{"id":485013,"date":"2023-03-23T13:08:06","date_gmt":"2023-03-23T11:08:06","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=485013"},"modified":"2023-03-24T13:25:57","modified_gmt":"2023-03-24T11:25:57","slug":"linus-tech-tips-main-youtube-channel-hacked","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/485013-linus-tech-tips-main-youtube-channel-hacked.html","title":{"rendered":"Linus Tech Tips main YouTube channel hacked"},"content":{"rendered":"

Well-known technology YouTube channel Linus Tech Tips has been hijacked by a malicious actor and is using it to promote a cryptocurrency scam.<\/p>\n

Linus Tech Tips has over 15 million subscribers.<\/p>\n

The attackers appear to have ripped a recording<\/a><\/strong> of a 2021 session from The \u20bf Word<\/em> conference that featured investor Cathie Wood, former Twitter CEO Jack Dorsey, and current Twitter CEO Elon Musk.<\/p>\n

The malicious live stream on Linus Tech Tips\u2019 channel is using keywords involving Tesla, artificial intelligence, GPT\u20134, and OpenAI to get viewers.<\/p>\n

It is promoting a QR code and URL directing people to a Tesla-branded website claiming to give away crypto worth $100,000,000.<\/p>\n

It\u2019s a classic money-doubling scam promising to pay you back double any bitcoin, ether, dogecoin, or USD tether you send to a designated address.<\/p>\n

\"\"<\/a>

A screenshot of the scam webpage.<\/p><\/div>\n

The attacker appears to have gained access to the Linus Tech Tips channel and changed the channel handle from @LinusTechTips<\/a> <\/strong>to @teslaliveonline1.<\/p>\n

Navigating to the old LinusTechTips URL on YouTube gives the error message: \u201cThis page isn\u2019t available. Sorry about that. Try searching for something else.\u201d<\/p>\n

At the time of publication, the channel handle had been changed again to @temporaryhandle, with the channel name changed to LinusTechTipsTemp.<\/p>\n

All videos newer than seven years old have either been deleted or made private.<\/p>\n

YouTuber Linus Sebastian created the Linus Tech Tips channel in November 2008. He went on to found Linus Media Group in January 2013 out of a garage.<\/p>\n

The company is headquartered in Surrey, British Columbia, Canada.<\/p>\n

Linus Tech Tips is not the only YouTube channel targeted in this way.<\/p>\n

Several channels have either reported on the issue, like ThioJoe<\/a><\/strong>, or discussed how their accounts were hijacked, like Paul Hibbert<\/a><\/strong>. (Hat tip to the MyBroadband forum community for referencing these solid explanations.)<\/em><\/p>\n

Joe explains that YouTubers are typically compromised in one of two ways:<\/p>\n

    \n
  1. Trojan Horse.<\/strong> A fake sponsorship deal culminates with the attacker sending a media pack or video game for the victim to download. The media pack may include a file named something like \u201cContract for {thing} on Youtube.com\u201d. However, .com is a lesser-known Windows executable file extension. Double-clicking the file causes a malicious program to run and steal private data from the victim\u2019s computer, including YouTube session data from their browser.<\/li>\n
  2. Malicious Google ads for software downloads.<\/strong> Attackers have started taking out Google ads<\/a><\/strong> targeting free and open-source software. Well-known apps like VLC, 7-Zip, OBS, Rufus, and Notepad++ have been targeted like this. Victims searching for a software download may click on the topmost sponsored link in Google and get taken to a fake site that downloads a virus rather than the actual software to their machine.<\/li>\n<\/ol>\n

    Hibbert explained that even though he had two-factor authentication enabled on his account, the attackers could easily bypass it.<\/p>\n

    \u201cIf a hacker is actually logged in as you using your cookies \u2014 which is what they did to me \u2014 they can use your existing login to go in and change all of your two-factor authentication without first providing a two-factor authentication key,\u201d he said.<\/p>\n

    Although Google does offer an Advanced Protection Program that provides more stringent security controls on accounts, Hibbert said users aren’t told about it.<\/p>\n

    “Google offers something called an Advanced Protection Program that they just keep a secret,” he said. “They didn’t even tell me about it after I got hacked!”<\/p>\n

    However, enrolling for the programme will entail that you buy a Google Titan Security Key, or use any other FIDO-compliant hardware security key.<\/p>\n

    MyBroadband contacted Linus Media Group for comment, but it had not responded by publication, when it was just after 05:00 in British Colombia, Canada.<\/p>\n

    \"\"<\/a><\/p>\n

    Update (14:30) \u2014 Channel taken down, more hijacked<\/h2>\n

    YouTube appears to have taken down the hijacked channel.<\/p>\n

    It now shows the message “This account has been terminated for violating YouTube’s Community Guidelines” when trying to visit the channel’s old non-handle URL.<\/p>\n

    However, two other Linus Media Group channels have now also been hijacked: Techquickie and TechLinked.<\/p>\n

    Sebastian also confirmed on Twitter that he is aware of the issue.<\/p>\n

    \n

    Yes I know -_-<\/p>\n

    \u2014 Linus LinusMediaGroup (@linusgsebastian) March 23, 2023<\/a><\/p><\/blockquote>\n