Hello world, youtubers have long been a target of hackers. You know the deal, a criminal
somehow hacks into a channel and changes the channel name and icon to something totally
different, usually resembling spacex or some cryptocurrency exchange. Then they start a
livestream using some pre-recorded video of Elon Musk they just ripped off another youtube
channel. Harnessing the subscribers and clout of the channel to get views.
All with the aim of tricking crypto noobs into sending them their hard earned bitcoin.
The sales pitch being whatever bitcoin you send us, we’ll double it! And send it back
to you. Now, I don’t think it takes a genius to figure out this is probably a scam, but
people fall for it nonetheless… Last year this particular scammer controlled bitcoin
address hoovered up 21 bitcoin in the space of 48 hours - those coins are now worth well
over 1 million dollars.
Google’s threat analysis group has just revealed the scam in more detail, and explains
how they’ve been battling to put these crypto crooks out of business. Google launched their
counter offensive in late 2019 when they discovered scammers were “[luring] their [targets]
with fake collaboration opportunities”.
You see, pretty much all youtubers have an email address linked in their channel’s
about section. This makes it easy for potential sponsors to get in touch with us. Though unfortunately
a good portion of these emails are straight up phishing attempts. One evil email example
google gives is this one. The email, which quite literally starts with “My name Jeff”
offers cash in exchange for the promotion of a non existent antivirus software “pixprotect”.
Once a youtuber had agreed on a price for the sponsor spot, the cybercrims would send
them a copy of the antivirus software to try out. And then, a “malware landing page disguised
as a software download URL was sent via email or a PDF on Google Drive”.
“Once the target runs the fake software, a cookie stealing malware executes, taking
browser cookies from the victim’s machine and uploading them to the actor's command
& control servers.” This is known as “session hijacking” or a “pass-the-cookie” attack.
Once they have them, an attacker can use the nabbed cookies to hijack a session, taking
control of a victim’s google account and thus their youtube channel. Session hijacking
isn’t new at all, it’s been around as long as the internet has existed. But google
says “its resurgence as a top security risk could be due to a wider adoption of multi-factor
authentication”. Simple because passwords are quite simply useless to an attacker if
you’ve got 2FA enabled, so they have to resort to stealing your cookies instead.
Interestingly, the attackers decided not to make the malware persistent, in other words
it wouldn’t configure itself to launch automatically on startup, instead it would run once when
executed, then just exit. Google postulates this was done to make it harder for malware
detection software to identify it as a threat.
At this point an attacker would proceed with their crypto scam, or sell the account for
between “$3 USD to $4,000 USD depending on the number of subscribers.” As with the
current trend, the bad actors behind this malware were operating this scheme as an affiliate
program, the miscreants “recruited on Russian-speaking forums via the following job description,
offering two types of work”. Social engineers were awarded between 25 and 70% of revenue
collected from victims depending on the level of work they were willing to do.
This wasn’t a small operation, google identified 15,000 email addresses and over 1000 domain
names used by the attackers in this operation. But google claims that since May they’ve
succeeded in “[decreasing] the volume of related phishing emails on Gmail by 99.6%”,
which to be fair is pretty remarkable. Also, Google has “referred the [] activity to
the FBI for further investigation”
Whilst this attack was impervious to strong and securely kept passwords, many attacks
are not.
This video is sponsored by roboForm. The easiest thing you can do to level up your security
is use a password manager. Roboform keeps your passwords encrypted until you need them
and notifies you if any of your passwords have been included in a data breach helping
you stay secure. Roboform is one of the og-est password managers, they’ve been around since
the 90’s - I also use them myself.
Use the link in the description to grab 30% off an annual subscription, bringing it to
just $16, and there’s a 30 day refund policy if you aren’t happy with roboform for any
reason.
If you enjoy this kind of video make sure to help me out by mutilating the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on how
an US Navy employee betrayed his country, trying to sell nuclear secrets hidden on an
SD card within a peanut butter sandwich.
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.