I use Spotify (the free desktop version) and was repeatedly served suspicious web pages launched by the application itself. Reading online reports, it seems like Spotify has been serving malware through its ads-supported free version.

What steps can I take to mitigate the risk if I still want to use the application?

  • 1
    You could run it in a VM, but a bit unpractical to start a VM just to listen to some mucis... – Anders Oct 6 '16 at 8:55
  • 1
    most probably you have downloaded a fake version of it, as spotify does not acts like this (as i used it before) – Hamza Islam Oct 6 '16 at 9:24
  • 3
    @HamzaIslam: It seems to be a problem that has affected many users recently. I don't think my downloaded program was compromised. – Gruber Oct 6 '16 at 10:51
  • you should better install Kaspersky Internet security. Immediately. even if you have to use trial for now, do it. as its the only best protection i ever came across in case of overall pc protection – Hamza Islam Oct 6 '16 at 14:26

I don't have any good solutions, but I have a couple of bad ones:

  • Upgrade to premium to get rid of the adds. But pay to not get malware? Doesn't feel right.
  • Uninstall it until they fix the mess, then reinstall it and hope they don't mess up again.
  • Run it on a VM. Just a tiny bit unpractical to have to start a VM just to listen to music...
  • Harden your browser (update to latest version, uninstall Java and Flash, etc) and hope for the best. Not bulletproof exactly, but better than nothing.
  • Change your default browser to a program that does absolutely nothing. That way Spotify will not be able to open a browser, but on the other hand no other program using the default browser will either...

As I said, not very good solutions. Perhaps someone else has some better ideas?

  • Good ideas. I don't know what kind of code could be put into Spotify ads, but if they can launch browsers they can probably put arbitrary code in there attacking any platform. Doesn't Spotify run in some kind of silent update mode which suppresses Windows UAC when the program updates itself? Running it in a VM seems to be the thing to do. – Gruber Oct 6 '16 at 11:56
  • I don't think it is code in the add that starts the browser. I think it is Spotify that does that. But I might be wrong here. – Anders Oct 6 '16 at 12:00

If the issue happens from a controlled network, then I suggest implementing ad-blocking at the network level.

There are lots of free, maintained, lists that can be incorporated into a blocklist. If you are using something like a Ubiquiti EdgeRouter Lite, someone has created an auto-updating anti-advert, anti-malware block script that is excellent I expect something like this may be available on other routers too.

Use of OpenDNS may also help as it will block known bad sites. You can do that both at the network level and at the PC level.

There are, of course, many other tools that will either block known bad sites or will block all adverts.

  • This type of blocking would work if the Spotify client downloads malicious content straight from well-known ad sites. If Spotify uses a proxy to serve the ads I suppose it would be harder. – Gruber Oct 7 '16 at 14:16
  • True but that isn't generally how these things work - though someone like Facebook may have their own ad proxy (which you can just block anyway), most simply hand off to one of a few well-known ad services. Believe me, it works REALLY well, I use it at home. Just occasionally, it breaks a site but that's a price worth paying for the security of avoiding drive-by ransomware attacks. – Julian Knight Oct 7 '16 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.