where the traditional network perimeter has dissolved. Proactive monitoring and protection of remote users are essential. Furthermore, the security community is encouraged to collaborate on identifying and disrupting such domain drop schemes by proactively securing high-value domains before malicious actors can exploit them.
The implications of such vulnerabilities are far-reaching. A successful hijacking of the Popcorn Time updater could have led to widespread malware infections, data breaches, or ransomware attacks across millions of endpoints. The ease with which attackers could have executed arbitrary code with system privileges, combined with the sheer scale of affected machines, made this a significant, albeit hidden, threat.