Linus Tech Tips & Techquickie is Breached

[Nikos751]

It wouldn’t.

Any technical explanation?

 

[Trident]

Any technical explanation?

Eset has exlained it:
ESET Smart Security Premium and ESET Internet Security contain a built-in list of predefined websites that will trigger a secure browser to open. You can add a website or edit the list of websites in the product configuration.

They don’t mention managing access to credentials anywhere. They just open certain websites in secure environment. If you always bank via this feature, cookies may be protected. But criminals will be mainly interested in opening your email. From there, they will gain access to everything else. They will also exfiltrate saved passwords in various managers.

 

[Nikos751]

Eset has exlained it:
ESET Smart Security Premium and ESET Internet Security contain a built-in list of predefined websites that will trigger a secure browser to open. You can add a website or edit the list of websites in the product configuration.

They don’t mention managing access to credentials anywhere. They just open certain websites in secure environment. If you always bank via this feature, cookies may be protected. But criminals will be mainly interested in opening your email. From there, they will gain access to everything else. They will also exfiltrate saved passwords in various managers.

It's actually on for all browsing

 

[Trident]

It's actually on for all browsing

It only gets triggered when you open a banking website (as per Eset website). And even if it was triggered on all sites, Eset doesn’t prevent programs from accessing your browsers repository. You should be able to create a HIPS rule that will do that but banking protection is a gimmick and won’t help you against these attacks. Attackers will copy the whole browser repository and Eset will just be sitting there.

You see those switches that say “Enhanced Memory Protection, Keyboard protection”.
The cookies are neither in memory, nor is is the user typing them. They are in this folder:
%APPDATA%/Google/Chrome.

 

[Nikos751]

It only gets triggered when you open a banking website (as per Eset website). And even if it was triggered on all sites, Eset doesn’t prevent programs from accessing your browsers repository. You should be able to create a HIPS rule that will do that but banking protection is a gimmick and won’t help you against these attacks. Attackers will copy the whole browser repository and Eset will just be sitting there.

You see those switches that say “Enhanced Memory Protection, Keyboard protection”.
The cookies are neither in memory, nor is is the user typing them. They are in this folder:
%APPDATA%/Google/Chrome.

I know how this works, I just didn't study the malware's behaviour. Even priviledge escalation is not necessary I think.. thanks!

 

[Trident]

I know how this works, I just didn't study the malware's behaviour. Even priviledge escalation is not necessary I think.. thanks!

It is very common behaviour to copy the browser repositories and even cheap RATs like njRAT which is widely available cracked would do the job. UAC doesn’t work against njRAT and it would copy information from ALL user accounts even if you set the folder only accessible by a specific user.

 

[Nikos751]

I wonder if cr

It is very common behaviour to copy the browser repositories and even cheap RATs like njRAT which is widely available cracked would do the job. UAC doesn’t work against njRAT and it would copy information from ALL user accounts even if you set the folder only accessible by a specific user.

Despite Edge uses Credential Manager sth not being used by other browsers, all browsers repos login data can bring hackers the actual credentials
.
At last, caution and malware definitions is the way to go i guess.

 

[Trident]

I wonder if cr

Despite Edge uses Credential Manager sth not being used by other browsers, all browsers repos login data can bring hackers the actual credentials
.
At last, caution and malware definitions is the way to go i guess.

More recent stealers target some third party managers as well. So yeah, caution and AV identification is the way to go definitely.

 

[ForgottenSeer 98186]

lol, Linus Techtips has had revenue of 5+ million euros per year for a while.

Linus himself has been a multi-millionaire for at least the past 10 years off his channel.

 

[wat0114]

The best advise is to use a laptop based on linux/mac/chrome os for managing this content and never open important accounts on a Windows-based PC. If you don’t click on links in emails, it greatly reduces the risk.

In these forums and others, it's funny how at least someone mentions the numerous vulnerabilities and LOLBins in Linux compared to Windows, yet if you stick to recommended repositories and keep it updated, Linux is a completely worry-free OS. I run Linux with kernel based Apparmor-enforced browsers (most likely way overkill), UFW with default-deny out/In, and apply all updates in a timely manner, which btw install significantly faster than the snail pace of Windows updates, and there is nothing to worry about. Security in Linux is actually boring because little is needed to keep it secure. With no more than 2% user base, no one cares to go after it. Yes, "security thorough obscurity" really is a thing

 

[Digmor Crusher]

I can say the same about Windows though, worry free, boring and secure. I have a 11 year old desktop that runs W10, boots in 15 seconds, loads web pages instantly and runs every program I need. Windows updates never give me any issues and I have no issues with security, whether I'm running FSecure, Microsoft Defender , Voodoo Shield, Malwarebytes, Configure Defender or Simple Windows Hardening its basically all quite on the western front, no issues, no infections, no nothing. Plus with Windows I actually have options for any programs I want to install.

 

[Nikos751]

More recent stealers target some third party managers as well. So yeah, caution and AV identification is the way to go definitely.

I wonder if it’s that easy to steal and decrypt credentials data in Linux too.

 

[Trident]

I wonder if it’s that easy to steal and decrypt credentials data in Linux too.

There are some stealers.

New stealthy OrBit malware steals data from Linux devices

A newly discovered Linux malware is being used to stealthily steal information from backdoored Linux systems and infect all running processes on the machine.

www.bleepingcomputer.com

 

[Nikos751]

There are some stealers.

New stealthy OrBit malware steals data from Linux devices

A newly discovered Linux malware is being used to stealthily steal information from backdoored Linux systems and infect all running processes on the machine.

www.bleepingcomputer.com

it's interesting though, that when having saved passwords in Windows 11 browsers, and tried using browserpassview utility by Nirsoft, I noticed the following:
Edge: (custom primary password or device password or no password) & (sync on or off): the utility managed to decrypt my password
Firefox: no sync & (master password or no master password): the utility managed to decrypt my passwordFirefox: sync on & (no master password: the utility managed to decrypt my logins
Firefox: sync on & master password): the utility did not manage to decrypt my logins
Chrome: sync on (there is no master password option) The utility managed to decrypt my logins
Nirsoft tool is a specific simplistic tool, for legit usage, so no serious assumption can be made granted that the behaviour could be just a bug (I dont know what exactly firefox master password protects), but this behaviour maybe is a indication of Firefox with sync & master password is more secure than Edge with same settings.

 

[vtqhtr413]

Hijacking a YouTube channel without a password | Kaspersky official blog

A couple of months ago, the popular tech blogger Linus Tech was hacked. All three of his YouTube channels (the biggest of which boasts over 15 million subscribers) fell into the hands of cybercriminals, who began broadcasting streams with crypto-scam ads. How did the hackers manage to gain access to the channels? Didn’t the famous tech-blogger protect his accounts with a strong password and two-factor authentication? Of course he did (at least, that’s what he himself says).

Linus Tech fell victim to a pass-the-cookie attack, a common method for targeting YouTubers. In this post we take a closer look at the objectives and motives behind such attacks, how hackers can access channels without knowing password and second factor, what Google’s doing about it, and how not to fall victim to this attack.