Mystery tracks being 'forced' on your Spotify

Very interesting! I had something that sounds similar to this a couple of years ago.

My Spotify had a new music "Device" listed with a weird name. Frequently the device would be selected and a song I'd never heard of would start playing, with no sound as it went to the rogue music device.

On my Spotify account I could see a new linked application that I hadn't ever setup. I deleted it, kicked out any logins that Spotify allowed me to do and the problem went away for a day or so. Then it magically reappeared!

When I set up my account I did so with my Facebook account. At one point, IIRC, you could have an account created via Facebook but that meant you always had to log in using Facebook. They later changed this to allow you to set a password and use either.

Assuming the worst I secured my Facebook account (password change/revoking access/etc). No luck. What did work was setting up a proper Spotify password. I'd always logged in with Facebook and never bothered changing the password when they added that feature. Once I changed it I could delete the application, kick out any applications, and then it never came back.

Complete speculation: When Spotify allowed Facebook linked accounts to have a separate password, they generated me a password that was "guessable" and someone used it to access my account?

It's quite clear to me that this s a fraud to make money. Those tracks are produced by algorithms and played via access tokens gathered from sites like the playlist converters floating around. Be wary of your account data and check the access of 3rd party apps regularly.

https://support.spotify.com/uk/account_payment_help/privacy/... for information how to do that for Spotify.

This happened to me - apparently I spent 34 hours last year listening to a song called "Bear Claws" by an artist called Andrew Brady. I did some digging and all I could find was an Irish guy on Twitter with 2 tweets to his name. The song and the artist no longer existed on Spotify last time I checked. The odd thing is that these songs never seem to show up in my play history.

I did link Spotify to Facebook at one point, although I disabled all of my external apps on the Facebook side a long time ago and have used my username / password to log in ever since. I've never used a "playlist converter" or linked anything else to Spotify, as far as I know. My password has always been unique.

It should go without saying that if these access tokens have been breached they really should be revoked. I imagine Spotify will finally do something about it now that this has hit the mainstream press.

This reminds me of a brief period (1 to 2 months) that I went through with Spotify where I'd always open my Spotify to find it playing some random music that I'd never heard of before. Usually some generic "Ibiza mix" stuff or something.

Yet, I tried everything to stop it, assuming I had my account compromised: I logged out all devices, changed my password, but nothing changed until one day it randomly stopped.

They did not change anything at all on my Spotify account, it's as if they just used my account to play music somewhere else. They also never hijacked it while I was using it to try and play their music, it was only when I'd log on it would be playing some other music.

Funny, to me this sounds like a hash collision. (For a map key, not the cryptographic kind.)

Knowing only that Spotify is a large distributed system, and seeing that the mystery tracks are short in title and length, as well as plentiful, it feels like a these tracks are ending up as collisions in a distributed hash table.

From there it'd be a matter of bubbling up top due to sorting order properties.

I guess it’s like phone SPAM where you get a phone call from an overcharged number and they hope some of the called will ring back (and then be charged some euros or dollars).

Maybe they found a way to spam thousands of Spotify accounts, and hope that a part of them gonna try to listen some out of curiosity.

If there are enough doing that, they’ll get royalties money from really played music, and not from pseudo played track, which might be what Spotify monitors

Accounts are unquestionably being exploited (often via reused passwords). I, along with others I know, have found mystery people squatting in my family plan. I had assumed they were also what were contributing to these weird artists in my history, but perhaps not.

Why does Spotify still not have 2FA? I get that legacy connected devices will be a problem for them, but there are ways around that.

To me it sounds like someone at Spotify messed up and ran dev experiments on the production system instead in the staging environment.

Could this be done if a bad actor finds a website that embeds the Spotify player/widget and also explicitly allows cross-origin requests?

Recently mysteriously had all my playlists deleted and lots of tracks I never played had been played and weird playlists added in place of mine. Went and reset all 3rd party access and reinstated my playlists and it hasn't happened again since. I chalked it up to maybe logging in on someone elses mobile device while travelling to play my playlist and then forgetting and then they did it, but maybe it was bad actors over the internet. I'll never know.

    racking up thousands of listens and
    (perhaps) hundreds of pounds

I thought artists earn something like $5 per 1000 plays these days?

Reused passwords that appears in breaches maybe?

Maybe these are test accounts/artists created/used by Spotify developers? I don't know much about their culture but if there was an actual attack with actual consequences and these accounts were removed as a result, they would've said something.

Something similar happens to me on YouTube 2-3 times per month.

I’ll go to my subscriptions and there will be videos in there from channels that I never subscribed to, but I’m now subscribed.

Off topic but somewhat related - my corporate overlords don't let us install anything on our workstations and the browsers we use are old and not supported by play.spotify.com.

Any bright ideas about how I can use spotify here?

I was hacked because at the time I set up a free account I used an old default password I'm pretty sure shows up in a leaked dataset. I suddenly noticed messages showing up that someone played music from a device I don't own. I changed my password and deleted all offline devices. It's entirely my fault, still it's odd that spotify wouldn't notify me of suspicious behaviour, since they kind of pay for it too.

This is why I refuse to play the Discover Weekly playlist. I strongly believe that Spotify is getting money out of made up artists, with songs put up by algorithms in some way, and that's the best way to get them to you.

Regarding the 'hacking', it never happened to me, but it's easy to see how troublesome that may be. But that's what we get for trusting an application that promises to get us free music forever. It had to have drawbacks, eventually.