(upbeat music)
- Now, this is a video I didn't wanna create,
but I'm hoping that you and I can
both learn some lessons through
what I'm gonna share about my YouTube channel being hacked.
I already announced it on the same day that it took place,
but here I wanna talk about some of the lessons
and some of the things that really saved me compared
to other YouTube channels.
- As many of you would already know,
our YouTube channel got hacked last week.
- [YouTuber] Corridor Crew, we've removed
your channel from YouTube.
- Now, on the 22nd of August at around 19:30 UK time,
we noticed that someone had changed the title
or the name of my YouTube channel.
They had changed some of the graphics.
They started live-streaming an Elon Musk crypto video.
They then started marking all our videos as private.
Now this happened really, really quickly,
so it was definitely automated, in our opinion.
It happened to quickly for a human
to manually go and make those changes to the channel.
Now, when we noticed this,
one of the first things I did was remove the person
that had editor privileges on my YouTube channel.
Now this was a good thing,
because an editor cannot delete a channel
or publish content.
All they were able to do is mark all my videos at private.
They weren't able to delete my videos.
They weren't able to delete my channel.
They couldn't change the permissions, as an example.
They couldn't delete or reset streaming keys.
So as the owner of the channel, I was able to go in.
I removed the current stream keys, I reset them.
I went and deleted the livestream,
and then I started restoring the channel,
like setting the name back to what it should be David Bombal
I changed the graphics back to what they should be,
and then I had to go back manually
and set all the videos back to public.
Now we were very fortunate.
I think within about 30 minutes,
we were able to get the channel back to what it should be.
- All in all, Corridor Crew was completely unresponsive
for five days.
We lost tens of thousands of dollars in that period of time.
- Now I really wanna thank those of you
who have reached out with your support,
who have left fantastic comments.
Some of the comments were interesting;
let's put it that way.
It's always amazing how some people will try
and kick you when you're down.
But I really wanna thank all of you
who supported me during this,
and I really wanna express special gratitude
to Neal Bridges.
Neal has, unfortunately, just had some really bad news.
He's got Stage IV cancer.
So the day before he went into a hospital
and had tests done,
he actually helped me restore the YouTube channel,
gave me some advice on some of the messaging
to send out, and I really wanna thank Neil
for his support.
He's been on my channel multiple times.
He has shared advice with all of us
on how to improve our lives and get into cyber.
But he's also helped me tremendously.
So a real shout-out and thanks to Neal Bridges.
Please send your love to him during this difficult time.
We wanna wish him all the very best.
Now, I made some announcements on Twitter
and in the YouTube community just
to let you know what had taken place.
There were a lot of comments about, did you not have 2FA?
And it's what's interesting.
The person involved did have
two-factor authentication enabled.
They were using a password manager
and they still managed to get into the YouTube channel.
Now, some hackers also tried to phish John Hammond,
and he did a whole analysis of the malware
that they tried to infect his computer with.
So if you wanna get into the really technical details
of some of the malware that was used to try and attack John,
have a look at that video below.
Now, in this case, malware was also used.
I'm not sure if it's exactly the same malware
that John encountered.
We're still continuing our investigations.
Some people believe that I should fire the person involved
for falling for a phishing campaign
or allowing this to happen,
but I just wanna remind you that Jim Browning,
someone with millions of followers on YouTube,
who deals with scammers had his channel deleted
through a phishing type attack.
So he fell for this.
Now if someone like that can fall for an attack like this,
Don't assume that it's not gonna happen to you.
You think it'll never happen to you, until it happens.
This kind of stuff can happen.
We are all humans.
We all make mistakes.
At the end of the day, I have to take responsibility
for what happened to my channel.
Hackers are able to use social engineering
to get into companies around the world.
There are many, many names.
Just recently, LastPass had an issue
with a developer account.
Twitter, being a famous one,
many, many out there.
Don't assume that it's never gonna happen to you.
Okay, so some takeaways,
The person involved here had editor privileges,
that kinda limited what the attackers could do.
They couldn't delete my account as an example.
They couldn't take control.
They couldn't lock me out of the account.
I was able to kick them out,
but they couldn't lock me out,
so fortunately it was an account that had lower privileges
that was attacked in this example.
The person involved did have 2-factor authentication.
Don't believe that will always save you.
2-factor authentication can be bypassed,
and this was an example of that.
It's happened to other YouTube Channels as well.
Now in this example the person was using a Windows Computer,
so personally my takeaway is I won't allow anyone
to use a Windows computer,
if they want to access confidential stuff,
such as my YouTube Channel.
I will force them to use a Mac or Lenox.
I am kind of disappointed with Windows.
But that's just my personal opinion
that this attack was able to take place,
so I won't use Windows and I won't allow anyone
to use Windows.
I will force the use of 2-factor authentication
with a external 2-factor authentication device,
and I will try and limit what people have access to.
So reduce privileges.
Don't give people too much access.
Reduce the privileges.
Now some good news, once again,
I warned people who are part of my David Bombal website
that the emails could have been breached.
At the moment, it looks like that didn't take place.
Teachable has told us that there doesn't look
like there was any malicious activity
on the website using our accounts.
So that looks fine.
One of the things I decided years ago
is that I would not store credit card information.
I would not store passwords.
I've always tried to use third party systems,
such as Teachable.
Try and collaborate with other companies,
such as Udemy.
I don't have access to your email address
or your password on Udemy.
I don't have access to your credit card information.
I prefer that.
Now I want to share some lessons
that I think both I and you can learn
through this experience.
I just need to preface this with a disclaimer.
This is not legal advice.
This is just my opinion, based on my experience
This is what I'm going to change,
And what I've learned through this experience.
So just remember it's not legal advice.
First thing is have friends that can help you,
or have people that can help you.
I really want to thank Neal Bridges once again
for phoning me and helping me during this attack.
So make friends with good people.
Have good people on your side.
Also, have a good team.
Now in this case, it looks like one
of my team members made a mistake.
But invest in your team.
Teach your team.
People are gonna make mistakes.
All of us make mistakes.
If someone like Jim Browning can fall
for a phishing campaign, it can happen to all of us.
Have a plan in place if something does happen.
As an example, The Corridor Crew,
when they lost their YouTube Channel was still able
to put their video on their website,
And that's something that I'm gonna do a lot more.
So if you go to my website, Courses.DavidBombal.com,
I'm going to be uploading a lot of content there.
I'm gonna make sure that if something does happen
to my YouTube Channel, people can still watch my content
on my website.
Now one of the requirements in the UK,
is that you have to tell people within 72 hours
of a data breach.
I phoned the ICO, which is the organization
that is in charge of this kinda thing in the UK,
and they basically told me,
look, you're not sure that a data breach took place,
so you don't have to report a data breach.
Okay, big lesson, 2-factor authentication can be bypassed.
Corridor Crew had the same problem.
- [Male Voice On Phone] His account had 2-factor on,
so the only possible way I could think they got
in was they got into his phone as well.
- [Man In Maroon Hat] I don't know how that's possible.
- 2-factor authentication was used on an account.
It was bypassed.
Same thing happened here.
One of the things that I'm going to start doing
for all team members is using a YubiKey.
I wanna make that a policy
that anyone who has access
to confidential data uses Yubikey
or something like that
so that we don't rely on 2-factor authentication
on an application as an example,
but have an external device.
I think that will make our security posture a lot better.
One of the things that helped us during this,
and I think that it's something
that I'm gonna do more and more.
I think we can definitely improve
is compartmentalizing permissions or access to data.
First thing I'll say is I hate email.
Email is a nightmare.
Phishing emails, this kinda stuff is such a problem.
We will either hire people or buy systems.
Stop someone who has access to emails who received emails
on behalf of the company having access to other systems.
So kinda separate stuff,
because it looks like a lot of this stuff comes
from dodgy emails.
Big lesson is don't give people more access than they need.
In the team, I'm gonna restrict who has access to what,
and lock things down more and more.
Now as always, you need to be vigilant.
We need to improve our systems.
There's a lot of things that I need to improve on.
I'm gonna be creating a lot of videos
as an example talking about ways to improve security.
Um, one of the topics I want to talk more about is pf sense,
a better firewall than perhaps some
of the firewalls you may encounter.
Tom Lawrence is a fantastic person to follow.
He has a lot of great content on his website.
Go and follow him so that you can learn
how to deploy security in businesses.
He supports a whole bunch of businesses.
I think we can all learn a lot from people
like Tom and others who support companies day to day.
Another lesson is anti-virus isn't going
to stop everything.
Even if you've got anti-virus on your systems,
malware can get past it.
Software can get past it,
especially if it's new.
If you've got anti-virus on your systems,
it's not gonna save you.
You've got to have multiple levels of security.
Don't just rely on one thing.
Now I could have posted this video earlier;
I was actually hoping to get more information,
but at this point we're still investigating,
so that's all I can share.
Take away from all of this,
it was a really bad experience.
Uh, can't say I want to repeat this.
But hopefully we can all learn from this.
Attacks take place.
If you are working with other people,
they may not attack you,
but they'll attack someone in your family,
or someone in your company.
All it takes is one person in your organization
to download malicious software,
click on a link or something like that,
and this kind of thing can take place.
Now I really want to thank all
of you who have supported me through this.
Thank you for watching my videos.
Thank you for going on a journey with me.
I really want to ask,
because it's affected my YouTube Channel quite badly,
please make sure that you subscribe.
Please make sure you click on the bell to get notifications,
cause that really does help me,
and it's affected, this has affected my YouTube channel.
I'm pretty sure a lot of people decided to unsubscribe
when they saw this stupid video going out,
and I'd really appreciate it
if you can share the news with others.
What are your tips?
What do you think I could have done better?
I'm sure I'll get some snarky comments, uh,
I've had a lot in the last few days.
My advice is ignore the haters.
Make sure you spend time with people that want to help you,
people that build you up, rather than break you down.
But with that, I want to thank you for watching my videos.
I want to thank you for your support.
I'm David Bombal.
Stay safe and all the very best.