Operation IXIM: Preventing a botnet of millions of PopCorn Time users#

Niels Teusink (Eye Security)

• Why: The clearest possible case study that update endpoints are long-lived critical infrastructure: abandoned software whose updater never stopped phoning home to expired domains.
• What: During threat hunting, the authors found millions of systems still running the Time4Popcorn updater, connecting to unregistered domains; registering one exposed millions of unique hardware IDs per month. The update mechanism has no meaningful security — the right domain registration would have yielded instant compromise of millions of machines including government, military, and corporate networks (CVE-2026-30612). The talk covers the RE of Windows/macOS updater binaries, hardware-ID generation bugs, AV interactions, and the ethics/legality of a possible "benevolent update" to disable the service at scale.
• How: Domain takeover of unregistered update endpoints; insecure (unverified) update delivery.
• Where applicable: Any fleet where abandoned consumer software persists — the transferable lesson is update-URL lifecycle governance, which applies to your own products' update infrastructure too. (from abstract only)