- Hey everybody, it's Roberto.
And tonight we have a serious video.
We have to talk about a massive YouTube hack
that has been affecting the community.
These are hacks that are a little bit different
than what we've seen before.
We've seen plenty of YouTube hacks,
plenty of Bitcoin scams.
I'm gonna need you guys to do me a huge favor
because this is a serious video.
One thing, there's a chance that this video
might be gated in some way by YouTube
because of what we have to talk about.
I'm not saying they're gonna suppress it.
I'm just saying that there's a possibility that this video
might be gated or get less distribution.
So I'm gonna need you to share this video in Facebook,
Twitter, Reddit, Discord, pretty much anywhere that you can,
because we're gonna be talking about how content creators
can protect their privacy and security,
and secure their accounts from these hacks
that are hijacking YouTube accounts.
And it doesn't matter if you're a larger or smaller channel,
and actually mid-tier creators are
probably the most overall vulnerable to this.
So I'm going to explain that actually.
I have to reference a ton of notes.
And for the security portion of this video,
I did consult a security expert,
my friend, Shannon Morse, aka @Snubs in Twitter.
Guys, she said you can feel free to hit her up
with your questions around this
and any security questions that you had.
I'm also gonna reference her YouTube channel,
multiple of her videos down below for you guys.
So just make sure you're checking that out.
Get your information from an actual security expert.
I'm gonna be relaying everything
I talked with her about in my notes here.
And so this video is not gonna be highly edited.
This is gonna be a massive information dump.
And toward the end of this video,
if anyone from YouTube is watching,
I have some advice and some thoughts
on what you can do to help creators a bit more.
I know you're doing, you know, as much as you can right now,
especially with quarantine,
but I think that there's more we can address.
The important thing to know about these particular
YouTube hacks, they're taking over people's accounts,
locking them out, stealing their AdSense, and streaming
Bitcoin scams in the community.
The important thing to know is
this bypasses two-factor authentication.
This is bypassing two-factor authentication,
and it's doing so by using a SIM card swap
to compromise people's accounts when they try to do that.
So what's happening is people are using
the Forget Password feature.
And then the hacker has that go,
the authentication, go to their phone.
And then they're able to change the password
and lock the content creator out.
So that's what's happening here.
Now, the important thing in here is prevention.
An ounce of prevention is worth a pound of cure.
It's easier to try everything you can to prevent
your YouTube account from being compromised
and being hacked then to try to hope
that everything'll be okay and that you'll get it back
with the help of Team YouTube.
And then there's no guarantee that your YouTube channel
won't somehow be impacted if you manage
to get it restored and get your videos, your content back,
and get all of that up and running again.
So it's better to just not be in that position
in the first place, if at all possible.
If you are a YouTube content creator,
if you are a public figure, if you are a journalist,
if you're an activist, if you are anybody in the public eye,
if you are on this platform, you are a target.
I cannot stress that enough.
And so you need to act accordingly.
Again, I'm gonna try and give you some best information
I know how to help address this.
Firstly, before we get to the two-factor authentication part
and how they're reverse engineering that,
let's address phishing scams through triggering emails.
If you get something with a triggering email headline
from YouTube, or that seems to be from a brand,
assume that it is a scam and that is a phishing scam
designed to get you to click on something
that will give them access to your account.
Do not click on anything.
Just assume that if it is a triggering subject matter email
about copyright, about losing your account,
about anything, it is a scam.
In order to help make that a little bit
easier with your YouTube account,
sign that up to a secret email address.
Do not make the email account that manages
your YouTube channel public in any way.
If it currently is, you wanna do everything to change that.
If you have in your About section,
an email listed for people to contact you
for business purposes, make that a completely separate,
a completely different email.
I know that it's a pain in the butt.
I know managing different email accounts is
frustrating and it's inconvenient.
It is essential for the purposes of security
and protecting everything that you have built.
Please, please, please make a separate account for that,
and have a separate secret email
for managing your YouTube account,
and use it for nothing else.
Use a password manager that has an unreadable
by human beings password that is generated.
Do not just rely on making up your own passwords,
use a complex password generator,
and consider using a password manager
that allows you to have the different passwords
for each and every website.
Again, I know it's a pain in the butt.
It is essential to do.
I recommend the following, Dashlane,
LastPass, and 1Password.
Any one of these three works and they are fine.
And I think that they are going to help you.
And so I would recommend them.
Limit third party access to your YouTube account
in terms of plugins,
in terms of things that help you with your YouTube channel,
limit that to as few as possible.
There are a few that I use on the channel.
There's a few that a lot of us
YouTube educators use and recommend,
but beyond those which are YouTube certified,
we don't like to use third party plugin,
third party accounts and give third party access
to our accounts.
You know, all it takes for those doors
is for one of them to have a faulty lock
for you to lose everything, all right?
So limiting the amount of ways that someone could get
into your account is in your best interest.
Again, I know all of this is scary.
I know this all is serious,
but you have to take it seriously.
A friend of the channel, personal friend of mine,
Jon Prosser, Front Page Tech, over 250,000 subscribers,
had his YouTube account hacked today, today!
And they ran one of these
Bitcoin livestream scams,
had 40,000 viewers on it.
They made like, I think $4,000 is what was said.
These things are serious and they are targeting YouTubers,
and you are not safe.
You have to assume that you're not safe.
So you have to take every single precaution possible.
And that's why I'm making the video.
Again, please share this with other content creators.
Please take every precaution for your channel.
And I have a few more items here to get through.
I know this isn't a fun video,
and I know it's not super edited.
I know some of you are bored 'cause you're
just sitting here listening to me talk,
but this is important, it's too important!
So two-factor authentication,
the thing that they're bypassing.
It's not foolproof, clearly.
The way that this is happening is at some point,
if they have access to enough information about you,
they can impersonate you with your phone carrier,
and then they can do what's called a SIM card swap.
So I'm gonna link to a video from Shannon Morse
that explains how to prevent that in detail.
I'm gonna link to that in the description.
You should absolutely watch it.
You should watch as much of this content
about security as you possibly can.
I'm gonna try and put together a playlist for you.
And at some point on the channel,
I'm gonna do some collaborations
with security experts to help you.
Maybe we do it as a livestream,
and we'll try to answer your questions in the comments.
Now, there are a couple of things you wanna do.
First of all, do not tell anybody your phone carrier.
If you buy a new phone, I know the new iPhone is coming out,
don't tell people what carrier you got it from.
Don't tell people who you have
your phone plan signed up with.
Do not tell people your carrier.
Start really being cautious and thoughtful
about the private information that you share
with people on the internet as a public figure.
Do not tell them who your cellphone carrier is.
That's number one.
Number two, you have to,
when it comes to a SIM card swap request,
you are not usually told this
but you should request
a specific pass phrase
when it comes to this, a security pass phrase.
If you do not request this,
there is a possibility that your provider
doesn't require it.
So unless you specifically request that this be required
and it's notated in your account,
then they can just ask to do this without any kind
of security protocol or any other verification.
And so they can use basic information to impersonate you.
Again, especially if you've been sharing a lot of details
of your life as YouTubers are want to do.
And so once they do this,
once they hit Forgot Password
and two-factor authentication goes through,
instead of going to your phone number with your SIM card,
it's going to the hacker's phone,
and that's how they're getting in,
and that's how they're locking you out.
So that is how they are bypassing
the two-factor authentication.
And so you wanna take every precaution to prevent that.
And there are a couple of extreme measures here
beyond talking to your cellphone provider
that you can take.
For one thing, you could go ahead
and get a secret phone number and a secret phone
that you use for social media,
and that you use for two-factor authentication
for all of your social media accounts.
This is an extreme measure.
I understand not everyone can afford a second phone.
Not everyone can afford a second phone line.
I understand that, for those of you who can,
who are mid-tier or top-tier creators, take this extra step.
And I know it's inconvenient as hell,
but this needs to be a phone number that nobody knows about.
This needs to be the primary device
besides one that is in your home in terms
of a desktop and laptop that you log in with.
And so you need to limit the devices that have
access to your YouTube channel.
Again, fewer doors, you know,
in case one of those locks doesn't work.
So we need to do that.
Okay, the other thing is, in terms of a phone number
being out there and existing,
you should have a Google Voice number
and nobody else should know what your phone number is, okay?
So there's that, avoid possibly even having
that phone number forward to your actual phone number,
just have it be within the app and that's it,
if at all possible.
Limit your public wifi usage, if you can do that,
quarantine probably makes that a little bit simpler
for some of you, but I know a lot of people like to work
in coffee shops or restaurants.
Limit that because it's gonna make
you less vulnerable in general.
Make sure you're using antivirus software of some kind.
I know a lot of people are skeptical about it.
Even if you use Apple devices,
I still put antivirus stuff on my Apple computers
and on my devices, even my iPad.
So just, just kind of like, again,
prevention's better than cure.
And then finally there is another piece
of hardware you can get.
You could get a physical hardware token.
In the case of YouTube and Google,
this is called a Google Titan Key.
These are something that you will have to invest money in.
There are also another company,
I believe it's called UB, I believe.
I'll let you know in the description,
I'll link to resources for you for security.
But these Google authentication keys are
basically key fobs that, excuse me,
you can use to physically unlock your device
in terms of being able to access
your Google account, or what have you.
And so you're gonna want that
as your two-factor authentication method.
And so Google's Advanced Security,
you know, allows you to set that option.
And I would recommend any content creator
that is a full-time content creator,
or is very close to that threshold,
just make this an investment and make this a priority.
If you have a monetized YouTube channel,
I would say set aside the money,
save it up, make this a priority.
This is not an affiliate link.
Don't worry, I'm not getting anything out of that.
So just go ahead and buy this physical key.
It is a lifetime investment in protecting
your YouTube channel from these hackers.
I also think it should go without saying,
please, please, please do not give anybody your password
for your Google or YouTube account
or for any of your social media,
please, please, please do not do that.
If possible, do not use the same password twice.
Also in terms of protecting your privacy,
if you have your own website,
make sure you're using private registration,
that way they can't get private information about you
like your phone number to be able to use
in order to impersonate you and get access to this,
or just have one more way that they might be able to get
around everything and get into your accounts.
So please, please, please just make
sure you're doing that as well.
Make sure that you're locking down
as much private information as yourself as possible,
and scrubbing as much of yourself from the internet
as is possible for a public figure, thank you.
So my thoughts for Team YouTube and for what YouTube
and Google can do to help content creators, you know what?
I know that you guys actually have a lot
of robust security features
and that you do the best that you can.
And it's actually in many cases, a lot.
And so the biggest issue I think is that content creators
are not educated about the threats that they are facing.
And I think that if you can find any way, shape, or form,
and I know how difficult it is to educate
the community at large about anything,
I have personal experience with that.
I know that literally you can put things
in the YouTube dashboard, staring it in people's face,
and they still won't click on it,
and they still won't sit through it
because it's not entertaining enough.
I know, I know, believe me,
I suffer through it on this channel every single day.
So I understand how hard it is to teach people boring things
that they actually need to know.
But please YouTube, a couple of things here.
Please find some means and some way to illustrate
the severity of these hacks and compromised accounts,
even if you have to trot out the biggest content creators
who have ever suffered from these hacks
and use them and plaster their face all over everything
to get people to take it seriously.
If that's what it takes, please make those overtures,
and please get those creators to come forward and do that
because people actually listen to people who have
a million plus subscribers when they talk.
And then, I'm sorry for everybody for throwing shade there,
but it's the truth.
And then another thing is for any content creator
who has been compromised during this time,
because I know that you guys are understaffed
and overburdened with a quarantine limiting capacity,
I understand all of that,
but if what you can do is for any content creator
who has been compromised, if you could ask to send them,
if you could just opt to send them a Google Titan key,
I think that that's a strong overture
to the community that you support creators.
I think those creators would appreciate it.
And those creators will probably talk to their community,
the other creators in their groups and in their audience,
and then stress the importance of security.
So I think that that could help.
And anything you can do once you restore creators' accounts
to fully, truly educate them about these kinds of issues,
then that would be amazing.
If there could even be some creator masterclass
in terms of security that you guys make available
and that you guys publicly promote on a regular basis
so that creators make sure that they're
following these things.
If you could bring in any experts that could help
people within the YouTube community, that can be a resource.
And also if you could really just constantly
hammer this issue home for creators,
even by putting some advertising behind it,
maybe that would go a long way.
If people could just
have this be an issue
that is relevant to them.
I know how hard it is to manufacturer relevance
and to get people to click on anything
that's not wildly entertaining,
coming from somebody with a million
to 10 million subscribers,
this is gonna to be a good fun time,
but this is too important for the community
because we literally have people losing
their entire livelihoods and years and years
of everything they've worked for,
those memories, those accomplishments.
They might have brand deals up in the air,
and it could be days or weeks before this gets
resolved for them and it's just a nightmare
when it happens to a content creator.
I've been in text and DMs with creators,
like all night before making this video,
that are going through this right now.
And I just feel horrible for them in this situation.
And I really just don't know how they're coping with it.
So anything that can be done, anything that can be done,
I would hope is being done, not just for these creators,
but to just help make our community more aware,
more educated and better protected in these circumstances.
And so that's my final thoughts for YouTube.
You know, no shade, no tea, I get it.
It's very hard to educate people about anything, I get it.
So everybody, that's it for this video, I'm exhausted.
This has been emotional for me too, because again,
these aren't just people who I know from YouTube.
These are friends of mine that are affected by this.
And I just really am, I'm like,
this is not even the first time
that we've had to address this on the channel.
And it's not something that I think
we're gonna see the last of.
So please, please, take this seriously.
Take the security of your channel seriously.
Don't think it can't happen to you, okay?
It can happen to anybody and the best of us.
And even with all the precautions,
there's no such thing as a guarantee,
but it's better than nothing.
Anyway, that's it for tonight.
I'm gonna try my best to have a better,
more lighthearted video where I'm less frustrated
and less exhausted and where I'm my usual self, okay?
So if you want anything like that, by the way,
there are other videos here on this channel.
Watch them after you lockdown your account.
Anyway, I'm not gonna ask you to do the normal things.
What I'm going to insist upon is that you share the video
with anybody that can benefit from it.
And that you look into your own security.
Please check out the videos from Shannon Morse,
aka @Snubs in Twitter, and also her YouTube channel.
I'm gonna link to that below.
I'm gonna link to it in the info card.
It's gonna be the only thing
that I link to here in the info card.
So that's it for you guys, as always,
thank you so much for watching and don't forget.
Go out there, create something awesome today,
and lock it down, take care.