{"id":66876,"date":"2022-08-31T09:00:52","date_gmt":"2022-08-31T09:00:52","guid":{"rendered":"https:\/\/www.cryptocabaret.com\/?p=66876"},"modified":"2022-08-31T09:00:52","modified_gmt":"2022-08-31T09:00:52","slug":"fake-youtube-dmca-notices-exploit-suspension-fears-to-install-malware","status":"publish","type":"post","link":"https:\/\/www.cryptocabaret.com\/?p=66876","title":{"rendered":"Fake \u2018YouTube\u2019 DMCA Notices Exploit Suspension Fears to Install Malware"},"content":{"rendered":"

\"youtube<\/a>The popularity of user-generated content sites like YouTube has led to millions of regular people becoming proud content creators in their own right.<\/p>\n

Since YouTube content creators are also copyright holders, this can lead to a new perspective on the purpose of copyright law. To keep things running smoothly, content creators also need to respect any copyrights held by others.<\/p>\n

Not doing so could lead to copyright complaints from third parties. If YouTube users receive three complaints, their accounts could be permanently suspended, taking all videos, views, subscribers, even creative momentum away. Fortunately, most careful YouTubers never experience copyright problems.<\/p>\n

But out of nowhere, disaster can still strike.<\/p>\n<\/p>\n

\"youtube-bogus-dmca1\"<\/a><\/center><\/p>\n

The message above was received by YouTuber John Hammond<\/a> just this week. In common with similar emails<\/a> received by other YouTubers recently, it mentions a genuine video he created and uploaded to YouTube. It even cites the correct YouTube URL.<\/p>\n

But Hammond is not just a YouTuber, he\u2019s also a cybersecurity researcher, and this didn\u2019t feel right.<\/p>\n

Clever Opening Shot \u2013 But Not That Clever<\/h2>\n

By including genuine information in the message and coupling that with the genuine fear of account loss, the scammers hoped that panic would lead to urgency, and that urgency would lead to less scrutiny. Hammond didn\u2019t panic, he knew his video didn\u2019t violate copyright.<\/p>\n

The message was sent<\/a> to Hammond via Google Drive, in PDF format. YouTube would never do that. Warnings appear in users\u2019 YouTube accounts so viewing them there is always the best option \u2013 unless you\u2019re a cybersecurity guy with a penchant for rabbit holes.<\/p>\n

Hammond followed up by doing what the message asked. He clicked the \u2018Open Full Report\u2019 button for more information and found himself transported to an obviously-not-YouTube URL, with his email address tagged on the end. This is rarely a good thing.<\/p>\n<\/p>\n

\"youtube-bogus-dmca2\"<\/a><\/center><\/p>\n

Hammond found that the destination site acted differently depending on the user\u2019s browser (such as Chrome or Firefox) but eventually redirected to files stored on Dropbox.<\/p>\n

Needless to say, YouTube doesn\u2019t deliver files to its users like that.<\/p>\n

Beware of Unnecessary Links, Multiple Downloads<\/h2>\n

By this point, Hammond was supposed to believe that YouTube communicates with creators via Google Drive, using a Gmail account, in questionable English. According to the text in the notification above, he was also supposed to believe that YouTube hadn\u2019t yet decided whether he should get strike or not.<\/p>\n

This ray of hope draws the target\u2019s attention towards the outcome of the supposed copyright \u2018moderation\u2019 process and away from the bogus copyright notice. Given the warning\u2019s claim that any decision will stand if the user doesn\u2019t read the full report, one can imagine that some might be tempted.<\/p>\n

After clicking \u2018Open Full Report\u2019 for entirely different reasons, Hammond was served with a file that had been hosted by the attackers on Dropbox. It was named \u201cYouTube Copyright Report\u201d and came with a ZIP extension, meaning that extraction would take place on the user\u2019s machine. <\/p>\n

In general, users should be extremely cautious of files that appear on their machines as part of a process they didn\u2019t initiate themselves, especially when the event comes out of the blue. Never trust a stranger bearing ZIPs, it rarely ends well.<\/p>\n<\/p>\n

\"youtube-bogus-dmca3\"<\/a><\/center><\/p>\n

Using Process Monitor on Windows 11 (inside a VM<\/a>), Hammond found that the file tried to discover device information, checked if any anti-virus was running, and then repeatedly tried to contact what appeared to be an IP address in Finland.<\/p>\n

Conclusion: RedLine Stealer Malware<\/h2>\n

We looked a little closer at the Finland-linked IP address and found a lot of interest in Russia, a characteristic it shares with the domain previously highlighted by John Hammond in the URL containing his email address. In respect of the latter, many other similar domains are linked and could be just as malicious, but something else caught our eye too.<\/p>\n

After tests on the domains and IP addresses, we discovered similar URLs containing other people\u2019s email addresses and usernames. We were able to directly link one of the email addresses to an active YouTuber who may have been targeted with a similar bogus copyright complaint. <\/p>\n

We haven\u2019t received a response to the warning email we sent him earlier but the situation is potentially very serious<\/a>. Hopefully he bailed on the process early enough.<\/p>\n<\/p>\n

<\/center>
\"youtube-bogus-dmca4\"<\/a><\/center><\/p>\n

While technically experienced YouTubers may not fall for this kind of scam, it\u2019s not difficult to see how someone who really values their YouTube channel might act emotionally in the heat of the moment. <\/p>\n

That being said, the scam cannot survive when a user has a clear understanding of YouTube\u2019s \u2018strike\u2019 system and the methods used by the platform to communicate problems. Becoming familiar with these processes isn\u2019t difficult but if there\u2019s any doubt, log into YouTube, read any messages and before clicking anything, ask someone. <\/p>\n

Nothing is so urgent it can\u2019t wait, despite what the scammers say.<\/p>\n

From: TF<\/a>, for the latest news on copyright battles, piracy and more.<\/p>\n

Powered by WPeMatico<\/a><\/small><\/p>\n","protected":false},"excerpt":{"rendered":"

The popularity of user-generated content sites like YouTube has led to millions of regular people becoming proud content creators in their own right. Since YouTube content creators are also copyright holders, this can lead to a new perspective on the purpose of copyright law. To keep things running smoothly, content creators also need to respect […]<\/p>\n","protected":false},"author":2,"featured_media":66877,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[308],"tags":[],"class_list":["post-66876","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-torrent"],"_links":{"self":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts\/66876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=66876"}],"version-history":[{"count":0,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts\/66876\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/media\/66877"}],"wp:attachment":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=66876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=66876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=66876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}