Getting Hacked by watching a Youtube clip

[oxmox 73]

You Can Get Hacked Just By Watching This Cat Video on YouTube

Companies such as Hacking Team and FinFisher sell devices called “network injection appliances.â€

The only thing you need to do to render your computer’s secrets—your private conversations, banking information, photographs—transparent to prying eyes is watch a cute cat video on YouTube, and catch the interest of a nation-state or law enforcement agency that has $1 million or so to spare.

To understand why, you have to realize that even in today’s increasingly security-conscious internet, much of the traffic is still unencrypted.

Companies such as Hacking Team and FinFisher sell devices called “network injection appliances.†These are racks of physical machines deployed inside internet service providers around the world, which allow for the simple exploitation of targets. In order to do this, they inject malicious content into people’s everyday internet browsing traffic. One way that Hacking Team accomplishes this is by taking advantage of unencrypted YouTube video streams to compromise users. The Hacking Team device targets a user, waits for that user to watch a YouTube clip like the one above, and intercepts that traffic and replaces it with malicious code that gives the operator total control over the target’s computer without his or her knowledge.

These so-called “lawful intercept†products sold by Hacking Team and FinFisher can be purchased for as little as $1 million (or less) by law enforcement and governments around the world.

https://firstlook.org/theintercept/2014/08/15/cat-video-hack/

Edited September 2, 2014 by oxmox

[vilas 477]

omg , last time i was having antivirus alert when i was watching similar movie (i love such "cute cats" movies) and i was thinking "what tha hell i do not download anything" but my antivirus claimed it removed virus and i was only watching YT , shock

[oxmox 73]

Who was brave enough to click on the Cat video with almost 16million hits ? :bounce3:

[Nicholas 5]

Why the heck would you post it if you can get hacked by watching it?

[Sniperwolf572 758]

Fear mongering and this is the key to understanding why it is:

These are racks of physical machines deployed inside internet service providers around the world, which allow for the simple exploitation of targets.

So, basically, this is a machine that an ISP has to physically put in place and allow it for it to "work". Such wow, much scare. Considering traffic goes and comes trough your ISP anyway and they can see/shape your unencrypted traffic as is without mumbo jumbo machines if they want to. There's plenty of ISP's that insert warnings/ads into websites that come to you for whatever reason already (example).

The equivalent is: YOU CAN GET POISONED BY EATING AN APPLE! (As long as someone down the line who interacted with it puts poison in it.)

I can spy/infect on any unencrypted traffic on my work network too, but that would require me to be an asshole and to have a motive to do so. So it boils down to "Do you trust your ISP with unencrypted traffic?" (Or any computer that traffic goes trough).

Much more viable attack vector is to simply disguise a malicious ad and plant it in the ad system. Something which happens quite a lot today, but it's dependant on the people curating the ad services letting such malicious ads through. No need for "applicances" or cooperation from the worlds internet providers. Just simple old timey deception.

Funny cats on YouTube are as safe as they ever were.

Why the heck would you post it if you can get hacked by watching it?

Because it's BS.

Edited September 4, 2014 by Sniperwolf572

[jblackrupert 14]

You should download the latest Malware and keep it updated to protect yourself. Especially if you have nude photo's of yourself.

See: 2:40

[Lenyoga 326]

I watched a YouTube video and my family was hacked, they are now belong to Microsoft.

By the way, good video up there, that kind of basic guidelines should be mandatory in schools nowadays. And I always thought I was paranoid with my 25 character passwords and cloud-avoiding fanaticism.