SmartTube Compromised

aftvnews.com

163 points by akersten 3 days ago


sfRattan - 3 days ago

Announcement from the dev, in the project GitHub and Patreon:

Friends, it seems that my digital signature has been exposed. This signature protects the app from fake and malicious updates, so there is a risk that someone may try to release counterfeit versions under my name.

To completely eliminate any threats, I’ve decided to stop using the current signature and switch to a new one. Because of this, the app’s identifier will also change. You don’t need to delete the old app (but it will no longer receive updates) — the new one will install as a separate app and will need to be configured again.

Thank you for your understanding and attention to security.[1][2]

---------------

There aren't any new apk releases on GitHub yet. However, concerningly, the SmartTube website (which I won't link directly) still offers undated "Stable" and "Beta" downloads.

It sucks to deal with security breaches as an indie or solo dev, but I'll be waiting for a more detailed postmortem before assessing whether to install a future release... Hopefully one that details new security procedures to guard both the dev's key and the production build environment.

Factory resetting my Shield as a precaution, but nothing sensitive was really on there, and Android's security model did exactly what it was supposed to and limited the damage. When using a third party app like this, it's prudent to use it signed out or else with a purpose specific Google/YouTube account which is connected to nothing else critical.

[1]: https://github.com/yuliskov/SmartTube/releases/tag/notificat...

[2]: https://www.patreon.com/posts/important-144473602

embedding-shape - 3 days ago

> SmartTube’s developer told me that the computer used to create the APKs for the project’s official GitHub page was compromised by malware. As a result, some official SmartTube releases were unintentionally released with malware.

Seems it's lacking in information about how a malware manages to compromise supposedly signed releases? Do authors not have the production signing keys behind a password or similar, and review 100% of the changes before they deploy stuff?

I swear the more time goes on, the more I'm loosing faith in the entire ecosystem. People running random binaries on the same device they do banking on always surprised me, but now developers manages to get malware on their developer machine and are publishing random binaries to other strangers???

boje - 3 days ago

I really hope Google doesn't pick this out (and similar events) as further justification for getting rid of APK-based installation.

lostmsu - 2 days ago

> Do not download SmartTube from any app store, APK websites or blogs; these were uploaded by other people and may contain malware or ads. SmartTube is not officially published on any app store. Sadly, the Google PlayStore does not allow ad-free Youtube apps using unofficial APIs.

Maybe should actually switch to releasing via F-Droid.

GaryBluto - 3 days ago

It's kind of shocking to me that so many people would download an app like this and sign in using their actual YouTube account.