SmartTube Compromised
aftvnews.com
aftvnews.com
Friends, it seems that my digital signature has been exposed. This signature protects the app from fake and malicious updates, so there is a risk that someone may try to release counterfeit versions under my name.
To completely eliminate any threats, I’ve decided to stop using the current signature and switch to a new one. Because of this, the app’s identifier will also change. You don’t need to delete the old app (but it will no longer receive updates) — the new one will install as a separate app and will need to be configured again.
Thank you for your understanding and attention to security.[1][2]
---------------
There aren't any new apk releases on GitHub yet. However, concerningly, the SmartTube website (which I won't link directly) still offers undated "Stable" and "Beta" downloads.
It sucks to deal with security breaches as an indie or solo dev, but I'll be waiting for a more detailed postmortem before assessing whether to install a future release... Hopefully one that details new security procedures to guard both the dev's key and the production build environment.
Factory resetting my Shield as a precaution, but nothing sensitive was really on there, and Android's security model did exactly what it was supposed to and limited the damage. When using a third party app like this, it's prudent to use it signed out or else with a purpose specific Google/YouTube account which is connected to nothing else critical.
[1]: https://github.com/yuliskov/SmartTube/releases/tag/notificat...
I'm curious if this is the best idea? Like, if you don't read all the GitHub releases thoroughly or miss the HN material, and instead you just auto-install updates, you downloaded a malware-infested version which will be on your device until you learn otherwise?
For those using sketchy devices without Play Protect and also installing random apks without an understanding of security or Android's trust-on-first-use model, there's not much anyone can do.
I installed 30.56 from the git link on my Shield. It did not overwrite the old one, as it has the old signature. I manually uninstalled 30.48. I did not use the backup/restore option in either as I didnt want to dirty any data in the new app.
Seems it's lacking in information about how a malware manages to compromise supposedly signed releases? Do authors not have the production signing keys behind a password or similar, and review 100% of the changes before they deploy stuff?
I swear the more time goes on, the more I'm loosing faith in the entire ecosystem. People running random binaries on the same device they do banking on always surprised me, but now developers manages to get malware on their developer machine and are publishing random binaries to other strangers???
maybe QA will find it... but they're testing X number of JIRA tickets based on Y epics and if it's not on the list they're not looking...
It doesn't matter whether the app is installed via Play Store, Huawei's or Samsung's store etc., or from APK.
What's new is that they were gonna block installations outside of Google Play, unless the developer has signed up for Google Play Console and has gone through a verification process there, whitelisting their signing key fingerprint. However, they've walked back on this and said they'll create a new "advanced flow" for "advanced users" that's "designed to resist coercion" to bypass this restriction. Door in the face technique IMO, the existing 12-step process to installing an app was already complicated enough.
So effectively the result is that file based installations will be blocked unless Google has specifically whitelisted their key through the Google Play Console verification process, or the user goes through this "advanced flow" which we're yet to see any details of
I am currently in process of "verifying" my identity with Android Developer console.
In addition to proof of identity (e.g. passport/driver license) Google is demanding a proof of address, government registration, this month's rental agreement, foreign passport... The process is stuck in limbo because months-old documents are deemed "outdated", and I am constantly threatened that my verification request (!) will be denied because of "exceeding allowed number of attempts" (!!)
It shares the same principle as silent Discord account bans and other "verification" harassment schemes, such as Upwork account verification. The excess developers — Google's potential competitors — need to be banished from platform as quickly and cheaply as possible, so that Google can peddle their own spyware unimpeded.
Maybe should actually switch to releasing via F-Droid.
hasn't been in over a year
I just googled redtube and uh... are you sure?
https://tweakers.net/nieuws/213942/youtube-stopt-met-premium...
1. Save $14 for retirement and not watch Youtube
2. Save $14 for retirement and watch Youtube with ads
3. Pay $14 a month for Youtube without ads
The only option that's not fair is expecting private companies and creators to give you entertainment and its delivery with nothing in return
His rationale? "Nobody will cry over a few missing quarters and they are free to lock their doors anyway."
You are very intelligent.
You are able to make your own définition though. The clear mark of a very intelligent mind.
But I suppose strictly speaking, theft is not the same word as stealing. I was not smart enough to get that. You're right, and I apologize.
Not that ad-blocking is illegal, it's not, but it does bypass payment to creators for content they provide. Which functionally acts the same as theft.
To save $1680 I'd prefer to just use an adblocker (which I have done for the past decade)
I think there is a good argument that having a single dominant platform has been harmful.
OpenAI thought of it first, should YouTube get a government backstop too?
- What happened to you?
- I figured that if I ran behind the bus, I'll save the $3 dollars the ticket costs-
The hacker father smacked his son hard on the head and cried:
- You fool! To run behind a bus like that! You should have ran behind a taxi instead and you would have saved at least $50 dollars!
Then they both watched YouTube together the rest of the evening, thinking eagerly about all the juicy money they would save over the next decade.
* $0.00 plus additional risk that the author of the alternative you are using is compromised, you end up using a malicious version of that alternative, and get pwned.
Obviously for some/many, that trade-off is totally cool. But it needs to be included in the analysis, otherwise you're being dishonest.
Its not entirely ad free, just fewer ads, AFAIK sponsored segments remain so there are still ads, sometimes quite lengthy ones.
$14/month is $168 an year, and if you subscribe to multiple other video services the annual total is going to be quite high.
which is a very niche slice, and I have no idea how representative it is in aggregate. but sponsorships happen because they pay well enough to annoy every viewer, not just ones that aren't using the better-paying Premium - they generally are not cheap, to say the least.
If you look at Premium, it's about 100x more lucrative than regular views. So I'm pretty sure I'm providing more money to creators than the skipped ads.
LTT though is a rather significant outlier in terms of subscribers (16.6 million right now). For truly large channels it's reasonable for the equation to be different.
And the equation for them really is different. They're a company with ~100 employees¹ and YouTube and video sponsorships came out to just 11.6% (ads AND premium) and 9.2% respectively of their multi-person company income. People claiming "SponsorBlock steals from creators" aren't talking about LTT, they're talking about smaller creators for whom YouTube stuff is a majority of their income.
Plus, like. Ads+premium lumped into one. It wouldn't surprise me if premium was lower than sponsorships.
It completely changes if we're talking about non-Premium views.
I can try to hunt mine down, but most of the examples I've had were from a couple years ago, and YouTube's history is rather hard to search for stuff like that :| Not high odds of success.
I've been trying to find public numbers for English-language channels, but wow. So much slop.
As for the ads, YouTube Premium now has built-in sponsor skip. They can't really block sponsored segments, as that is a freedom of speech issue and also something they can't easily determine. Creators can just omit that some product is sponsored.
And the proliferation of AI videoslop is only making the 0.1x side larger and larger
I guess you could say YouTube surfaces a larger span of quality, from really shit quality to incredible high quality, which I guess is cool. But since they provide zero tools to actually discover the really high quality, and on top of that decide they know better what I want to watch than me (like the subscriptions page not starting with the last published video), does that really matter?
> as that is a freedom of speech issue
It isn't. Freedom of speech in the US (since Google is based there, and maybe you too?) is about the government placing restrictions, not companies or individuals. As a individual (or company), you're free to limit the speech of anyone who want on your platform, for any reason. You might face public outcry, but it isn't a freedom of speech issue as it's on a private platform in the first place.
> Freedom of speech in the US...
Freedom of speech is a subject which is much larger than the US constitution. I'm not saying YouTube isn't legally allowed to block sponsored segments. I'm saying that they might not want to because they don't want to limit their creators' speech in that matter. Especially considering how easy it would be to side-step. What would be their reason? They've already made it easy to skip sponsored segments.
Not true in the US, where the FTC requires (and has required for decades) disclosure by the creator to the viewer whenever a payment has been made to the creator to promote anything. On Youtube, this is typically done by the creator's saying (in the video) "this video is sponsored by Foo Corporation", or, "I wish to thank the sponsor of this video, Foo Corporation".
Personally, I'm unhappy with Premium's built-in sponsor skip. For one thing it becomes available to me only after enough previous viewers have manually skipped over the sponsored segment. For another, it sometime skips ahead too far (probably because the viewers who manually skipped weren't precise in skipping exactly to the end of the sponsored segment). I'd much rather Youtube allowed the uploader to declare (to Youtube) that the upload is free of sponsors (e.g., by checking a box) and then punishing the uploader somehow if he routinely declares falsely. With that information, Youtube could and IMHO should give me the option of telling Youtube somehow (e.g., by checking a box) that I prefer for sponsored videos to be omitted from my recommendations.
Although I like your idea about creators themselves having to declare to YouTube their sponsored segments.
Also, if the creator doesn't follow the rule, the sponsor can be fined by the FTC, so even before the FTC notices the violation, the sponsor will probably notice and refuse to continue the relationship unless the creator's videos comes into compliance with the rule.
Again, this rule has been in effect for decades in the US. Advertisements in the US must be labeled as such. Ditto paid endorsements.
They refuse to correct for purchasing power parity and are left with nothing in the end. Steam seems to do very well in comparison.
(I don't watch YouTube even for free, but practically everybody I know does without paying anything, and it makes a lot of sense).
"Purchasing power parity" is a non-concept for almost 100% of companies and products. But YouTube Premium is priced differently in different regions. Sometimes much cheaper than $14.
They're explaining for people who don't seem to understand, why people are fine signing in to these kind of 3rd party apps in the first place, because the subscription price ends up being what these people earn in days, not hours.
My experience is that you are basically paying to remove the official ads from your disguised ads.
The various algorithm tweaks for engagement these past few years and the introduction of shorts have significantly degraded the content quality and many good channels have just thrown the towel.
I will happily pay for youtube when they show that they want to encourage good content and help empower the people who make that good content, but Google doesn't want to do that because Mr Beast slop advertising to your kids is more profitable.
So I pay for Nebula instead.
Most youtube content being disguised ads, this cannot be true.
Do you have a source for this?
I do value watching unlimited youtube videos without ads, but if they're gonna add the ads back in, I'd easily stop paying for the one google product I currently pay for (and honestly the only reason I haven't already done this is laziness and convenience)
It launched at $9.99[1] and is now $13.99[2] which I believe to be a 40% increase, i.e. flat in real dollars. If like most people you subscribe for a year, it's only $11.67/mo.
1: https://www.cnet.com/tech/services-and-software/youtube-free...
I can absolutely imagine my YT accounts at some point getting banned for using adblock, some stupid private upload or some comment.
I have a gmail account used solely for google store and Android TV related verifications that's unlike other business, personal, registration, or spam email accounts.
The TV's in the house, smart wifi devices, and guest wifi accounts are on separate subnets, the NAS hosted media has limited read only keyhole access accounts for TV apps to use.
Whether it's SmartTube or any other app (iView, SBSOnline, Netflix, etc) it's wise to assume that anyone can be comprised by malware to sniff traffic for (say) bank account passwords, host bots for DDOS or mining, etc.
Also are you really using same account for gmail, your personal pictures/docs and youtube?
Most people use "sign in with Google" and tie their Google account to services well beyond the Google ecosystem, just to avoid creating a new entry in their password manager (lol). You think people are making new Google accounts for each Google service? That's hard for me to believe.
I also don't need to manually go set speed to 1.75x and enable subs in english, it's a one-time setting. _Further_ I can download a video locally, for whatever reason (later viewing, bw throttling, risk of deletion, etc).
As if that weren't enough, I don't have to watch videos logged in, my client is just set up to download my select channels.
I now see zero use of a youtube account.
Surely you can use a web browser?
TV and set-top box browsers tend to be slow and fiddly to use from a TV remote. (And often running on underpowered hardware).
Not Youtube account.
1. Manage your YouTube account
View and manage your videos and playlists
View and manage your YouTube activity, including posting public comments
2. View and manage your [YouTube] rental and purchase history
Your rental and purchase history may be displayed and accessible on this device.Even with YouTube Premium you don’t get the feature set you get with SmartTube. The sponsor block integration on my TV is brilliant.
My wife has YT Premium, and we find ourselves watching YT in SmartTube just because the interface is so much better.
No ads is of course a big plus too.
When we move away from walled gardens (which I support), the burden of verifying the "chain of custody" shifts to the user. Installing an APK that auto-updates with root/system privileges is essentially giving a single developer the keys to your living room.
We need better intermediate trust models—like reproducible builds signed by a quorum of maintainers—rather than just "trust this GitHub release."
I hope that Flatpak and similar technologies are adopted more widely on desktop computers. With such security technology existing, giving every application full access to the system is no longer appropriate.
I really dislike Flatpak for installing multiple identical copies of the dependencies.
Just give me some easier to use tools to configure the access that each application has.
You don't, but as far as I know, Flatpak or Snap are the only practical, low-effort ways to do it on standard distros. There's nothing stopping flatpak-like security from being combined with traditional package management and shared libraries. Perhaps we will see this in the future, but I don't see much activity in this area at the moment.
Which channel distributed the compromised apk? What is the signature of the payload injected? What is the payload, what does it do?
Where can I read more about *unrequested uninstalls*? Google search only shows results about how impossible it is to remove phone default apps.
Among the options of what could be pushed:
- proxyware, turning your network into a residential proxy that can then be sold to anyone willing to pay for them to commit crimes, send spam, scrape, ... with your IP [I believe this is the primary suspect here]
- other standard botnet crap like DDoS bots
- exploits that try to break out of the sandbox to establish persistence, steal other data, or steal your Google account token
- code that steals all data/tokens that the app itself has access to
- adware that shows ad notifications etc.
- ransomware that tries to prevent you from leaving the app (of course this works best if they get a sandbox escape first, but I'm sure you can get pretty close with just aggressive creative use of existing APIs)
Yeah, I'll pass.
On my TV the app vanished and after some searching, it was disabled. I was kinda afraid Google had finally (ab)used it's Play Services power to ban it. But luckily it was because the developer marked it as compromised. All and all impact was minimised this way.
I doubt your statement about requiring a Google account to be connected, as you can also import subscriptions instead of granting access to your account.
I've been using it for years and I've never had to sign in.