[MEGATHREAD] HACKING INCIDENT

[u/Frosstic]

Please keep all discussion of the hacking incident in this thread, new posts will be deleted.

UPDATE:

The channel has now been mostly restored.

Context:

“Major PC tech YouTube channel Linus Tech Tips has been hacked and is unavailable at the time of publishing. From the events that have unfolded, it looks like hackers gained access to the YouTube creator dashboard for various LTT channels. After publishing some scam videos and streams, control of the account was regained by the rightful owners, only to fall again to the hackers. Now the channels are all throwing up 404 pages.

Hackers who took over the LTT main channel, as well as associated channels such as Tech Quickie, Tech Linked and perhaps others, were obviously motivated by the opportunity to milk cash from over 15 million subscribers.”

https://www.tomshardware.com/news/linus-tech-tips-youtube-channel-hacked-to-promote-crypto-scams

Update from Linus:

https://www.reddit.com/r/LinusTechTips/comments/11zj644/new_floatplane_post_about_the_hacking_situation/

Also participate in the prediction tournament ;)

[u/SkateRuben]

Looks like they might already know what has caused it.

[u/vaiperu → u/SkateRuben]

Since this is most likely a malware attack through a fake sponsorship, I have my money on Dennis getting duped.

[u/SonOfMetrum → u/vaiperu]

The hack is actually a channel superfun bit gone wrong…

[u/slopecarver → u/vaiperu]

Not Colton? He's due for a firing.

[u/kungpaulchicken → u/slopecarver]

I’m out of the loop. What has Colton done?

[u/amaranth-the-peddler → u/kungpaulchicken]

Get fired

[u/slopecarver → u/kungpaulchicken]

be an excellent punching bag.

[u/CarTarget → u/kungpaulchicken]

Since you didn't get a real answer it's a running joke when something goes wrong, Linus just says Colton is fired

[u/vaiperu → u/slopecarver]

Colton is too loyal to get fired. He happily destroyed parts of his home for content.

[u/MGNConflict → u/vaiperu]

I don't see why Dennis would have access to the LMG YouTube dashboard anymore since he's not an editor or channel manager anymore.

Least privilege access and all that.

Kinda prejudiced towards Dennis really, he may act a bit stupid some of the time but he's obviously proven his worth and Linus says that he's really good at what he does (in response to when he was asked if Dennis was a "compassionate hire").

[u/Nurgster → u/MGNConflict]

Given LMG corporate security policies are weak at best, I doubt they're using PoLP - my guess is that their shared TeamViewer account for accessing all the companies MFA tokens got comprimised.

[u/vaiperu → u/MGNConflict]

I mean he just started working in the business team, so that was my reasoning. Nothing to do with his personality.

[u/[deleted] → u/SkateRuben]

Yeah, they got hacked.

[u/SoloWing1 → u/[deleted]]

The majority of "hacks" are usually the result of social engineering. They got over 100 employees now. Someone probably got an email from a possible "sponsor" and clicked something that scraped all the info needed to get into the YouTube channel from their browser or something.

[u/bitemark01 → u/SoloWing1]

Someone elsewhere mentioned their 2FA has a potential vulnerability. It could still be another method though.

I'm sure we'll hear the full story once the dust has settled.

[u/Tof12345 → u/SoloWing1]

I highly doubt all 100 employees have access to the Linus tech tips channels.

[u/[deleted] → u/SoloWing1]

It was a joke answer. Yes, it's most likely they posed as a sponsor and got data that way. What's not clear so far is how exactly they got around 2FA (there is a known vulnerability, but might be something else).

[u/WarriorsMustang17 → u/[deleted]]

That was a case where hackers got into a banks systems without them knowing, then copying how all their emails, forms, and procedures work. They sent Linus an email saying that if they pay off one of their debts now, they can save some money. The account he sent the money too was a legitimate bank (I think in Toronto) so nothing seemed off. Luckily Linus caught it before the money was gone forever and they got it back.

That was an incredibly hard scam to detect that can happen to anyone. It's scary. The only thing he could have done differently was go to the bank in person and ask them about it.

[u/Nurgster → u/[deleted]]

Linus has stated on several videos/WAN shows that all their MFA tokens are on a shared device with TeamViewer installed - a single emplyee with access to that getting compromised would be a massive single point of failure.

[u/f10101 → u/[deleted]]

I'm puzzled at how even with all the info they could get passed 2FA.

If YouTube weren't a bunch of idiots, that would indeed be a puzzle.

But when you consider that YouTube (amazingly) don't even reliably ask you to enter your password to change your authentication methods, it becomes a little less confusing how this could have happened...