youtubers are getting hacked hackers are taking over their channels getting full control to add
and delete videos start live streams and ultimately delete their channel it honestly
has me worried about my channel because this hack is pretty clever but the hackers made
a mistake they went after one of the best hackers on youtube john hammond who while
almost falling for the hack himself you know when you swipe down to see your notifications
it looks like real google caught it and reverse engineered take that hackers so in this video
we're gonna break down exactly how hackers are taking control of youtube channels and what you
and your favorite youtubers can do to keep your channels safe i don't have a coffee cup i'll be
right back this video is a psa a warning to all creators so please share with all your favorite
youtubers get your copy ready and let's break this down oh by the way if you want to become a hacker
like john check out the sponsor of this video it pro tv they have all the cyber security and i t
training you need to get started on the path to becoming a hacker so definitely check them
out they are what i use i got a link below and if you use code network chuck you get 30 off
forever now back to john almost getting hacked because yeah even experts in cyber security can
fall for hacks and he almost did uh my name is john hammond i'm a security researcher by day uh
and at night when i can squeeze in a little bit of free time uh i also create content on youtube
awesome and the reason we're talking today is because someone foolishly tried to hack a
hacking youtuber's youtube so walk me through the first moments here okay so if it's all right i'll
give you a little bit of a backstory uh i gotta be honest this happened yesterday uh it was a sunday
and i was out going for brunch with my friends and my phone vibrated and i got a notification
and i dropped down hey you know scroll to check your notifications and it was a google drive it
was an official google notification that said uh youtube has shared a pdf file with you
i was like that's weird uh and it was a google account allegedly and i thought okay that would
normally kick off and send a natural uh google drive email it gives you a notification and says a
user has shared a folder or file or anything with you so i thought i'll go check my email before i
go and open what this google drive file might be so when i went to go take a look at my email
i had this in my inbox an item shared with me youtube copyright report and it's from google.com
right it is a legitimate hey google drive service letting me know that the google account had shared
an item with me youtube copyright report you might be able to notice right off that
uh okay email address certainly raises an eyebrow that really loses its credibility right away but
the youtube copyright report itself was a little at least intimidating to look at uh
this looks pretty official the youtube copyright infringement warning now chuck i'm sure i don't
have to tell you uh as a content creator a copyright strike is a little terrifying
yeah terrifying it adds a little bit more concern and i think for an innocent unknowing victim this
could certainly be uh a concern and hey you want to read the full report and the document at the
link below if you don't read the report you can't appeal whatever decision comes from this
so when i opened this thing up i thought all right well i don't really want to click this
open full report button for real but i would like to try and right-click it and copy the link
address and get an understanding of where is this thing going and what is it doing now real quick
before we jump there what what do you think is different about this phishing attempt versus
like normal run-of-the-mill fishing attempts this one caught me off guard because you know when you
swipe down to see your notifications it it looks like real google it looks like a google drive file
and you just hate at least in the big bold letters youtube or google has shared an item with you an
official file youtube copyright report that's not just an email that you get oh hey here's a
cutesy please click my link it had a little bit more pizzazz to it and certainly was a bit more
believable going through legitimate official channels and i i have to admit i i'm worried
that i might just absent-mindedly fall for it i think had i not gone to go double-check the
email itself had i just simply looked at the file with the google drive pop-up i could very well
have taken this more seriously and and fell in for it uh i think doing that extra due diligence
let me go see the legitimate email uh that is where i had saw the address because otherwise
there were no signs that this was fake all right so you got the email and you you uh you you knew
by this time that just by the the weird email that said where it was shared from that it was
probably something fishy and then now you have this link to download the copyright report so
had i copied this link i would have seen this url uh https next get report site
with some random letters and strings here and included a get parameter http get parameter
that would have my legitimate email address here what where on how i received this original email
so okay i'm assuming this parameter is included for tracking sake okay they want to know that i
am a legitimate victim i am one that could fall for this and now could be added to whatever list
if they do more attacks like these but i thought let's go ahead and play with this link on its own
i tried to go access this in a little bit more of a safer sandbox you might have seen me work
through tails tails linux one of those amnesia hey only ephemeral operating systems with linux
and hunix works just as well and funny enough using and setting up this virtual machine was
exactly the video that i allegedly had a copyright strike on i was about to point that out that's
pretty funny and then i thought hey let's slap it in and see if we can go to this website
it redirected me i don't know if we were able to catch it just there but the next dot get report
that i was at suddenly went to download with a different string and what would have been that
http parameter now the gimmick is that this didn't do anything else like if i view the source code
i hit control u on my keyboard that's a blank line there's nothing on the website and i
thought that's weird uh i don't know if there are some strange settings or some shenanigans
where tor just wasn't letting anything more happen uh i could check out hey what what
happened from the network perspective we'll move into the developer tools so if i were to take a
look at what these requests were doing from the network perspective when i make the first request
to next that does some shenanigans you can see my original request a response that came through
but ultimately the headers said cool you're good but it ends up redirecting me over to
that download get report site with what would have been my own email included ultimately
this doesn't go any further but in a different browser it has different functionality now why
do you think that is that it's not working through like your secure hunix tor situation
so malware strains can do a peculiar thing when they're waiting to receive a callback
or connection like over http especially through the browser right uh it might be wanting to ensure
i'm fooling or deceiving the legitimate victim who's probably using a modern web browser like
chrome or like firefox or hey you're scrolling through your android phone or your ipad
uh something like tor or a command line utility like curl okay we'll ignore those requests and
not proceed forward with them it's checking your user agent very clever so they're trying to hide
themselves from people like you yep can't have the security researchers come in and ruin all the fun
so i jumped into a different virtual machine at this point because okay if tor wasn't cutting it
for me i guess i will go through a vpn and i'll go ahead and try and download or see
what came through on that website using the command line tool curl
nothing came through uh if i add some verbose debug information still really nothing
but if i were to add a user agent so if i were to run curl again following redirects to attack
l going ahead and adding a new user agent that might be a legitimate chrome uh i'd be able to
go ahead and actually see the response from this is going to send me right to that download link so
if we wanted to get real fancy let's just trust it let's just see it happen and that actually
ends up speeding me over to now discord when i actually went ahead and uh kind of shared some
of the information on this it gave me a a dropbox link which you might be able to see on the twitter
thread so things have changed already even just the time that we've uh wanted to record this and
that gave me a new file copyright report.zip which differs from what i had previously
um let's see if it's the same file yeah yeah let's do some live and that's really clever they put it
on discord as a hosted file there so just for our own sanity check what i had to begin with is this
youtube copyright report.zip which would extract to this copyright report and that would give me a
hefty file that was a screenshot file but still a windows binary executable let's go ahead and
go take a look at that new discord one looks like that was copyright report there it is i want to
just double check that this is what it says it is and it is a zip archive cool so let's play with it
copyright report copyright report docx screenshot yet again uh it may very well have just clobbered
what i had previously i don't know ooh one of those has a space in it the other one doesn't
some detective work here this is fun so both of these are just flat windows executables
let's check if they are in fact the exact same file just by taking a look at the the sha-256 hash
these are massive files you might have noticed hey that was like a 400 megabytes and this one
looks to be different so maybe we'll have to do some due diligence and and poke at this thing
interesting interesting now here it is john actually sent me the malware now i'm not going to
open it i'm too scared but jon does open it john cracks these puppies open and sees how they work
so if you want to see that go watch this video right here now before they get to your video
what was the end result what are they trying to do are they trying to capture and get your youtube
credentials what was the end game so if we had detonated that malware sample if we let it run
in a real environment uh what it ends up kicking off is known as a malware family called the
redline information stealer uh there's some cool research and other information out about it online
but really it tries to harvest credentials it looks for saved browser sessions logons username
and password bundles that all up and then kicks it off to home base or their hq it's pretty crazy
so just go do it my video's over and while you're there make sure you subscribe to john because he's
awesome and i'm super thankful that we have people like him who can discover these hacks
and help the public to become aware of it and how how to protect ourselves and again if you want to
become someone like him if you want to learn the skills you need to get started in it and cyber
security check out the sponsor of our video it pro tv seriously they are what i use to keep up to
date on all the latest it trends and if you're new or you're established and you're just trying to
keep up like me you want to check them out they've got everything you need from knowing nothing to
becoming awesome like john so link below use code network chuck get 30 off forever video over done
don't click any links they're all bad i'll catch you guys next time