cross-posted from: https://lemmy.today/post/42851505
Slightly more detail in this GitHub issue, however much is still unknown, even after three or so days. The dev hasn’t revealed any further details. Some articles on this incident:
- https://www.bleepingcomputer.com/news/security/smarttube-youtube-app-for-android-tv-breached-to-push-malicious-update/
- https://www.aftvnews.com/smarttubes-official-apk-was-compromised-with-malware-what-you-should-do-if-you-use-it/
Note that the articles provide little detail on what’s happened, mostly just detail that a malicious library was found and Play Protect started removing the app if affected. It’s unclear which versions are specifically affected, how the dev got breached, and what the malware actually does. According to a user (who may or may not be using some sort of LLM, their comment sounds like one at least) in a separate, related issue, the malware may collect device info and send to a command & control server. It could (in theory) receive new instructions at any point if it’s a C2 server. Again, it does appear that they had an LLM of some sort generate their comment, so take it with a grain of salt.
I’m going to uninstall the app and revoke access on my Google account page. I see little reason to need to reset my password as of right now, since the app uses an API key and not my actual password. In my opinion, it’s possibly related to YT viewbotting and commenting, or to add your device to a botnet. It’s unclear to me how this botnet would work in practice, since even Android TV sandboxes apps (for the most part).
Update: it appears that this may be related to the Vo1d botnet:
DrWeb: Android.Vo1d.14.origin. If this is indeed the case, then the goal was to add devices to the botnet. It’s my understanding that previous versions of this botnet typically required cheap, pre-rooted Android TV boxes, in order to install other apps. I’m not sure if that means that you’re safe if your device is not rooted. It might be worth checking your installed apps for oddities.
So, my Shield auto deleted the app, what the go? Give it some tiime to work out and then redownload it or move onto something else (?)
They already released an updated version that’s clean and was built on a clean device. 30.56, I believe is the clean version.
I downloaded TizenTube Cobalt as a replacement until the dust settles. Obviously similar attacks can happen with TizenTube, but if you want something that is clean right now, that’s the way to go.
I wondered why my NVIDIA shield auto deleted the app. I had assumed Google was just throwing a fit about it
Good to know. Thank you for posting this.
Thanks for the recommendation, I’ve been wanting something like it for the TV for a while now.
There seems to be an alternative for ad-free youtube called TizenTube Cobalt. Gonna try it today. https://github.com/reisxd/TizenTubeCobalt/releases
Invidious has existed for many years, I would also suggest Piped but I’m pretty sure their development cycle is a lot slower.
Do either of those work on Android TV?
You will have time find applications that support the Invidious APi, I don’t personally use android/android-TV but on iOS/TvOS I use Yattee.
Given that I host my own instance and don’t typically use the public ones l can just visit my domain an get it with ease.
They are self-hosted web front ends for YouTube. So you’ll need to host the backend and frontend somewhere. Then you’ll just need a browser.
There are public instances but they are not reliable as they are shared with a lot of internet users, and YouTube blacklists them quickly.
Yeah, I guess I knew what they were, but it seems like it would be rough to use on an Android TV in the browser compared to purpose built TV applications.
Ah, fuck.
I’ve been using TizenTube since this issue came up and it’s gotten the job done. Not sure if it will be a good long term alternative.
