YouTubers fell for shady 'sponsors' who seized, then sold, accounts
- Reference: 1634884132
- News link: https://www.theregister.co.uk/2021/10/22/russian_crims_lured_youtubers_with/
- Source link:
Google [1]forums have for years witnessed pleas for help to regain control of stolen YouTube accounts, despite the owners using multi-factor authentication. Impacted influencers found themselves not just locked out of their accounts, but scrambling to stop the sale of their channels.
What did they all have in common?
[2]
"Sponsors" who suspiciously disappeared without paying out, but did stick around long enough for YouTubers take the bait.
[3]
[4]
"The actors behind this campaign, which we attribute to a group of hackers recruited in a Russian-speaking forum, lure their target with fake collaboration opportunities (typically a demo for anti-virus software, VPN, music players, photo editing or online games), hijack their channel, then either sell it to the highest bidder or use it to broadcast cryptocurrency scams," [5]wrote Ashley Shen from Google's Threat Analysis Group on the company blog.
Once contact was established, the crims often moved away from Gmail to messaging platforms like WhatsApp, Telegram or Discord so that Google wouldn't spot their phishing attacks or the links to nasty destinations they included.
[6]
When the targeted YouTuber downloaded the malware-embedded software required for the "collaboration," they actually installed cookie-stealing software that attackers used to log into their channels and bypass MFA requirements. The crooks ran the malware in non-persistent mode as a smash-and-grab technique, thus avoiding detection by security products.
Most of the malware was readily available on Github and included RedLine, Vidar, Predator The Thief, Nexus Stealer, Azorult, Raccoon, Grand Stealer, Vikro Stealer, Masad, Kantal, Sorano and Adamantium Thief. The bulk of it was capable of stealing user passwords and cookies, and some had anti-sandboxing techniques inclusive of enlarged files, encrypted archives and download IP cloaking. Still others presented fake error messages requiring user click-through to continue execution.
[7]Google Pixel 6, 6 Pro Android 12 smartphone launch marred by shopping cart crashes
[8]Motivated by commerce, not conscience, Google bans ads for climate change consensus contradictors
[9]Google trims the cut its Play Store takes from digital subscriptions, ebooks, music streaming
Google identified around 15,000 accounts hijacked in this manner and 1,011 domains created just for the purpose of perpetuating the scam. The scum behind the attacks tried to pose as legit sources of software such as Cisco or Steam.
After the scammers seized control of a YouTube channel, they often sold them on account-trading markets, whereupon some stolen channels were converted into cryptocurrency scam accounts.
Shen wrote that since May 2021, Google has blocked 1.6 million messages to targets, displayed around 62,000 phishing warnings, blocked 2,400 files and restored around 4000 accounts. These actions, she claims, have seen the attackers move away from using Gmail to other less popular email providers.
[10]
Google claims it is continuing to improve detection of social engineering malware attacks that target its products, and "YouTube has hardened channel transfer workflows, detected and auto-recovered over 99% of hijacked channels".
The blog post doesn't explain why it decided to reveal its findings now, or when it first acted to protect YouTubers' accounts. Nor does the ad giant discuss whether or not it made any money when channel owners lost access and the crooks took over. ®
Get our [11]Tech Resources
[1] https://support.google.com/youtube/thread/22221399/my-youtube-channel-has-been-hacked-hijacked-ownership-changed?hl=en
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YXKL0w7Y7WcOEoZ8ZGSZEwAAAJM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YXKL0w7Y7WcOEoZ8ZGSZEwAAAJM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YXKL0w7Y7WcOEoZ8ZGSZEwAAAJM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://blog.google/threat-analysis-group/phishing-campaign-targets-youtube-creators-cookie-theft-malware/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YXKL0w7Y7WcOEoZ8ZGSZEwAAAJM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2021/10/19/google_pixel6_tensor/
[8] https://www.theregister.com/2021/10/08/google_climate_change/
[9] https://www.theregister.com/2021/10/21/google_subscription_fees/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YXKL0w7Y7WcOEoZ8ZGSZEwAAAJM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
What's the business model?
To me, popular YouTuber-Accounts are like good old magazines.
You're interested in StarWars, watch my StarWars-Channel.
You're interested in general politics, hear me ramble.
So, if any of this more or less topic-specific channel starts to tout something completely unrelated, i.e. Crapto, why would I fall for it?
I mean, that's the equivalent of a machine gun company starting to advertise in Mom&Prams Weekly.
Re: What's the business model?
Does your stroller not have integrated minigun pods to protect your little darlings from the nasty world? Why will you not think of the children and the greater good?
Re: What's the business model?
Videos on channels with larger audiences are more likely to be suggested to new people, so even if they hook a few people by doing it then it's probably worth it to the scammers.
Most of the malware was readily available on Github
Why is Github allowing this? I appreciate it's probably whack-a-mole, but are they even trying to not host this stuff?
Re: Most of the malware was readily available on Github
"Why is Github allowing this? I appreciate it's probably whack-a-mole, but are they even trying to not host this stuff?"
Think of it from an InfoSec perspective; if everyone can see the source code for the malware it opens up development opportunities for more people to be able to defend themselves (and others) from said malware. Security through obscurity means less people have eyes on the action.
There is an argument that shielding the masses from this information offers greater protection, but the counter argument is that having more "open" channels of analysis means that threat response times can be quicker when, not if, these attacks take place.
not just "influencers"
My favorite violinist Antal Zalai lost his channel and all of his videos to crypto scammers recently. I'm pretty sure no fake sponsorships were involved, just a regular phishing or cracking attack. When I searched backwards from the crypto peddlers' business names I found thousands of mid sized channels on the same boat. WTF YouTube?
Re: not just "influencers"
I guess your violinist doesnt generate enough ad revenue for Google for them to consider them an "influencer" and someone "worthy" of protection/getting their account back.
As for going after the crypto peddlers, Google doesnt go after them until they've ammassed a large enough amount of money, so that Google can then decide they were bad'uns and kick them out, and simply pocket the ad revenue rather than paying out.
Or at least that the only explanation I can come up with, since it should be trivial to do a simple reverse search of whatever crap is being spewed from a compromised/stolen account, and ban all of it. But then maybe that's just too difficult for Google's super duper amazing algorithms...
Re: not just "influencers"
I guess your violinist doesnt generate enough ad revenue
That's a bit simplistic view. Google is in control of what ads and when are showing, so it might as well be that they just don't like violinists (although I am not following what are the latest trends are in terms of who gets cancelled and if violins are still politically correct) and they don't show enough ads.
Re: WTF YouTube
YT doesn't actually care. Income is income, whether from ads on legit channels or hijacked channels.
Google will only really sit up and take notice when enough people jump ship because of these problems. It'd have to be enough users to seriously dent YT revenue, so short of a huge awareness campaign and mass exodus, it seems likely things will stay the same.
15,000 influencer accounts hijacked
Surely that's a positive outcome?