Old 'Popcorn Time' App Left Macs at Risk

An abandoned unofficial Popcorn Time app called Time4Popcorn left a security risk on Macs long after users stopped opening it. A small update checker continued running whenever an affected Mac started, contacting update addresses and trusting the files it received. Because the checker had permission to make changes across the computer, someone who took over an expired address could have used it to install malicious software. Security researchers at Eye Research found no evidence that attackers had exploited the flaw, but estimated that 250,000 to 350,000 Macs were exposed.

With the developers gone, there was no official update to fix the problem. Eye Research took control of an abandoned address and used the checker to disable itself on more than a million Macs and Windows PCs, then transferred the addresses it secured to the cybersecurity nonprofit Shadowserver Foundation. That intervention does not remove other vulnerabilities in Time4Popcorn, and some update addresses remain outside the researchers’ control. The researchers therefore recommend uninstalling the app if it is still present. Since Time4Popcorn was distributed under the Popcorn Time name, users may not recognize that their old copy is the affected version.