Important Notice to Our Users

http://news.spotify.com/us/2014/05/27/important-notice-to-our-users/

by mts_ • 12 years ago

82 46 12 years ago

news.spotify.com

iambateman• 12 years ago

Looks like somebody REALLY wanted to know what their girlfriend had been listening to.

pestaa• 12 years ago

Spotify is a paid service, and they store user-sensitive data. Don't underestimate the impact of a breach.

jasonlfunk2• 12 years ago

I think the joke was because only one user's data was apparently accessed.

wwwwwwwwww• 12 years ago

it's also possible a lot more people were compromised and the trail was covered using log injection or something

security is really hard to measure

0x0• 12 years ago

What's the connection with the Android app? Did someone backdoor it, or something?

eli• 12 years ago

maybe it transmits the password or session token in an insecure way?

nkozyra• 12 years ago

As best I can tell from sniffing, it isn't doing anything overtly insecure.

hodgesmr• 12 years ago

I received an unauthorized password reset attempt over the weekend. Seems like I probably wasn't the only one.

spacefight• 12 years ago

With the size of the spotify users, that might also have been a typo. Or a targeted attack... but to gain what exactly?

MattJ100• 12 years ago

Anecdotal I know, but interestingly I also received one last week. I've had the account since Spotify was in private beta and this has happened only once before that I recall.

bowlofpetunias• 12 years ago

The complete lack of concrete information and the fact that the "incident" applies to only one user suggests something was discovered that triggered the company lawyers to engage cover-your-ass mode.

The alternative explanation would be that Spotify has adopted a total transparency policy that includes even the smallest of incidents, but the total lack of information about what the Android update actually changes doesn't support that.

Am I missing something here?

ronaldx• 12 years ago

You may have missed:

"Hey, this also has the nice benefit that customers will upgrade to our latest version."

tomp• 12 years ago

Given that they are only urging Android users to update, it looks like this isn't a new version, but rather a hotfix for some issue that only existed in the Android app.

eddywebs• 12 years ago

sounds like aftermath of heartbleed

a1a• 12 years ago

Possibly, but why wouldn't they say so? It seems reasonable to me that they would blame the heartbleed bug instead of taking the blow themselves.

seefoma• 12 years ago

Interesting note at the end about offline playists having to be re-downloaded. That, and the phrase 'internal company data' has me curious if the breach was some kind theft of media, as opposed to user credentials and info.

elemeno• 12 years ago

It sounded like that's a result of the upgrade on Android - presumably they've changed something recently about how they store the offline play lists.

Shank2• 12 years ago

Offline playlists are encrypted by Spotify. Presumably this change means that the encryption keys used by Spotify to store offline data were compromised.

k-mcgrady• 12 years ago

The makes sense to me as it's unusual to make such a public announcement when just one users data has been compromised and it didn't include and personal or payment information. It sounds like something Spotify are worried about that likely won't harm actual users and media theft seems like a decent conclusion.

easytiger• 12 years ago

Or someone got hold of the crypto keys they use to sign all comms to the dl server and they embed the key in the apk

Rudism• 12 years ago

I don't think the playlist thing is related to the breach at all.

This is likely just a side effect of the new version being an entirely new Android app instead of an upgrade to the existing one. If the local playlist data and/or offline settings were sandboxed to the old app, a new app wouldn't be able to access it.

atmosx• 12 years ago

If that was the case I don't think they would bother writing that blog-post. Why on earth would a user 'care' about another user 'stealing his digital media', when it's just 'songs' that are not even owned, by basically 'rented' on a monthly fee.

Shank2• 12 years ago

Interesting note: there are now two apps in the Google Play Store under Spotify Ltd. The first one -- Spotify, is the existing app. https://play.google.com/store/apps/details?id=com.spotify.mo...

It has the package name 'com.spotify.mobile.android.ui'.

The new one is 'Spotify Music,' which appears to be brand new. https://play.google.com/store/apps/details?id=com.spotify.mu...

It has the package name 'com.spotify.music.'

To me, this indicates that the signing keys for the Android app were also stolen during the breach.

6thSigma2• 12 years ago

The hackers would also have to have control of Spotify's Google developer account.

andymcsherry• 12 years ago

Not necessarily, the app could be installed outside of Google Play. A user could click on an malicious web link that would download the application and prompt them to install, much like https://m.spotify.com/us/ allows the user to do.

tokenizerrr2• 12 years ago

I think if the signing keys had been compromised they could have released an update to the existing app, instead of having to list a new one. Wouldn't it be more likely that just the google play credentials (or api keys) have been compromised?

dublinben• 12 years ago

You can't update an app signed with key X to an app (.apk) signed with key Y. The package names must be different, otherwise you get nasty error, and you cannot update. Their users would be forced to uninstall the old app and reinstall the new one.

Trellmor• 12 years ago

Probably not the signing keys, otherwise they could have uploaded a malicious app with the original package name.

ctz2• 12 years ago

This looks like a reasonable explanation.

The new app is signed by "CN=Spotify, OU=Android, O=Spotify, L=Stockholm, ST=Stockholm, C=SE", the old was signed by "CN=Anders Bond, OU=Mobile, O=Spotify, L=Stockholm, ST=Sweden, C=SE". The new key was generated on 2014/05/24.

maaarghk2• 12 years ago

No, look here:

https://support.spotify.com/us/problems/#!/article/downloadi...

That article has a link to com.spotify.music

ctz2• 12 years ago

The article probably needs updating.

Because right now `com.spotify.music` is just over 1MB (down from 15MB) and just shows this screen:

http://i.imgur.com/lZYDyBt.png

Hitting the "Download" button takes you to the "Spotify Music" app page on the Play store.

general_failure• 12 years ago

I don't understand why they bother announcing such vague information. Just say 'security breach' in two words and stop instead of this word diarrhea.

worklogin• 12 years ago

Attention: Not everyone is tech-savvy, tech-anything, or security-anything. Saying "Security breach, no biggie" is not a proper way to communicate with the general public about a service for which they pay.

-Scope of breach? Check

-Actions taken? Kind of (investigating, patching apps)

-Actions required by users? Check

-Reassurance that everything will be alright, stop cancelling your credit cards? Check

reledi• 12 years ago

The most interesting part to me is that the comments rant about the new app instead of discussing the security issue. Their users really want to be heard. Those are dedicated users whose hatred for the app is fueled by love for the product or company. Spotify should at least let them know that they're listening.

hendzen• 12 years ago

Two things missing from this statement that should be part of this note and every note like it:

1) How were the passwords stored (hashed? what algorithm? what parameters?)

2) How were the CC #'s stored (encrypted? what cipher/mode/etc?)

aggronn• 12 years ago

Our evidence shows that only one Spotify user’s data has been accessed and this did not include any password, financial or payment information.

johnnyfaehell• 12 years ago

I think the point here is if your data has been breached you should be reassuring people that password and payment details even if accessed aren't easily readable.

waylandsmithers• 12 years ago

|We take these matters very seriously

This phrase seems to appear often in press releases and I feel that it usually indicates the opposite. If you feel the need to SAY that, it's probably because you've done something that implies you don't.

jasonlfunk2• 12 years ago

That seems like an unreasonable standard. If you take things seriously - you can't SAY that you do otherwise people will think that you don't.

halflings• 12 years ago

Received a similar message from eBay (french):

"Cher membre eBay,

Afin que les utilisateurs d'eBay continuent de bénéficier d'une expérience fiable et sécurisée sur notre site, nous demandons à tous nos membres de modifier leur mot de passe.

En voici les raisons : nous avons récemment découvert que notre réseau informatique avait été la cible d’une cyberattaque. Cette attaque a eu pour effet de compromettre une base de données contenant les mots de passe des utilisateurs eBay.

Il est important de souligner que rien n'indique qu'il y ait eu accès à vos données financières ou que celles-ci aient été compromises. Par ailleurs, votre mot de passe était crypté. "

benrapscallion2• 12 years ago

It's surprising how the titles of such posts always never mention the content, just "Important Information".

benrapscallion2• 12 years ago

It's surprising how the titles of such posts never mention the content, just "Important Information".

Important Notice to Our Users

Related Stories