“I was tricked into deleting my channel…”
“We did it.
We finally got hacked.”
“I did get hacked.”
“…taken over by hackers”.
Well if only these folks had been smart enough to use 2FA…
“The person involved did have 2-factor authentication enabled…”, “Even though I had two-factor
authentication enabled…”
So this is obviously very concerning.
If you’re a content creator of any kind, I beg you to listen carefully because what
I’m about to say could save you thousands of dollars in lost revenue.
And if you aren’t a YouTuber, that’s ok, because this is a real life case study where
what you learn can be applied to so many other parts of your online security.
Over the past week, I’ve been watching hours of videos and taking notes on all of the methods
that have been used to hack YouTube accounts.
Now while this is not legal advice in any way, I’m hoping to educate you on the many
extremely creative methods that have been used to takeover YouTube accounts and the
important steps you need to take to secure yours.
And if you stick with me to the end, we’ve got a message that we need to share with the
YouTube team that I need your help on.
This video is sponsored by EasyDMARC, which is a critical service for us small business
owners that I’ll explain in a moment.
The anatomy of the average scam is simple but shockingly effective and there seems to
be two primary methods used to scam YouTubers recently.
The first kind of scam I noticed was one built on impersonation, where scammers leverage
stolen trust to get you to click on links or download malware without realizing it.
For Jim Browning, the scam was convincing in part because of timing, but also because
as far as the initial email was concerned…
“It has genuinely come from Google.com”
The scary thing is that at the time I’m recording this, it is possible for somebody
to send an email through the Google or YouTube system that comes from their trusted email
address.
It could look like a message from YouTube support, it could look like one of those dreaded
Copyright Strikes, or it could even be a notice of tax documents.
In the cases of Matt Rittman and Paul Hibbert, the attackers impersonated advertisers who
supposedly wanted to sponsor their videos…
“…simple as that.
They said, ‘Ok, we’re going to send you some footage of the game, we’re going to
send you a brief…”
And links to that footage and brief actually ended up being malware that was downloaded
onto their computer and executed in less than a minute to automatically change passwords,
2FA and the primary phone number on the account.
Two crazy things to share here.
First, as Matt Rittman points out…
“I even scanned it for viruses, and sure enough it didn’t come up with any threats.”
These malicious files apparently don’t get flagged by most antivirus software and from
what I’ve seen, they’re usually a zip file, a fake PDF or even just a button link
in an email that doesn’t even look like a download.
If that doesn’t worry you, another crazy thing is that once executed, the sneaky program
has the ability to steal the active login sessions on your browser to even bypass 2FA.
John Hammond has an entire video, very fascinating for those who are into that kind of thing,
which details exactly how this kind of malware attack works.
We’ll talk more about how we can protect ourselves against this in a moment, but I
want to share the second common method I saw used to takeover a YouTube channel - a kind
of backdoor attack.
This is what happened to IT professional David Bombal, whose channel was hacked via another
member on his team who had editor privileges on his channel…
“Now, when we noticed this, one of the first things I did was remove the person who had
editor privileges on my YouTube channel.”
The vulnerable back door could be another human being, but in some cases it could just
be the hacking of another device or account associated with your channel.
This is exactly what happened to the Corridor Crew channel…
“The leak occurred through Christian’s Gmail account”.
Access to an email account grants equal access to any associated YouTube channels, not to
mention so many other parts of your digital life that you probably don’t want somebody
to have the ability to see.
These kinds of impersonation attacks are far too common.
In fact, just last month, I caught somebody trying to use my All Things Secured email
address to send fraud emails to people, essentially trying to steal the trust I’ve built with
my audience.
The only reason I found out about it and stopped it was because I’ve set up what are known
as DMARC protections through EasyDMARC, the company that is sponsoring this video.
If you’re a YouTube creator or anybody who has their own email domain, please don’t
ignore this.
Setting up DMARC protections not only helps increase your email deliverability, which
is great for email marketing, it also gives you the peace of mind knowing that your email
address can’t be used for phishing emails similar to how we’re seeing here with YouTube
impersonations.
As somebody who uses email a lot for my business, I can’t tell you how nice it is to log into
a dashboard that shows me exactly what’s happening with my email domain.
Enabling DMARC protections is something I recommend for every small business, period;
EasyDMARC lets you get started doing that for free; and when you use them, you help
support this channel.
It’s a perfect Venn diagram that ends with you going to [EasyDMARC.com](http://EasyDMARC.com)
to see for yourself.
So as far as YouTube hacks are concerned, what are the steps we need to take to protect
everything we’ve worked for and built here?
Let me share with you 5 changes based on the experiences of all these channels that have
been hacked.
First, start using physical security keys as your 2-factor authentication, and force
everybody on your team to use them as well.
I know, I know…we’ve already covered how 2FA still isn’t foolproof, but this is the
best lock we have for now and I anticipate that companies will adapt to the strength
of these keys in the future, so start using it.
Second, I find it interesting that two of these YouTubers specifically called out the
Windows operating system as the culprit.
“I won’t allow anyone to use a Windows computer”
And if you’re not going to use Windows, that leaves you with only a couple other options,
like it or not…
“…but I’m thinking maybe I need to move towards using an Apple computer…”
Apple or Linux.
Again, not 100% foolproof, but it seems as if these malicious programs, or at least the
ones that are popular at the moment, don’t affect those operating systems and Windows
is particularly vulnerable.
The third suggestion to protect yourself is to limit admin access.
If I were you, I would make sure that you’re very stingy about who has admin access to
a YouTube channel.
It may not prevent a hack, but it will severely limit the damage that is done.
An admin can delete videos and an entire channel.
An editor can only make videos private.
On top of that, the fourth step is to compartmentalize data access.
This is where things get a little tricky and quite inconvenient, honestly.
This could mean disassociating your YouTube channel from your day-to-day email account
and moving it to a more private account.
Perhaps it means going so far as to making sure that the device you use to access email
is not the same device you use to log into YouTube.
Now I admit, that’s hard.
I’m still working out exactly how I’m going to implement this measure for myself,
but considering the fact that the majority of YouTube hacks I heard about stemmed from
some kind of email phishing attack, it makes sense to try to separate the two as much as
possible.
Step five, I suggest you build alternative platforms for distribution and communication
that don’t rely entirely on YouTube.
Every All Things Secured video is also copied over to Odysee, another video streaming platform,
so that if this channel goes down, at least the video archive is preserved somewhere other
than my backup drive.
I’m also building a connection with you on Twitter and via email, so that when things
do go wrong, there are other methods of communication.
Make sure all your eggs aren’t in one basket.
Number six, never under any circumstances give over your password, and number 7, if
you haven’t realized this by now, it’s wise to be extremely skeptical of any email
that puports to come from Google or YouTube.
Don’t click the link.
Log into your account instead.
And that leads me to my final soap box.
Forgive me for a moment, I’m going to pretend that somebody at YouTube headquarters is watching
this video.
And for that person out there, I have three simple suggestions for you.
First, please stop allowing people to send messages from the trusted [Google.com](http://Google.com)
or [YouTube.com](http://YouTube.com) domains.
It needs to be clear when a message is or is not officially from your company.
Second, you should always require a 2FA re-authorization whenever any kind of anomaly occurs, such
as a change in IP address because somebody is accessing my account from elsewhere.
And third, this one really baffles me, somebody shouldn’t be able to change or remove my
2FA security without first authorizing using my 2FA key.
I realize people lose their 2FA, but you can easily force people to create 2FA backups
in the same way that Apple has started doing that when setting up 2FA keys.
Oh, and since you’ve watched this far, I encourage you to tweet this to YouTube so
that they see it.
Who knows, even a small group like us may be able to enact positive change on this amazing
platform.