2d ago

SmartTube’s official APK was compromised with malware — What you should do if you use it

www.aftvnews.com

Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ @lemmy.dbzer0.com

misk @piefed.social

1d ago

SmartTube’s official APK was compromised with malware — What you should do if you use it

www.aftvnews.com /smarttubes-official-apk-was-compromised-with-malware-what-you-should-do-if-you-use-it/

19 comments

Once again being lazy and not updating my shit has averted potential disaster.
- This is a 3rd party youtube client. Did it not stop working when you did not update the app for almost a whole month?
  
  Nope. In fact, I only ever bother to update it when I have issues with playback which is maybe one every few months.
Fortunately, its an app for TVs. Still, sometimes you have to be extra careful when downloading 3rd party apps. Especially, those which do not exist on fdroid.
- It would not matter in this case, or? The official SDK was compromised since his building machine was compromised?
  
  The app is limited for TV which limits the reach. Plus, I do not download apps outside of fdroid for the most part.
If you use SmartTube and are concerned about your exposure to this malware, you should factory reset any device that had the app installed
Fuuuuugg
I don't have a Google account. I'm just going to delete and redownload 😮‍💨
- From the comments of the article
  Deleting it and re-installing from the new uncompromised release is not a big deal, but having to go and factory reset all one’s streaming devices and re-configure them from scratch is rather time consuming (I have several).
  In yuliskov’s github announcement, he doesn’t come across as this being particularly urgent, and is NOT making statements like “reset all your devices, change all your streaming account passwords”. He just said going forward there won’t be updates and it will have to be re-installed from the new tree.
  It seems at this point for most people, if google and amazon haven’t uninstalled it and you are not running 30.43 or 30.47, then keep using it, and when the new version is released, remove the old one and install the new one.
  Factory resetting is likely overkill. Android apps are, theoretically, sandboxed, so they shouldn’t be able to affect the system or other apps. Uninstalling the infected app should be enough to clean up, but a factory reset is a guaranteed way, which is why I mention it.
Ugh, and lately I was having some playback woes so I was updating the app as soon as a new update was available 😵‍💫
Just revoked its access to my Google Account, now to remove it, install and setup the clean version on my TV Box 😮‍💨
Thanks for posting this!
Are we all ready for the inevitable "FLOSS is bad, and here is why" flood of bullshit?
- It has nothing to do with FOSS (although it being FOSS helps a lot)
This is why I don't install software that's not on fdroid
- Fdroid sucks on TV
  
  Try flicky
Shite, I'm pretty damned sure I updated like a week ago. The updates always pop up in the main menu of the app, and they often mean a fix for google's latest anti-adblock measures, so I usually update right away. I should probably adjust that policy to add some delay.
- Pretty sure if you downloaded/updated from within the app you should be fine, as the threat is for net new installs
Ahhh I was wondering why it hat disappeared.
I thought it was just google with their usual anti addblock shenanigans.
So if I was still on version 1.29 I don't need to worry? I've unit for now just to make sure I can't update to an infected version

19 comments