Spotify hacked by a pro

[diraiba]

I use spotify alot in the car and noticed lately that randomly it switches to a song i have never had in any playlist or even listened to...

It then said that spotify was being used by a winamp(spotiamb 0.2.1) mod at some point...

for giggles i listened to some of the random songs they play on my acc(like the full album)

What happened then got me laughing.... all the songs are exactly the same, some have one different key so they sound different to a computer, others had a delay before the song started... but they where all exactly the same...

So there's a hacker out there, that uploaded his music to spotify and is now hacking accounts to get his music played (and thus create an income for himself)

Is this known to anyone?

One of the albums (there are 2) is Busy Tavern By Dungeonsd.

Never heard of it, and it randomly starts playing like 6 times a day... i then have to look up the playlist i was playing again and start the song i was listening to over.

i would like to hear thoughts,

Danny

[user-removed]

Hey Danny,

If you contact our support team at this link, they will be able to help you recover your account.  This should remove the other 'user' and give you full access without another person using your account.

I am off for the weekend, but if you post your case number into this thread, I will ensure that the case is chased up and completed for you when I get back into the office.

[diraiba]

Dear Calvin,

Thanks for the quick reply! muchos appriciados!

But, my password was never changed, i already resetted the password to something else and now it seems to be just fine.

its just the fact that someone is using accounts and uploading well... not fake, but useless audio and hacking random accounts to generate money for these songs by playing them on the hacked accounts.

i think it might be a good idea to investigate this and maybe remove the author from spotify/block his ip etc,

Thoughts?

[user-removed]

It is not an issue that I have seen before tbh - just the normal hijackings.  If you have changed your password, it should keep them out - especially if you have disconnected all devices.

We can certainly look over this for you (it is a different team, but I am about 5 strides away from them) - please pop them an email and they will see what can be done.

[Fufu22]

Diraiba, I thought I was crazy. This is THE EXACT THING HAPPENING TO ME. Did you figure out what it is? I've changed my password and logged out of everything, but this madness continues! It's the most useless music as well. It will even randomly play when Spotify is paused. 

You are literally the only other person who's had this problem (according to Google). 

I'm not alone!

[diraiba]

Hello @Fufu22

Hi, Yes, there is an easy way to stop this, this is done with a button on the website when you login on the page, simply go to account then press unlog everywhere, then relog change your password, then unlog all accounts again with the button, then it stopped for me.

Good luck

[colesl4w]

I am getting this also! Exact same tracks. I can also see "spotiamb" in my Connect list. Another user is getting this exact same behaviour as seen here:

https://community.spotify.com/t5/Help-Desktop-Linux-Windows-Web/Random-unsolicited-song-hijacks-play...

Spotify team, you really need to look in to what is causing this. I'm going to change my password now to see if this fixes it. But clearly this is not an isolated issue.

[colesl4w]

Other tracks that this "hack" play automatically are by Tondy Oldem, such as "Storm in a rush". I can see that the track is played from an automatic search for tony+oldem

[Rorey]

Hello @diraiba @Fufu22 Staff here.

After further investigation it seems some accounts may have been accessed by attackers guessing the password after multiple tries. 

Although it is listed as a Connect device, by no means was the Spotiamb player used in the compromise of accounts. The reason why it appears as a Connect device is because someone logged in with that user's credentials.

We recommend resetting your password and disconnecting from all devices using this link. If this does not solve the issue for you we will gladly help out. Send us a message over here then post your case number here.

We'll get it looked into immediately.

[diraiba]

Rorey,

Thanks for looking into this,

i hope i've been somewhat of help!

[user-removed]

I just did that after getting hijacked, a dangerous thing when im driving and the station suddenly changes on its own, and I'm trying to get the regular playlist running again.

I hope this solves the problem.

[nagel0r]

I am so glad this isn't just me,I thought I was going nuts. I get the same device listed you guys mentioned but the songs I get interupted by are by an artist (or album) called 'Neverending'. The odd thing is the first track in their album never completes, it gets about halfway through and starts again. Really awful halloween type ambient rubbish.

I'll try logging out and resetting password as suggested.

Thanks,

Adam

[creepazoidart]

My acocunt was invaded by the same exploit, the bands that it seems to play and some related artists are: "Bhardique, Fentaex, Arnament, Spacial Persun, Slightless, Vendurable, Shemchic, Venduzza, Derainger, Fraid, Befroseen, Rhuchem, Exhaltor, Might Reader, Praiseant, Rigorous Alchemist, Phenomonity, Shadowed Witness, Joy of Zeus, and Nyalaria. Each 'artist' has the same songs as mentioned above, their custom images are all stock photos of nature, and the music is obviously cheaply computer generated. Each has 1 album, with ~9 songs and ~5-10k plays per song. So what appears to be happening is that when a premium account is not active, it is hijacked by 'Spotiamp 0.2.1' and plays songs by these fake artists. This could be netting the account owners as much as $9,000 (average of $.0072 per play, ~20 artists, 9 songs, 7.5k plays per song). According to this article, http://www.theverge.com/2013/12/22/5235456/spotify-debuts-spotiamp-app-winamp-streaming Spotiamp was developed by Spotify engineers. Who knows how many bot artists exist out there, but Spotify should really start filtering these, as harmlesss as they are to users.    

[rvenderbosch]

i got the same problem. spotiamb 0.2.1 keeps pausing and playing my playlist though

[kovats90]

I've had the same issue, but mine has a different device listed and plays some type of Asian music with artists like Thi Ngoc Kendy, Nguyen Black Laddy, Ngoc Linda Tu, etc.  I tried to report the artists, as well, but I'm not sure it did anything.

[Mike141]

Same issue here, my phone is currently playing a song I've never heard of called "I Made It" by tu nguyen mommy. how do i stop it? My account is linked to Facebook and I have changed both the email address and password but spotify still logs in with the old details.

[kovats90]

My Spotify stopped playing the music when I changed my password and deactivated all devices, but it still shows in my recent plays. I guess that'll go away with time.

[diraiba]

Use the webinterface from spotify, uninstall the winamp bullsh** at your account settings press logout of all devices, change your password and relog, it should now be good to go again.

If the problem continues run an antivirus and repeat above steps

[anderverhaal]

Same problem here. Since a few days I hear strange music after a while and I see strange artists popping up on my Android device. 'You showed Me' from Thi Ngoc Kendy. 

Never heard of this artist.

Please fix this problem asap?

Btw: when I open up the settings panel on Android (swipe from top to bottom), I see this system playing de song: WIN-0P8K6VPKD9.

Update: I forgot to mention I recently changed my password after I discovered this problem. Didn't fix it.