Jump to content

Linus Tech Tips, Tech Quickie, Tech Linked channels hacked

betav17
By betav17
in General Discussion
 Share
Spotty
Message added by Spotty,

The Linus Tech Tips, TechLinked, and TechQuickie Youtube channels have been restored.

A video explaining what happened is now up:

 

 

Recommended

Posted by LinusTech,

Thanks for the concern everyone. We are still in recovery mode over here and working with YouTube to get everything restored. Will hopefully have a video (or at least an update on WAN Show) to share with you all ASAP, but we want to make sure we get the details right since smaller channels may rely on our experience to help harden their own security.

Recommended by Spotty

268 reactions

Go to this post
Posted
5 minutes ago, Mikezz said:

Highly unlikely scenario. 

I still think Redline Stealer was the cause of this

n3ptune_cpu

 

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Well I guess let's hope it's only the YouTube channels... As someone working in IT, I know that if payment details are involved, or even worse, personal identifiable information... Let's say the sh*t hits the fan...

Good luck with disaster control.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
Just now, Spotty said:

It's not a video, it's just a text message. A copy is pinned to the top of this page if you would like to read it.

I know there is a lot going on...but in terms of the forum, has there been any indication of a breach here?  Just asking, as if they had their YouTube sessions compromised there is a non-zero chance that whatever LTT account was logged into the LTT forum also had the session keys stolen

3735928559 - Beware of the dead beef

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

The workday at LMG today is going to be a nightmare for everyone who has access to the channels, not that Linus will go off on anyone but having to secure everything is just a slog.

I'm the reason we can't have nice things

 

Row row fight the power!

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Hacking LTT to promote BitCoin via Elon Musk ??!?!?! 🤣🤣

It's like hacking HardwareUnboxed and promoting Nvidia and their politics and business model. 

This truly is peak irony right there. Of all the channel that could've had any success with that stuff, they chose exactly the one where 99% of the people are ready to publicly lynch miners and crypto traders. I still can't stop laughing.

| Ryzen 7 5800X3D | Arctic Liquid Freezer II 360 Rev 7| AsRock X570 Steel Legend |

| 4x16GB G.Skill Trident Z Neo 4000MHz CL16 | Sapphire Nitro+ RX 6900 XT | Seasonic Focus GX-1000|

| 512GB A-Data XPG Spectrix S40G RGB | 2TB A-Data SX8200 Pro| Phanteks Eclipse G500A |

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
6 minutes ago, Taf the Ghost said:

LMG's biggest headache is now they can't trust any of the computers on their network until they run a basically deep check on everything. That's the real headache that comes with this.

Perhaps not

I doubt just anyone can log in and upload videos.

So they can narrow it down to computers of people that are able to log in

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
2 minutes ago, n3ptune_cpu said:

I still think Redline Stealer was the cause of this

Hm, if it was redline, the question is how did they get a remote code execution... Who clicked? And what else came in a package with that. They'll probably have some persistence or spreading in there... I hate this stuff, it's such a pain to make sure nothing worse happened, especially with IOT devices...

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
Just now, LightJack05 said:

Hm, if it was redline, the question is how did they get a remote code execution... Who clicked? And what else came in a package with that. They'll probably have some persistence or spreading in there... I hate this stuff, it's such a pain to make sure nothing worse happened, especially with IOT devices...

https://blog.avast.com/adobe-acrobat-sign-malware Potentially this, it’s very well executed. 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
6 minutes ago, A_Button117 said:

The good news is YouTube should be able to put things right back to the way they were. Of course I'm sure they have lost subs before being taken down. This also probably affects their upload schedule they set for the week. 

Honestly this will probably be a net positive for them in the end. LTT is big enough that I am sure they are getting expedited help in restoring the channel so I doubt it will take more than a day. Not only that but now they get to talk about getting hacked in a video or on wan show which I am sure will perform well. 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
3 minutes ago, Moortu said:

Perhaps not

I doubt just anyone can log in and upload videos.

So they can narrow it down to computers of people that are able to log in

Probably only needed to flip one workstation and use it as a proxy so the requests kept on coming from the same IP address (thus not flagging the need for MFA) 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
7 minutes ago, TheTripleDeuce said:

2FA is fine...unless you use text message 2FA....linus has been hacked through his mobile carrier in the past...

Linus is smart enough to not currently be using SMS for 2FA. Give him SOME credit.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
Just now, LightJack05 said:

Interresting... You got a more technical link to that so I can dive into the code or something? Might fire up a Remnux if you can get me a sample. 😅

https://securityscorecard.com/research/detailed-analysis-redline-stealer/ A detailed analysis that I shared earlier, it’s pretty comprehensive, if you want to play with one you can find it yourself I’m sure. 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
Just now, wordloc said:

Probably only needed to flip one workstation and use it as a proxy so the requests kept on coming from the same IP address (thus not flagging the need for MFA) 

Yeah could also be a session token stealer or something. That would allow the user to stay authenticated... Although, I think more widespread changes would require 2FA authentication, right?

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
Just now, LightJack05 said:

Yeah could also be a session token stealer or something. That would allow the user to stay authenticated... Although, I think more widespread changes would require 2FA authentication, right?

Depends on the changes, reasonably it should and if it didn’t then that’s Google/YTs fault. 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
1 minute ago, Drazil100 said:

Linus is smart enough to not currently be using SMS for 2FA. Give him SOME credit.

LTT got hacked a few years ago, and exactly that was the cause. They def don't use it now, they have stated that they don't.

“Remember to look up at the stars and not down at your feet. Try to make sense of what you see and wonder about what makes the universe exist. Be curious. And however difficult life may seem, there is always something you can do and succeed at. 
It matters that you don't just give up.”

-Stephen Hawking

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
2 minutes ago, Mihle said:

LTT got hacked a few years ago, and exactly that was the cause. They def don't use it now, they have stated that they don't.

That's why I specified "currently" xD

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
5 minutes ago, wordloc said:

https://securityscorecard.com/research/detailed-analysis-redline-stealer/ A detailed analysis that I shared earlier, it’s pretty comprehensive, if you want to play with one you can find it yourself I’m sure. 

Ok. so the downloaded ZIP file just straight up contains the .NET assembly/.exe file? I question that people would fall for that... Also, are you sure Defender wouldn't catch that? Even if it is 400+MB?

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
1 hour ago, Datanerdje said:

2FA is a scam/hack to get your location and ID better verified. Its an exploit and doesnt contribute to security at all. As a matter of fact your personal security is even worse. 

let me guess, youre wearing your tinfoil hat and reading a book on conspiracies

 

2FA is still streets ahead of password123

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
7 minutes ago, wordloc said:

https://securityscorecard.com/research/detailed-analysis-redline-stealer/ A detailed analysis that I shared earlier, it’s pretty comprehensive, if you want to play with one you can find it yourself I’m sure. 

Careful, some are so smart sort of know how to cheat virtual boxes by showing a popup that seems real, and if you click it they can execute outside of the virutal box 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

yeah they definitely don't use SMS 2FA, that is very risky nowadays due to Some Swapping Abuse to carriars

 

n3ptune_cpu

 

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
2 minutes ago, LightJack05 said:

Ok. so the downloaded ZIP file just straight up contains the .NET assembly/.exe file? I question that people would fall for that... Also, are you sure Defender wouldn't catch that? Even if it is 400+MB?

I don’t know if defender has updated to check for recent changes 

 

https://www.socinvestigation.com/redline-stealer-returns-with-new-ttps-detection-response/ 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
13 minutes ago, QuantumSingularity said:

Hacking LTT to promote BitCoin via Elon Musk ??!?!?! 🤣🤣

It's like hacking HardwareUnboxed and promoting Nvidia and their politics and business model. 

This truly is peak irony right there. Of all the channel that could've had any success with that stuff, they chose exactly the one where 99% of the people are ready to publicly lynch miners and crypto traders. I still can't stop laughing.

I don't think the hackers care. they just want a channel with tons of subscribers so they can blast their scam out there.

If your question is answered, mark it so.  | It's probably just coil whine, and it is probably just fine |   LTT Movie Club!

Read the docs. If they don't exist, write them. | Professional Thread Derailer

Desktop: i7-8700K, RTX 2080, 16G 3200Mhz, EndeavourOS(host), win10 (VFIO), Fedora(VFIO)

Server: ryzen 9 5900x, GTX 970, 64G 3200Mhz, Unraid.

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
1 minute ago, LightJack05 said:

Ok. so the downloaded ZIP file just straight up contains the .NET assembly/.exe file? I question that people would fall for that... Also, are you sure Defender wouldn't catch that? Even if it is 400+MB?

They actually make the files huge so that they can't be uploaded to totalvirus scan and it takes a while to scan by a virus scanner.

It can even go as far as to not have any bad code at first, but it downloads it later. so when it is first scanned the virus scan will not find anything

Link to comment
Share on other sites
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing General Discussion

×