Important Notice to Our Users | Hacker News Reader

Important Notice to Our Users

news.spotify.com

82 pointsmts_46 comments

Interesting note: there are now two apps in the Google Play Store under Spotify Ltd. The first one -- Spotify, is the existing app. https://play.google.com/store/apps/details?id=com.spotify.mo...

It has the package name 'com.spotify.mobile.android.ui'.

The new one is 'Spotify Music,' which appears to be brand new. https://play.google.com/store/apps/details?id=com.spotify.mu...

It has the package name 'com.spotify.music.'

To me, this indicates that the signing keys for the Android app were also stolen during the breach.

The hackers would also have to have control of Spotify's Google developer account.

Not necessarily, the app could be installed outside of Google Play. A user could click on an malicious web link that would download the application and prompt them to install, much like https://m.spotify.com/us/ allows the user to do.

The new app was submitted under Spotify's account though.

I think if the signing keys had been compromised they could have released an update to the existing app, instead of having to list a new one. Wouldn't it be more likely that just the google play credentials (or api keys) have been compromised?

You can't update an app signed with key X to an app (.apk) signed with key Y. The package names must be different, otherwise you get nasty error, and you cannot update. Their users would be forced to uninstall the old app and reinstall the new one.

Isn't that basically what I just said?

Probably not the signing keys, otherwise they could have uploaded a malicious app with the original package name.

This looks like a reasonable explanation.

The new app is signed by "CN=Spotify, OU=Android, O=Spotify, L=Stockholm, ST=Stockholm, C=SE", the old was signed by "CN=Anders Bond, OU=Mobile, O=Spotify, L=Stockholm, ST=Sweden, C=SE". The new key was generated on 2014/05/24.

No, look here:

https://support.spotify.com/us/problems/#!/article/downloadi...

That article has a link to com.spotify.music

The article probably needs updating.

Because right now `com.spotify.music` is just over 1MB (down from 15MB) and just shows this screen:

http://i.imgur.com/lZYDyBt.png

Hitting the "Download" button takes you to the "Spotify Music" app page on the Play store.

It's the other way around. Go here:

https://play.google.com/store/apps/details?id=com.spotify.mo...

Use this online tool to install on your device, then open it from the notification drawer and you'll get the screen above. Then do the same from here:

https://play.google.com/store/apps/details?id=com.spotify.mu...

and also scroll down and note that the size is 14MB - i.e. com.spotify.music is the new one.

Anyway, whilst you had that wrong, I had misunderstood. I think Shank was saying that the signing keys for com.spotify.mobile.android.ui were stolen which is why they then changed it to com.spotify.music - which is a reasonable explanation. I had thought that he meant the attacker uploaded com.spotify.music or something.

The reviews are a disaster though. I know those people are just the minority of morons who don't understand what's going on, but holy shit they shout loud. As a Spotify Premium customer I hope it doesn't cause them any major issues.

The complete lack of concrete information and the fact that the "incident" applies to only one user suggests something was discovered that triggered the company lawyers to engage cover-your-ass mode.

The alternative explanation would be that Spotify has adopted a total transparency policy that includes even the smallest of incidents, but the total lack of information about what the Android update actually changes doesn't support that.

Am I missing something here?

You may have missed:

"Hey, this also has the nice benefit that customers will upgrade to our latest version."

Given that they are only urging Android users to update, it looks like this isn't a new version, but rather a hotfix for some issue that only existed in the Android app.

I received an unauthorized password reset attempt over the weekend. Seems like I probably wasn't the only one.

With the size of the spotify users, that might also have been a typo. Or a targeted attack... but to gain what exactly?

Anecdotal I know, but interestingly I also received one last week. I've had the account since Spotify was in private beta and this has happened only once before that I recall.

What's the connection with the Android app? Did someone backdoor it, or something?

maybe it transmits the password or session token in an insecure way?

As best I can tell from sniffing, it isn't doing anything overtly insecure.

It's surprising how the titles of such posts never mention the content, just "Important Information".

Interesting note at the end about offline playists having to be re-downloaded. That, and the phrase 'internal company data' has me curious if the breach was some kind theft of media, as opposed to user credentials and info.

It sounded like that's a result of the upgrade on Android - presumably they've changed something recently about how they store the offline play lists.

Offline playlists are encrypted by Spotify. Presumably this change means that the encryption keys used by Spotify to store offline data were compromised.

Actually, it looks like the "upgrade" is actually a new app entirely, so it's probably just that since it's a new app, the offline data has to be regenerated.

The makes sense to me as it's unusual to make such a public announcement when just one users data has been compromised and it didn't include and personal or payment information. It sounds like something Spotify are worried about that likely won't harm actual users and media theft seems like a decent conclusion.

Or someone got hold of the crypto keys they use to sign all comms to the dl server and they embed the key in the apk

I don't think the playlist thing is related to the breach at all.

This is likely just a side effect of the new version being an entirely new Android app instead of an upgrade to the existing one. If the local playlist data and/or offline settings were sandboxed to the old app, a new app wouldn't be able to access it.

If that was the case I don't think they would bother writing that blog-post. Why on earth would a user 'care' about another user 'stealing his digital media', when it's just 'songs' that are not even owned, by basically 'rented' on a monthly fee.

It's surprising how the titles of such posts always never mention the content, just "Important Information".

sounds like aftermath of heartbleed

Possibly, but why wouldn't they say so? It seems reasonable to me that they would blame the heartbleed bug instead of taking the blow themselves.

Looks like somebody REALLY wanted to know what their girlfriend had been listening to.

Spotify is a paid service, and they store user-sensitive data. Don't underestimate the impact of a breach.

I think the joke was because only one user's data was apparently accessed.

it's also possible a lot more people were compromised and the trail was covered using log injection or something

security is really hard to measure

Two things missing from this statement that should be part of this note and every note like it:

1) How were the passwords stored (hashed? what algorithm? what parameters?)

2) How were the CC #'s stored (encrypted? what cipher/mode/etc?)

> Our evidence shows that only one Spotify user’s data has been accessed and this did not include any password, financial or payment information.

I think the point here is if your data has been breached you should be reassuring people that password and payment details even if accessed aren't easily readable.

|We take these matters very seriously

This phrase seems to appear often in press releases and I feel that it usually indicates the opposite. If you feel the need to SAY that, it's probably because you've done something that implies you don't.

That seems like an unreasonable standard. If you take things seriously - you can't SAY that you do otherwise people will think that you don't.

I don't understand why they bother announcing such vague information. Just say 'security breach' in two words and stop instead of this word diarrhea.

Attention: Not everyone is tech-savvy, tech-anything, or security-anything. Saying "Security breach, no biggie" is not a proper way to communicate with the general public about a service for which they pay.

-Scope of breach? Check

-Actions taken? Kind of (investigating, patching apps)

-Actions required by users? Check

-Reassurance that everything will be alright, stop cancelling your credit cards? Check

The most interesting part to me is that the comments rant about the new app instead of discussing the security issue. Their users really want to be heard. Those are dedicated users whose hatred for the app is fueled by love for the product or company. Spotify should at least let them know that they're listening.

Received a similar message from eBay (french):

"Cher membre eBay,

Afin que les utilisateurs d'eBay continuent de bénéficier d'une expérience fiable et sécurisée sur notre site, nous demandons à tous nos membres de modifier leur mot de passe.

En voici les raisons : nous avons récemment découvert que notre réseau informatique avait été la cible d’une cyberattaque. Cette attaque a eu pour effet de compromettre une base de données contenant les mots de passe des utilisateurs eBay.

Il est important de souligner que rien n'indique qu'il y ait eu accès à vos données financières ou que celles-ci aient été compromises. Par ailleurs, votre mot de passe était crypté. "

Reply on news.ycombinator.com