Linus Tech Tips Got Hacked

In this video I discuss how the Linus tech tips YouTube channel, TechQuickie, and TechLinked all got taken over by a hacker and redirected to "double your crypto" scam site, I also explain how you can protect yourself from this kind of attack.

₿💰💵💲Help Support the Channel by Donating Crypto💲💵💰₿

Monero
45F2bNHVcRzXVBsvZ5giyvKGAgm6LFhMsjUUVPTEtdgJJ5SNyxzSNUmFSBR5qCCWLpjiUjYMkmZoX9b3cChNjvxR7kvh436

Bitcoin
3MMKHXPQrGHEsmdHaAGD59FWhKFGeUsAxV

Ethereum
0xeA4DA3F9BAb091Eb86921CA6E41712438f4E5079

Litecoin
MBfrxLJMuw26hbVi2MjCVDFkkExz8rYvUF

Dash
Xh9PXPEy5RoLJgFDGYCDjrbXdjshMaYerz

Zcash
t1aWtU5SBpxuUWBSwDKy4gTkT2T1ZwtFvrr

Chainlink
0x0f7f21D267d2C9dbae17fd8c20012eFEA3678F14

Bitcoin Cash
qz2st00dtu9e79zrq5wshsgaxsjw299n7c69th8ryp

Etherum Classic
0xeA641e59913960f578ad39A6B4d02051A5556BfC

USD Coin
0x0B045f743A693b225630862a3464B52fefE79FdB

and be sure to click that notification bell so you know when new videos are released.

[Markste-in]

The issue is that your current session allows you to just change your password without entering your old pw or any other verification or 2FA. Same with apple and icloud. You should be allowed to disable those 'convenience vulnerabilities'

[ThioJoe]

Google can sometimes be half decent at flagging sites if someone reports it via their Safe Browsing form. I assume it’s partly automated and affected by the number of reports, so a bigger channel will have more people reporting the domain if they know to. But I’ve reported some sites just with their public form and it was flagged well within an hour.

Another thing is apparently even if Safe Browsing flags a site, it doesn’t get blocked by chrome immediately unless you have “enhanced protection” on in chrome settings, which checks every site you visit against Safe Browsing, though of course that could be considered a privacy tradeoff. Otherwise with “standard protection”, I don’t think it will flag by default on chrome until you get the latest offline list updated which seems to happen within a day.

[lymieux]

1 month of no MentalOutlaw, time to start catching up

[sunla]

Silver lining here is that Linus putting the spotlight on this issue might ACTUALLY get us some kind of resolution to this ongoing, massive problem. The fact the Google has not been serious about doing something about this, and Antimalware services aren't doing enough to snuff out this crap, LTT could shed light on the issue that other YouTubers have been ignored for. If something can be done, I'm grateful, just sorry for all the people that have gone through this, especially those with more to lose.

[HowdyYT]

Memology got hacked a few months ago and got his channel back after like a week. I was surprised they didn’t use it as an excuse to just nuke his channel.

[dycedargselderbrother]

The company has scaled in weird ways. Despite having dozens of employees, some aspects are remnants from when there were much fewer resources. For example, they still don't have a dedicated server admin or seemingly anyone tech aware who isn't working deadlines on videos. As a result, stuff like this keeps happening.

More than once Linus, the CEO, had to leave in the middle of a podcast because something in the server room was down. They lost a NAS because no one read the logs for months as multiple hard drives failed. There are probably dozens more stories like this.

They're already beyond the point needing someone looking at this stuff full time; with a second building they probably need more than one person. Instead they just scatter these responsibilities around to be done by whoever, whenever they aren't filming videos and no one is really in charge of even basic administration.

I wouldn't have a hard time believing that dozens of employees not only had credentials but were perpetually logged into LTT and didn't even have session management. That is, the LTT account was exposed as all these people were logged into it in Chrome browsing random BS during lunch break, waiting for videos to upload, etc. Because that's the kind of thing you do when it's just you and your buddy running a little YouTube channel and you never change your behaviors as the business grows.

[Schniebel]

Good thing it happend to linus. Hes the one most likely to make a giant wave in the YT community to force YT to finally do something.

[Strykenine]

LTT isn't my first stop for technical information these days, but I am always interested in what they have to say. Hope they get it all back up and running soon!

[miller]

>Sir, they've hit the second channel
>I know (smiles and does the soyface)
Oh sh-

[TheTundraTerror]

This is a real "hard-R" moment.

[abracadabra]

Didnt think cookie hijacking was still a thing specially for google accounts. I guess it doesn't take that much to spawn secret hidden browser session in the infected computer. Honestly I think it can happen to anybody.

[entothechesnautknight]

I'm genuinely surprised that this issue hasn't been fixed yet, or at least had some kinda stop-gap put in place, like needing 2FA to change the password if you have 2FA on, or vise-versa.

[spx]

I can't believe YT didn't fix this cookie shit yet... I've seen numbers and numbers of creators get hacked

[ObviousRises]

What gets me is that its so easy to prevent this hack. Just require someone to log in (again) before they can livestream or private all videos.

[abdelnajjar]

linus is very good about not shying away from the times that hackers and scammers got to him in order to educate everyone. He NEVER shames anyone for getting scammed or hacked but instead raises awareness so others can protect themselves.

[blusterkong]

Considering they ran ZFS servers as core infrastructure for years without scrubbing, I wouldn't be surprised if they used YouTube as a backup repo lol

[ShihammeDarc]

The most funny thing is Linus will probably make this topic his most profitable video in a long while when the channel is restored.

[MateuLeGrillepain]

Remember when this happened to Nathaniel Bandy.

Two of his channels were rather secure, but his third was tied to an old Hotmail account. He then said that the hacker didn't begin the takeover immediately, reasoning they wanted to get the passwords to the other channels.

[phgamer]

the ironic thing is since they use that same video there is no reason youtube couldnt auto block it and immediatly recognize its a hack. also surprised the fbi hasnt taken down that site.

[ZvZxlcVjaMu]

Congrats on the shoutout from the WAN Show! (1:30:00)