Just How Bad Can One Click Really Be?

People have expressed doubt, even called me a liar, over my mentions of single-click malicious attacks in past videos, so allow me to talk about two factual real world examples that I experienced firsthand.

0:00 Intro
0:16 Why I'm making this
0:37 Facts, Inference, Speculation
0:44 Example 1
4:05 Example 2
6:20 But that's not Malware!
7:04 But those are patched now!
7:40 But this is rare!
7:59 Summary

[AtomicShrimp]

*Afterthoughts & Addenda*
Just in case there's any doubt about the distinction between my labels:
*Fact:* = evidence that was directly observed or other detail that is known to be true
*Inference* = probable explanation, hopefully the _most_ probable, based on observed facts and outcomes
*Speculation* = 'maybe' - no guarantees here

If you're worried about clicking my link (I mean, I did warn you about links) just perform your own web search for 'list of known security vulnerabilities'

[ShortHax]

Plot twist: You get to the end of the vid and Mike says, “And finally, since you clicked on this video, here’s the virus attached to it”

[puzzLEGO]

‘Can one click really be that bad?’
Rickroll link: yes, yes it can

[frankbaron]

as a retired IT engineer with 38 years experience, i agree with you. it's a constant close race between the complexity of the system, the imagination of the hackers and the lackluster security measures of the user

[huwjanus]

I spent 20 years as a software engineer and had to deal with people on an almost daily basis who thought my obsession with security was unfounded. Usually they would suggest that as a consultant I was trying to screw as much money from them as I could and was therefore over-blowing their security flaws. Several times I walked away from a contract and told them to call me when it all fell apart, which it _always_ did. At that point they were told that yes, I can fix this, but now my fees have gone up.

Good video, as always.

[BjornVerzijlbergh]

I think, personally, the reason they called you a liar was because these attacks are relatively rare, there isn't enough exposure to have left some kind of impression on these users of any significance. As such, people tend to ignore, forget or even suppress the thoughts that something they use daily could be inherently dangerous.

It also doesn't help that there is a taboo on talking about these things in general; People who got hacked are ashamed and people make "fun" of them or "mock" them for being so gullible as to click such a link. But without talking about it, exposing these scams/hacks, it's impossible to teach people about it.

So I applaude you for breaking the taboos and exposing these scams and hacks for what they are.

[IanSlothieRolfe]

I love your fact-o-meter. There are a lot of channels that could do with this level of open honesty!

[MyHam-osbq]

Kinda tired of hearing “stop spreading misinformation” from people on the internet who don’t know what they’re talking about. As always, thank you for the extremely well-thought-out explanation.

[Aci_yt]

I lost my channel for three months last year after clicking on a single link.
The person managed to somehow clone my google session, bypassing password requirements, 2FA and region locks.
So please be careful what you click on!

[Ricksdetrix]

Regardless of if a single click can be harmful, you should always be skeptical. People not familiar with IT WILL be fooled by scammers, to the point that I don't trust anything with a link in that my family or friends send me

[MrWylis]

Superb, Shrimp.
Some info for users of IT at every level there.
You've a rare knack for explaining things simply without being patronising. If you could somehow explain to others how to do THAT, the world would soon be in much better shape.

[ironhead]

I'd like to add, while "it has been patched" might be true, it does not mean that the user clicking the link has the patch/update to their system/tools/plugins/etc.

[infinitelybanta]

Can we make that “fact, inference, speculation” meter standard on all YouTube videos? Or better yet, maybe the entire world?

[samanthanorthover]

I always appreciate your well-mannered and measured responses to these sorts of things. You show a genuine interest in educating people which I find very admirable. Good stuff, Mr. Mike c:

[sutfolsemaj]

There's hardly a feeling worse than being called a liar, frustration is understandable. Even if you were a liar, all that would happen if we believed you is we'd be more careful. You wouldn't gain in any way from lying about the dangers of links in emails. You're not selling an anti-malware software, you're giving people the advice they need to prevent themselves from getting into a situation where such expensive software is necessary!

[S_P_A_C_E_DD]

We're all brave for having clicked on this video

[DeviPotato]

the biggest thing anyone, including and especially IT professionals, should know about computer security, is that there are ALWAYS threats you do not know about because they are new, unpatched (plenty of people put off updates!), or exist in software that you cannot control (such as a background service on your computer or within a browser).

you do not have control over everything within your computing environment, but you CAN control your own actions, such as treating unexpected or unusual links with skepticism, and simply not clicking them. that is the key takeaway from "just don't click" advice - it doesn't matter whether there is an active, visible threat that we know about right now, just that there COULD be, and the consequences of clicking on something malicious are much higher than the cost of avoiding clicking them.

thank you for advocating good security practice on your channel - it's something many people take for granted!

[Absenteeee]

Everyone claiming that one click can't do any harm clearly hasn't done much research lol. A few years ago there was a scam going around Facebook that worked a lot like the first example- someone would message you something over messenger, and if you clicked it it would log in to your account- even if you didn't interact with the page at all.

Also lmao at the comment accusing Shrimp of being "irresponsible" by telling people this- even if he wasn't right, is encouraging safety and skepticism irresponsible??

[torreysauter]

I love the Fact-Inference-Speculation gauge, I'd like more channels to do that. Obviously someone can lie, but it seems useful for having a better informed and (hopefully) more critical audience.

[MikoG]

As a cyber security student I can vouch for the fact that clicking link can give attackers access to a victim's machine. I have performed such attacks in a lab environment where if the link was accessed with an older version of Firefox, I would be given reverse shell access to the victim's machine. Yes, this vulnerability was patched out a few years ago, but as stated in the video, new vulnerabilities are found every day. And of course, there are always zero day exploits which can exist for years before being uncovered.