Because the updater checked those lapsed domains, anyone who registered one could have pushed software to the devices with full privileges, according to Eye Security's Niels Teusink. That would have allowed a botnet, targeted attacks via a man-in-the-middle interception, or surveillance by identifying machines running the software.

The researchers' fix was to register one of the domains and send their own update telling the updater to disable itself. They acknowledged the ethical concerns but said their only alternative "was to do nothing," noting the update process "wasn't doing anything functional anyway, it was only creating risk for users." On Windows the update stops and disables the service without deleting files; on macOS a shell script blocks the updater from starting. Android devices were not addressed, since installing anything there would still need user interaction.

It is unclear exactly how many devices were at risk, but Eye Security says it sent out over 2 million update downloads by March, when it stopped and handed the domains to the Shadowserver Foundation, a web security non-profit. The team also had to tweak its update after VirusTotal flagged it as malware, which caused security programs to block it while leaving the vulnerable updater running.