Release Important Announcement · yuliskov/SmartTube
github.com
Important Announcement Friends, it seems that my digital signature has been exposed. This signature protects the app from fake and malicious updates, so there is a risk that someone may try to rele...
  • BrikoX@lemmy.zipMEnglish
    5·
    2 days ago

    The title doesn’t match the facts in the announcement.

    Only signature of the developer was leaked which could have lead to unsafe releases, but the point is moot as the developer is changing the signature key moving forward.

    • breakingcups@lemmy.worldEnglish
      7·
      2 days ago

      There’s a lot unclear, but it seems that an actual compromised update was released on official infrastructure (and subsequently removed from some devices by Play Protect). A transparency statement from the developer is still forthcoming. I’m not risking anything, not even updating to the new app, until all the dust has settled.

      • BrikoX@lemmy.zipMEnglish
        1·
        2 days ago

        The app id is being changed, so there is no way to push new updates with that signature anymore. Hence the need to re-install the app.

        Also it looks like the developer is adding VirusTotal scan workflow for all new releases moving forward.

        That said, I’m not familiar with the developer or the situation enough to comfortably say it’s safe.

        • AmbiguousProps@lemmy.todayEnglish
          2·
          13 hours ago

          I’m not concerned about the app id changing after a signature leak, in fact, it’s what I’d expect. I am concerned about if the new signature is from the actual dev or not, and the dev hasn’t really said much other than they’ll release a disclosure once their new build is pushed to fdroid. It’s been pushed as far as I can tell, and it’s still been silence from them. I’d recommend not installing either app until this gets sorted out, and revoking the app’s access to your account.

  • apotheotic (she/her)@beehaw.orgEnglish
    8·
    2 days ago

    I’m having a moment - do users need to manually install the app again to receive the new version with the new digital signature associated?

  • AmbiguousProps@lemmy.todayEnglish
    1·
    13 hours ago

    Slightly more detail in this GitHub issue, however much is still unknown, even after three or so days. The dev hasn’t revealed any further details. Some articles on this incident:

    Note that the articles provide little detail on what’s happened, mostly just detail that a malicious library was found and Play Protect started removing the app if affected. It’s unclear which versions are specifically affected, how the dev got breached, and what the malware actually does. According to a user (who may or may not be using some sort of LLM, their comment sounds like one at least) in a separate, related issue, the malware may collect device info and send to a command & control server. It could (in theory) receive new instructions at any point if it’s a C2 server. Again, it does appear that they had an LLM of some sort generate their comment, so take it with a grain of salt.

    I’m going to uninstall the app and revoke access on my Google account page. I see little reason to need to reset my password as of right now, since the app uses an API key and not my actual password. In my opinion, it’s possibly related to YT viewbotting and commenting, or to add your device to a botnet. It’s unclear to me how this botnet would work in practice, since even Android TV sandboxes apps (for the most part)