Jump to content

Linus Tech Tips, Tech Quickie, Tech Linked channels hacked

betav17
By betav17
in General Discussion
 Share
Spotty
Message added by Spotty,

The Linus Tech Tips, TechLinked, and TechQuickie Youtube channels have been restored.

A video explaining what happened is now up:

 

 

Recommended

Posted by LinusTech,

Thanks for the concern everyone. We are still in recovery mode over here and working with YouTube to get everything restored. Will hopefully have a video (or at least an update on WAN Show) to share with you all ASAP, but we want to make sure we get the details right since smaller channels may rely on our experience to help harden their own security.

Recommended by Spotty

268 reactions

Go to this post
Posted
2 minutes ago, Robonwars said:

maybe yt has a 0day exploit by the volume of channels being hacked lately

I mean... That is very unlikely... There would be a whole lot more going on if that was the case...

I think it's more probable that there is some software, especially on their servers and public facing that had an exploit... Might also be some vulnerability in an email service or whatever. Something managed to get a RCE on a machine...

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
1 minute ago, Wolves of the West said:

The hacker is likely reading this forum, right now. Dum Dum, DUM!

Well greetings to him, he now has Google being very mad at him... I would not feel comfortable with that...

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
2 minutes ago, RafaelSoaresP said:

I feel LTT was a shit target for the crypto scam, as the large majority of subs are way too tech savvy to fall for that crap

agreed

Dual X5690 my beloved.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
14 minutes ago, Middcore said:

LTT will be fine. All the videos will get restored. A channel this big, YouTube will bend over backwards for them. 

It's the smaller channels that will get completely hosed.

 

That's why I genuinely hope that once the dust settles and they piece together the sequence of events that led up to it, LTT posts a cautionary tale video. "It happened to us, it can happen to you." The video where old Whonnock server died is a good example for that kind of turning crisis into content. (I'd post a link, but you know...)

I sold my soul for ProSupport.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

do you guys think someone will be fired over this?

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Safest way to avoid these hacks is to have a VM to access only youtube services with service account(s). And never use these accounts on day to day use machines. 
Also enable conditional access and 2fa to login to the VM.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
1 minute ago, nielsjacquet said:

Safest way to avoid these hacks is to have a VM to access only youtube services with service account(s). And never use these accounts on day to day use machines. 
Also enable conditional access and 2fa to login to the VM.

that, and good filters on whatever mail exchange server (or service) they are using, and proper instructions on how to apply security awareness for new employees

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Just wanted to drop by and say I'm so sorry for the whole LMG team(s), I just happened to check YT as the first videos were going live and immediately I knew something was up.

This must have been terrifying seeing some nuckfuggets taking over your baby, everything you worked for. Jebus H Christ I can't even imagine how gut-wrenching that must have felt!

 

I hope there is no permanent damage or lasting effects, and I know the chances are slim but I hope the douche nozzles get caught or get owned themselves by someone else.

Take care and be safe to everyone at LMG.

Build: "The Cake Is A Lie" - (Portal 2 Theme) • Wall Mounted (in a ThermalTake Core P8 all sides removed) • Ryzen 5900X • 64GB Team Group Dark Pro (B-Dies) 3600MHz CL16 • ASUS X570-E Gaming • EK Quantum Plexi Monoblock • MSI RTX 3090 Suprim X • EK Quantum Plexi Block • 2TB Samsung 980 Pro Gen4 NVME • 8TB Samsung 870 QVO • Corsair RM 850X • 2x EK P480M Radiators •  PrimoChill Fittings • 2x D5 Pumps • Monsoon MMRS Pump Housing • 2x HeatKiller Tube 200 Reservoirs • 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
12 minutes ago, LightJack05 said:

Well greetings to him, he now has Google being very mad at him... I would not feel comfortable with that...

Looking forward to a stream or video where Linus shows up at the hacker's door... maybe gives them the first tech downgrade, sponsored by any one of the makers of baseball bats...

Razer Blade 14 (RZ09-0508x): AMD Ryzen 9 8945HS, nVidia GeForce RTX 4070, 64 GB 5200 DDR5, Win11 Pro [Workhorse/Gaming]

Apple MacBook Pro 14 (A2442): Apple M1 Pro APU (8 Core), 16 GB Unified Memory, macOS Sonoma 14.3 [Creative Rig]

Samsung GalaxyBook Pro (NP930QDB-KF4CA): Intel Core i7-1165G7, 16 GB DDR4, Win11 Pro [WinTablet]

HP Envy 15-k257ca: Intel Core i5 5200U, nVidia GeForce 840M, 16GB 1600 DDR3, Win7 Pro [Retro]

Toshiba Satellite A70-S2591:  Intel Pentium 4 538, ATI Radeon 9000 IGP, 1.5 GB DDR RAM, WinXP Pro [Antique]

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
4 minutes ago, nielsjacquet said:

Safest way to avoid these hacks is to have a VM to access only youtube services with service account(s). And never use these accounts on day to day use machines. 
Also enable conditional access and 2fa to login to the VM.

Well 0-Trust/Segregation is always a good idea, but only if it is well executed... Also, once the user logs in to the VM, the attacker has access again...

You would have to check for integrity on everything... 

Creating security awareness and putting limitations on code-execution would be ideal in combination with your solution. Basically have a seperate VM (or multiples) for administrator access to the accounts and have them locked down so they don't execute code. (Honestly, a chromebook would be pretty good. 😂)

And then only allow physical access to the machine. Whether that would be realizable in a production environment would be another question...

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Only problem is that Floatplane is too expensive. It's almost 300 INR per month. That's a lot. I will consider it if it merges with nebula.tv . Although that's just a fantasy and will probably never happen. image.thumb.png.d0f40e4cdecbac249bac9d7f40e4d359.png

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
2 minutes ago, denco101 said:

Looking forward to a stream or video where Linus shows up at the hacker's door... maybe gives them the first tech downgrade, sponsored by any one of the makers of baseball bats...

Dennis has been living in the hacker’s house for 2 weeks. That’s why channel super fun didn’t get hacked. 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
16 minutes ago, RafaelSoaresP said:

I feel LTT was a shit target for the crypto scam, as the large majority of subs are way too tech savvy to fall for that crap

Even the ones who purchased the "Screwdriver"?
 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
6 minutes ago, Phrozenbit said:

that, and good filters on whatever mail exchange server (or service) they are using, and proper instructions on how to apply security awareness for new employees

yeah that is the biggest obstacle in IT, getting emlpoyees to use the correct tools and avoid shadow IT. Awareness and adption are a must but not the most sexy thing ever.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
Just now, mrg9999 said:

Even the ones who purchased the "Screwdriver"?
 

we know that under 50 ppl falen for this the scam from the wallet the stream had an potential reach of 18 mio ppl

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
1 minute ago, mrg9999 said:

Even the ones who purchased the "Screwdriver"?
 

I have a friend who bought one. It’s really nice. I don’t use screwdrivers enough to justify the purchase but for someone who needs one on a weekly basis it’s totally a valid purchase. 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
5 minutes ago, mrg9999 said:

Even the ones who purchased the "Screwdriver"?
 

I love mine and use it weekly if not daily at work. I really hope the channel can be recovered quickly, and that it can force YouTube to create a better process for this as well as tighten security. 

Mini-ITX Desktop: i9-9900K@5GHz, 32GB TridentZ RGB 3200MHz, Asus Strix Z390-i, EVGA 3090 Hybrid FTW3, Samsung 970 EVO+ NVMe 1TB, Lian Li O11 Air Mini White

Plex/Minecraft Server: Dell PowerEdge T320, Xeon E5-2470 v2, 48GB RAM, 19.25TB storage, RTX A2000 6GB

Tablet: iPad Pro 11” M1

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

God i hope it wasnt Plouffe that got exploited

 

Who will talk about "lubing" key switches now?

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
6 minutes ago, LightJack05 said:

Well 0-Trust/Segregation is always a good idea, but only if it is well executed... Also, once the user logs in to the VM, the attacker has access again...

You would have to check for integrity on everything... 

Creating security awareness and putting limitations on code-execution would be ideal in combination with your solution. Basically have a seperate VM (or multiples) for administrator access to the accounts and have them locked down so they don't execute code. (Honestly, a chromebook would be pretty good. 😂)

And then only allow physical access to the machine. Whether that would be realizable in a production environment would be another question...

That is what i have to do before i begin my working day, unlock admin account and login to a seperate machine to access intune. All is locked down with conditional access (only verified machines can have access) and 2FA

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
14 minutes ago, BaidDSB said:

do you guys think someone will be fired over this?

At this stage I suspect it is difficult to say 100% what happened, but if the situation occurred as a result of gross negligence or sabotage then I would be surprised if the LMG did not draw consequences against the person or persons in question. 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

This could be a great idea. 

Imagine a new channel - Linus TESLA Tips. 

3900x | 32GB RAM | RTX 2080

1.5TB Optane P4800X | 2TB Micron 1100 SSD | 16TB NAS w/ 10Gbe
QN90A | Polk R200, ELAC OW4.2, PB12-NSD, SB1000, HD800
 

Link to comment
Share on other sites
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing General Discussion

×