On February 6, 2017, YouTuber BlackScreenTV was apparently the first to notice a disturbing new YouTube bug...
...in which many of the largest and most popular channels on YouTube were losing thousands of subscribers per minute.
BlackScreenTV livestreamed the carnage in a broadcast titled “BIGGEST GLITCH IN YOUTUBE HISTORY”...
...and briefly became what may have been the first and only member of the “Negative Sub Club” with -1,555 subscribers.
Trolls from 4chan’s politics board also seized upon the error to kill the subscriber numbers for “libtard” channels...
...specifically targeting The Young Turks and others that the 4chaners deemed “social justice warriors.”
It wasn’t until February 8 that Team YouTube finally confirmed the malfunction with this tweet on its official Twitter account...
...“Yikes! Starting Monday, in some cases, we accidentally started counting two unsubs for the price of one. We’re working on a fix!”
YouTube assured YouTubers that it was only an error with the subscriber count display and that no data was lost...
...however, the incident is has led creators to now question the denial of another “unsubscribe glitch” in December of 2016.
Some remain suspicious that real subscribers are being deleted from channels and that YouTube has been covering-up the problem...
The YouTube platform may have faced its darkest and most vulnerable moment in March of 2015...
...when security researcher Kamil Hismatullin briefly had the power to delete any video on the site in a single shot.
Hismatullin was probing weaknesses in the YouTube creator studio when he came across this logic bug:
POST=https://www.youtube.com/live_events_edit_status_ajax?action_delete_live_event=1 event_id: ANY_VIDEO_ID
The critical error allowed him to spoof commands from any channel and trick YouTube into deleting videos from its system.
All Hismatullin had to do was swap in a targeted video’s identity number in a post request against any session token.
In a blog post detailing the exploit, Hismatullin revealed that that vulnerability only took about “6-7 hours to research”...
...”considering that couple of hours I've fought the urge to clean up Bieber's channel haha.”
Hismatullin knew the bug could wreck “utter havoc” in “bad hands” and envisioned channels being extorted or wiped out.
Fortunately for YouTube creators, he instead chose to report the flaw to Google’s Vulnerability Research Grant program...
...netting a $5,000 reward for the fix after he assured, “luckily no Bieber videos were harmed :D”...
Although not as demoralizing as the “unsubscribe glitch” or as critical as the “delete live event bug”...
...a comment hack exposed in 2010 may have been YouTube’s most embarrassing security flaw to date.
Following the publication of a YouTube HTML injection exploit on the hacker TinKode’s blog, an “XSS attack” was unleashed.
Known as “cross-site scripting,” the technique was used to execute a malicious HTML code in YouTube users’ browsers.
YouTube’s security was supposed to have been filtering out any HTML script tags from comments left on videos...
...but the hackers discovered the filter only blocked the first script tag and allowed a second hidden code to slip through.
The scripting vulnerability was briefly deployed for several hours against videos posted on Justin Bieber’s channel...
...generating defamatory and “tasteless” popup messages while automatically redirecting viewers to naughty sites.
To combat the naughty problem, Google’s security team had to temporarily freeze and shut down the YouTube’s comment sections.
Google refused to reveal who was behind the attack, but it is suspected that word of the exploit was spread by 4chan...
Late in 2016, some of YouTube’s most popular creators began complaining about an unusual decrease in channel viewership...
...with the most widely subscribed, PewDiePie, going as far as threatening to delete his account to test YouTube’s response.
Despite the controversy, YouTube maintained its notorious policy of opaqueness and offered little insight...
...so it was a shock to many when in January, 2017, channel page view counts suddenly began increasing dramatically.
The phenomenon was first noticed and widely reported on by the 3rd party analytics site Social Blade...
...and many creators optimistically hoped YouTube was correcting a bug that had been responsible for the prior decline in views.
Several days later, however, YouTube acknowledged that the numbers were a glitch and that view totals would be rolled back...
...leaving many creators questioning YouTube’s policy of secrecy and the accuracy of the data that it shares publically...
In a paper presented at the 2016 USENIX Security Symposium, researcher Micah Sherr unveiled an unusual YouTube hack...
...using muffled audio buried in YouTube videos to hijack nearby devices with voice commands.
Sherr showed how hackers familiar with Apple’s Siri, Amazon’s Alexa, and Google Now could trick the algorithms...
...and he was able “to construct sounds that are understood as human speech only by computers, but not by a human brain.”
According to Sherr, it would be a “strange noise in the background that a human being would just dismiss as an oddity”...
...yet, “at the same time that noise could be controlling a cellphone that just happens to be located next to a computer.”
In several proof of concept demonstrations, Sherr used videos uploaded to YouTube to issue secret commands...
...ordering devices to open apps, take pictures, to power down, and to send web browsers to innocuous websites such as XKCD.
He fears that a more sophisticated attacker, however, could use the weakness on YouTube to send devices to malicious URLs...
...where malware could be installed and the devices could be taken over without users ever noticing.
“If a million people watch a kitten video with a secret message embedded, 10,000 of them might have their phone nearby”...
...“If 5,000 of those load a URL with malware on it, you have 5,000 smartphones under an attacker's control"...