SmartTube's signature has been compromised, possible injected malicious library found by some users

submitted by
edited

github.com/yuliskov/SmartTube/releases/tag/noti…

cross-posted from: https://lemmy.today/post/42851505

Slightly more detail in this GitHub issue, however much is still unknown, even after three or so days. The dev hasn’t revealed any further details. Some articles on this incident:

Note that the articles provide little detail on what’s happened, mostly just detail that a malicious library was found and Play Protect started removing the app if affected. It’s unclear which versions are specifically affected, how the dev got breached, and what the malware actually does. According to a user (who may or may not be using some sort of LLM, their comment sounds like one at least) in a separate, related issue, the malware may collect device info and send to a command & control server. It could (in theory) receive new instructions at any point if it’s a C2 server. Again, it does appear that they had an LLM of some sort generate their comment, so take it with a grain of salt.

I’m going to uninstall the app and revoke access on my Google account page. I see little reason to need to reset my password as of right now, since the app uses an API key and not my actual password. In my opinion, it’s possibly related to YT viewbotting and commenting, or to add your device to a botnet. It’s unclear to me how this botnet would work in practice, since even Android TV sandboxes apps (for the most part).

Update: it appears that this may be related to the Vo1d botnet: DrWeb: Android.Vo1d.14.origin. If this is indeed the case, then the goal was to add devices to the botnet. It’s my understanding that previous versions of this botnet typically required cheap, pre-rooted Android TV boxes, in order to install other apps. I’m not sure if that means that you’re safe if your device is not rooted. It might be worth checking your installed apps for oddities.

5
54
4

Log in to comment

Hot Top New Old

I loved SmartTube, but I moved away from my Android TV when Google started saying they are not going to allow side loading apps. Google has walked back that policy a bit, but I am much happier now with my alternatives and the knowledge that Google can’t wreck them with their future bull shit.

That said SmartTube is a goat and it is sad to hear that such a great app has been compromised like this.

 reply
5
OP

Curious, what did you do for an alternative?

 reply
4

Loaded Linux onto a spare desktop and use Freetube now with a VPN

 reply
7
OP

Hm, I’ve thought about using an HTPC for this myself, but haven’t gotten around to trying it. I’d prefer to be able to use my remote still..

 reply
1

I use a PS controller. Best part is you can choose what the buttons do and create actions

 reply
1

Comments in Technology@lemmy.zip

I’m having a moment - do users need to manually install the app again to receive the new version with the new digital signature associated?

 reply
8
OP

Yes, exactly.

You need to manually install the new version with the new signature.

 reply
6

The title doesn’t match the facts in the announcement.

Only signature of the developer was leaked which could have lead to unsafe releases, but the point is moot as the developer is changing the signature key moving forward.

 reply
5

There’s a lot unclear, but it seems that an actual compromised update was released on official infrastructure (and subsequently removed from some devices by Play Protect). A transparency statement from the developer is still forthcoming. I’m not risking anything, not even updating to the new app, until all the dust has settled.

 reply
7
edited

The app id is being changed, so there is no way to push new updates with that signature anymore. Hence the need to re-install the app.

Also it looks like the developer is adding VirusTotal scan workflow for all new releases moving forward.

That said, I’m not familiar with the developer or the situation enough to comfortably say it’s safe.

 reply
1
edited

I’m not concerned about the app id changing after a signature leak, in fact, it’s what I’d expect. I am concerned about if the new signature is from the actual dev or not, and the dev hasn’t really said much other than they’ll release a disclosure once their new build is pushed to fdroid. It’s been pushed as far as I can tell, and it’s still been silence from them. I’d recommend not installing either app until this gets sorted out, and revoking the app’s access to your account

 reply
2
OP

I edited the title to be more specific.

 reply
1
edited

Slightly more detail in this GitHub issue, however much is still unknown, even after three or so days. The dev hasn’t revealed any further details. Some articles on this incident:

Note that the articles provide little detail on what’s happened, mostly just detail that a malicious library was found and Play Protect started removing the app if affected. It’s unclear which versions are specifically affected, how the dev got breached, and what the malware actually does. According to a user (who may or may not be using some sort of LLM, their comment sounds like one at least) in a separate, related issue, the malware may collect device info and send to a command & control server. It could (in theory) receive new instructions at any point if it’s a C2 server. Again, it does appear that they had an LLM of some sort generate their comment, so take it with a grain of salt.

I’m going to uninstall the app and revoke access on my Google account page. I see little reason to need to reset my password as of right now, since the app uses an API key and not my actual password. In my opinion, it’s possibly related to YT viewbotting and commenting, or to add your device to a botnet. It’s unclear to me how this botnet would work in practice, since even Android TV sandboxes apps (for the most part)

 reply
1

Comments in Open Source@lemmy.ml

I wondered why my NVIDIA shield auto deleted the app. I had assumed Google was just throwing a fit about it

 reply
10

Good to know. Thank you for posting this.

 reply
12

Thanks for the recommendation, I’ve been wanting something like it for the TV for a while now.

 reply
1

So, my Shield auto deleted the app, what the go? Give it some tiime to work out and then redownload it or move onto something else (?)

 reply
1
OP

I downloaded TizenTube Cobalt as a replacement until the dust settles. Obviously similar attacks can happen with TizenTube, but if you want something that is clean right now, that’s the way to go.

 reply
1

They already released an updated version that’s clean and was built on a clean device. 30.56, I believe is the clean version.

 reply
1

There seems to be an alternative for ad-free youtube called TizenTube Cobalt. Gonna try it today.
https://github.com/reisxd/TizenTubeCobalt/releases

 reply
1
edited

Invidious has existed for many years, I would also suggest Piped but I’m pretty sure their development cycle is a lot slower.

 reply
3
OP

Do either of those work on Android TV?

 reply
3
edited

You will have time find applications that support the Invidious APi, I don’t personally use android/android-TV but on iOS/TvOS I use Yattee.

Given that I host my own instance and don’t typically use the public ones l can just visit my domain an get it with ease.

 reply
1

They are self-hosted web front ends for YouTube. So you’ll need to host the backend and frontend somewhere. Then you’ll just need a browser.

There are public instances but they are not reliable as they are shared with a lot of internet users, and YouTube blacklists them quickly.

 reply
1
OP

Yeah, I guess I knew what they were, but it seems like it would be rough to use on an Android TV in the browser compared to purpose built TV applications.

 reply
2
Insert image