Hacker News Reader

Comment by Shank | Hacker News Reader

Interesting note: there are now two apps in the Google Play Store under Spotify Ltd. The first one -- Spotify, is the existing app. https://play.google.com/store/apps/details?id=com.spotify.mo...

It has the package name 'com.spotify.mobile.android.ui'.

The new one is 'Spotify Music,' which appears to be brand new. https://play.google.com/store/apps/details?id=com.spotify.mu...

It has the package name 'com.spotify.music.'

To me, this indicates that the signing keys for the Android app were also stolen during the breach.

View on HN

This looks like a reasonable explanation.

The new app is signed by "CN=Spotify, OU=Android, O=Spotify, L=Stockholm, ST=Stockholm, C=SE", the old was signed by "CN=Anders Bond, OU=Mobile, O=Spotify, L=Stockholm, ST=Sweden, C=SE". The new key was generated on 2014/05/24.

No, look here:

https://support.spotify.com/us/problems/#!/article/downloadi...

That article has a link to com.spotify.music

The article probably needs updating.

Because right now `com.spotify.music` is just over 1MB (down from 15MB) and just shows this screen:

http://i.imgur.com/lZYDyBt.png

Hitting the "Download" button takes you to the "Spotify Music" app page on the Play store.

It's the other way around. Go here:

https://play.google.com/store/apps/details?id=com.spotify.mo...

Use this online tool to install on your device, then open it from the notification drawer and you'll get the screen above. Then do the same from here:

https://play.google.com/store/apps/details?id=com.spotify.mu...

and also scroll down and note that the size is 14MB - i.e. com.spotify.music is the new one.

Anyway, whilst you had that wrong, I had misunderstood. I think Shank was saying that the signing keys for com.spotify.mobile.android.ui were stolen which is why they then changed it to com.spotify.music - which is a reasonable explanation. I had thought that he meant the attacker uploaded com.spotify.music or something.

The reviews are a disaster though. I know those people are just the minority of morons who don't understand what's going on, but holy shit they shout loud. As a Spotify Premium customer I hope it doesn't cause them any major issues.

I think if the signing keys had been compromised they could have released an update to the existing app, instead of having to list a new one. Wouldn't it be more likely that just the google play credentials (or api keys) have been compromised?

You can't update an app signed with key X to an app (.apk) signed with key Y. The package names must be different, otherwise you get nasty error, and you cannot update. Their users would be forced to uninstall the old app and reinstall the new one.

Isn't that basically what I just said?

Probably not the signing keys, otherwise they could have uploaded a malicious app with the original package name.

The hackers would also have to have control of Spotify's Google developer account.

Not necessarily, the app could be installed outside of Google Play. A user could click on an malicious web link that would download the application and prompt them to install, much like https://m.spotify.com/us/ allows the user to do.

The new app was submitted under Spotify's account though.

Reply on news.ycombinator.com