Linus reveals the cause of Linus Media Group's YouTube hacks

Overclock3D.Net | March 24, 2023, 3:16 a.m. | Original

YouTube needs to harden their security against this kind of attack, and doing so should be simple

Published: 24th March 2023 | Source: Linus Tech Tips | Author: Mark Campbell

Linus Media Group's YouTube channels were hacked through a fake sponsorship email

This type of attack is incredibly common on YouTube
Linus Media Group is not the only company that has been affected by this kind of YouTube account theft, and this kind of attack is extremely common. Given how this hack uses stolen cookies, it is likely that Google and YouTube could easily strengthen their security mechanisms to prevent such attacks. This hack did not require compromised passwords and bypassed the protections of two-factor authentication, despite the fact that hackers were using stolen authentication cookies from the other side of the world.
One easy way for YouTube to help avoid this kind of security issue is to make their authentication cookies region or IP locked, preventing them from being used by hackers outside of the victim's global region. Additionally, authentication prompts should be asked for by YouTube when channel name changes and mass video changes or deletions are requested. These changes would prevent this kind of hack from doing major damage to YouTubers and their channels.

YouTube and Google need to harden their security against these hacks

Given how long this type of account theft has been a problem on YouTube, the company has gained a reputation amongst victims as an organisation that does not take this kind of security breach seriously. This has to change. YouTube has the ability to make this kind of account breach impossible by tightening of existing their security mechanisms.

YouTubers have a limited ability to prevent this type of account takeover, as this kind of breach does not require compromised passwords or any other kind of traditional data breach. All they need to do is open a fraudulent attachment from a fake sponsorship email and hackers have the ability to take over their YouTube channels. While this kind of hack can be avoided by teaching YouTubers and their staff how to spot these kinds of attachments, YouTube can stop these hacks entirely by blocking this attack vector.

We hope that YouTube can respond to yesterday's attack by updating their security mechanisms accordingly.

You can join the discussion on Linus Media Group regaining control of their YouTube channels on the OC3D Forums .

«Prev 1 Next»

Most Recent Comments

24-03-2023, 11:27:15

meuvoy
It's funny how this kind of thing has been going on for years, but it takes a big tech channel to literally shame google about it, for them to do anything about the issue. Quote
Reply
Corsair reveals their XENEON 27QHD240 OLED gaming monitor Cyberpunk 2077's receiving a fully path traced renderer next month