Abandoned Time4Popcorn Updaters Still Contact Old Domains, Researchers Find
Eye Security found Time4Popcorn updaters running on Windows, macOS and Android devices, The Verge reports. They contacted abandoned domains over unencrypted HTTP; the brief account does not establish a completed takeover.
The Short Version
Eye Security researchers found that updaters for Time4Popcorn, a fork of the Popcorn Time streaming app, were still running on Windows, macOS and Android devices, according to The Verge.
The software was contacting abandoned web domains over unencrypted HTTP and using an outdated, insecure Chrome version, the publication reports.
Why It Matters
An app’s development ending does not necessarily stop the software already installed on a device. In this case, the reported updater continued reaching out to infrastructure its original maintainers had left behind.
That makes the background component relevant even if someone no longer thinks of the app as an active service.
The Bigger Picture
The finding concerns a specific fork and its updater. It should not be read as proof that every Popcorn Time installation behaves identically.
Likewise, a potential route to abuse and a confirmed malicious takeover are different findings. The brief account describes the risky network behavior, but does not establish that a particular device had joined a botnet.
What to Watch
The available excerpt does not provide a complete affected-version list or explain the intervention suggested by the source’s headline. Details of what was disabled, and which installations were reached, would help establish how much risk remains.
For now, the supported lesson is narrower: software can keep communicating after its development and supporting infrastructure have been abandoned.
How do you decide when an old app is no longer worth keeping on your devices?
Connie Brew