5 ms·

Interesting note: there are now two apps in the Google Play Store under Spotify Ltd. The first one -- Spotify, is the existing app. https://play.google.com/stor

by Shank 12y ago

Interesting note: there are now two apps in the Google Play Store under Spotify Ltd. The first one -- Spotify, is the existing app. https://play.google.com/store/apps/details?id=com.spotify.mobile.android.ui https://play.google.com/store/apps/details?id=com.spotify.mo... It has the package name 'com.spotify.mobile.android.ui'. The new one is 'Spotify Music,' which appears to be brand new. https://play.google.com/store/apps/details?id=com.spotify.music https://play.google.com/store/apps/details?id=com.spotify.mu... It has the package name 'com.spotify.music.' To me, this indicates that the signing keys for the Android app were also stolen during the breach.

6thSigma 12y ago
The hackers would also have to have control of Spotify's Google developer account.
- andymcsherry 12y ago
  Not necessarily, the app could be installed outside of Google Play. A user could click on an malicious web link that would download the application and prompt them to install, much like https://m.spotify.com/us/ https://m.spotify.com/us/ allows the user to do.
  - 6thSigma 12y ago
    The new app was submitted under Spotify's account though.
tokenizerrr 12y ago
I think if the signing keys had been compromised they could have released an update to the existing app, instead of having to list a new one. Wouldn't it be more likely that just the google play credentials (or api keys) have been compromised?
- dublinben 12y ago
  You can't update an app signed with key X to an app (.apk) signed with key Y. The package names must be different, otherwise you get nasty error, and you cannot update. Their users would be forced to uninstall the old app and reinstall the new one.
  - tokenizerrr 12y ago
    Isn't that basically what I just said?
Trellmor 12y ago
Probably not the signing keys, otherwise they could have uploaded a malicious app with the original package name.
ctz 12y ago
This looks like a reasonable explanation. The new app is signed by "CN=Spotify, OU=Android, O=Spotify, L=Stockholm, ST=Stockholm, C=SE", the old was signed by "CN=Anders Bond, OU=Mobile, O=Spotify, L=Stockholm, ST=Sweden, C=SE". The new key was generated on 2014/05/24.
maaarghk 12y ago
No, look here: https://support.spotify.com/us/problems/#!/article/downloading-android-update https://support.spotify.com/us/problems/#!/article/downloadi... That article has a link to com.spotify.music
- ctz 12y ago
  The article probably needs updating. Because right now `com.spotify.music` is just over 1MB (down from 15MB) and just shows this screen: http://i.imgur.com/lZYDyBt.png http://i.imgur.com/lZYDyBt.png Hitting the "Download" button takes you to the "Spotify Music" app page on the Play store.
  - maaarghk 12y ago
    It's the other way around. Go here: https://play.google.com/store/apps/details?id=com.spotify.mobile.android.ui https://play.google.com/store/apps/details?id=com.spotify.mo... Use this online tool to install on your device, then open it from the notification drawer and you'll get the screen above. Then do the same from here: https://play.google.com/store/apps/details?id=com.spotify.music https://play.google.com/store/apps/details?id=com.spotify.mu... and also scroll down and note that the size is 14MB - i.e. com.spotify.music is the new one. Anyway, whilst you had that wrong, I had misunderstood. I think Shank was saying that the signing keys for com.spotify.mobile.android.ui were stolen which is why they then changed it to com.spotify.music - which is a reasonable explanation. I had thought that he meant the attacker uploaded com.spotify.music or something. The reviews are a disaster though. I know those people are just the minority of morons who don't understand what's going on, but holy shit they shout loud. As a Spotify Premium customer I hope it doesn't cause them any major issues.

by Shank 12y ago

6thSigma 12y ago

The hackers would also have to have control of Spotify's Google developer account.

andymcsherry 12y ago
Not necessarily, the app could be installed outside of Google Play. A user could click on an malicious web link that would download the application and prompt them to install, much like https://m.spotify.com/us/ https://m.spotify.com/us/ allows the user to do.
- 6thSigma 12y ago
  The new app was submitted under Spotify's account though.

tokenizerrr 12y ago

I think if the signing keys had been compromised they could have released an update to the existing app, instead of having to list a new one. Wouldn't it be more likely that just the google play credentials (or api keys) have been compromised?

dublinben 12y ago
You can't update an app signed with key X to an app (.apk) signed with key Y. The package names must be different, otherwise you get nasty error, and you cannot update. Their users would be forced to uninstall the old app and reinstall the new one.
- tokenizerrr 12y ago
  Isn't that basically what I just said?

Trellmor 12y ago

Probably not the signing keys, otherwise they could have uploaded a malicious app with the original package name.

ctz 12y ago

This looks like a reasonable explanation. The new app is signed by "CN=Spotify, OU=Android, O=Spotify, L=Stockholm, ST=Stockholm, C=SE", the old was signed by "CN=Anders Bond, OU=Mobile, O=Spotify, L=Stockholm, ST=Sweden, C=SE". The new key was generated on 2014/05/24.

maaarghk 12y ago

No, look here: https://support.spotify.com/us/problems/#!/article/downloading-android-update https://support.spotify.com/us/problems/#!/article/downloadi... That article has a link to com.spotify.music

ctz 12y ago
The article probably needs updating. Because right now `com.spotify.music` is just over 1MB (down from 15MB) and just shows this screen: http://i.imgur.com/lZYDyBt.png http://i.imgur.com/lZYDyBt.png Hitting the "Download" button takes you to the "Spotify Music" app page on the Play store.
- maaarghk 12y ago
  It's the other way around. Go here: https://play.google.com/store/apps/details?id=com.spotify.mobile.android.ui https://play.google.com/store/apps/details?id=com.spotify.mo... Use this online tool to install on your device, then open it from the notification drawer and you'll get the screen above. Then do the same from here: https://play.google.com/store/apps/details?id=com.spotify.music https://play.google.com/store/apps/details?id=com.spotify.mu... and also scroll down and note that the size is 14MB - i.e. com.spotify.music is the new one. Anyway, whilst you had that wrong, I had misunderstood. I think Shank was saying that the signing keys for com.spotify.mobile.android.ui were stolen which is why they then changed it to com.spotify.music - which is a reasonable explanation. I had thought that he meant the attacker uploaded com.spotify.music or something. The reviews are a disaster though. I know those people are just the minority of morons who don't understand what's going on, but holy shit they shout loud. As a Spotify Premium customer I hope it doesn't cause them any major issues.