How my YouTube channel got hacked!

[@davecamyt]

You may have noticed, my channel name is still Ripple. The 'hackers' changed my channel name twice in the 24 hours they had control which means I can't change it for 14 days. I've emailed Google 👍

[@CW-yp9jo]

Have you tried contacting them on twitter? They seem to respond better on social media than through emails.

[@bernardoberner4]

Uhm, so thats what happened. I saw a video that this channel, Ripple, posted and I thought, Ive never seen this channel, why am I subscribed to it? So I immediately unsubbed. Glad you could recover the channel mate and I already subscribed again👍

[@BioRouge]

You didn't loose much content did you? Glad your back mate. As soon as you shared the email (and I've not gone past 1:40 yet - ) The very first and only needed Red Flag was the email address of the sender. Domain is incorrect. Dave, If you would like - I would be more than happy to chat with you and your audience on basic cyber security practices we should all follow to improve our lives. I've been a CISO for many organizations and serve as a consultant for this very purpose (this is for the benefit for all of us, not reaching out for financial gains).

[@johntoms1170]

No worries Rip! 😁 Seriously sorry you have to go through that.

[@Hexadeci]

Be careful with that computer Dave, I suspect they have a key input tracker and may have all your passwords.

[@paulsmith2516]

Beyond that email address which to me was a HUGE red flag, the other thing you could have picked up on is the grammar of the first email which was terrible. That will NEVER EVER happen in an OFFICIAL corporate communication. I worked in Banking for over a decade so I am HYPER vigilant about security and fraud prevention. I hope this isn't received as critical as all I want to do is highlight more red flags for yourself and anyone else seeing this to avoid more people getting done. Glad you're back Dave and I have resubbed today as well. 🙂

[@cobblett]

email grammar isn't really a giveaway but the email domain could of been and also the files. He was good to message the actual company about it but should of refrained from messaging the orginal email until he could confirm it indeed was legitimate or not.

[@M1ggins]

@@cobblett could have, or could've, never could of.

[@MattMaloneTV]

So glad you got it back Dave! My heart sunk when I saw what happened 😢 Also, I'll definitely be checking emails 3 times over from now on!

[@davecamyt]

Thanks Matt 😁

[@BrownOnline]

On Windows folder view options, make sure you turn on "Show hidden files, folders, and drives" as well as unchecking "Hide extensions for known file types". This could have helped you more quickly identify the PDF was an executable.

[@Albatross-365]

Given how Microsoft keep banging on about security and keeping PCs up to date, having file extensions turned off by default is the worst security flaw

[@HazyJ28]

But also remember that LEGITIMATE PDF files can have malicious JavaScript payloads. (Thanks Adobe 😬😶‍🌫️)

[@SuellioAlmeida]

Sorry to hear about this, but it looks like you got it back and you're alright with your content all being there, we have to be grateful! Please continue posting amazing content and stay alert!

[@davecamyt]

Thanks mate 😁

[@netlizard1]

That's the same way LTT was hacked. Glad your getting it under control Dave. Love your channel.

[@mattrickl06]

Appreciate your honesty Dave, its pretty embarrassing when you get fooled by these complex scams

[@M1ggins]

Scariest I've had was from a bank phishing scam, they'd contacted me about fraud and included my last 3 purchases. Fortunately I'm paranoid when it comes to PCs so phoned the bank rather than click the link.

[@creditableme1]

"No one is going to steal anything from me" -Dave. Thinking you have the 'bad guys' figured out will actually leave you a step behind. I am glad you got all your content back, stay smart!

[@david_6582]

Dave - don’t forget to set up Multifactor Authentication for your Google Account.

[@Michael_SK]

2FA is important, but this method of hacking can be accomplished regardless of having 2FA or not. It's gotten some big KZbinrs, such as Linus last year. There's some videos that discuss it, but as Dave said, it basically copies the environment of which you are using with everything currently logged in over to their system.

[@TraumaTeamRacing]

LIKE A PHOENIX RISING FROM THE ASHES!!!!!!! 🙌🏻🙌🏻🙌🏻🥳🥳🥳 So happy you got this all sorted Dave! The community would be a darker place without you. Great to have you back 💪🏻💪🏻💪🏻

[@iconcity]

Mate And you SCOTT! :) nice to see you here!!

[@craftedworkshop]

This is literally my worst nightmare from a KZbin business perspective, glad you were able to get the content reinstated. Did you have 2FA enabled? I'm wondering if that would have kept this from happening.

[@davecamyt]

Yes as far as I'm aware 2fa was enabled 🫤

[@cr7pt0pl4gu3]

This attack steals the cookies not the actual password so it doesn't need to bypass 2FA to function as it just uses your saved browser session

[@DeeG7]

That's smart but you'd think Google / YT would force re entering your PW if any drastic changes to the account are being made like changing the name or email etc.

[@Ash_18037]

​@@cr7pt0pl4gu3You're missing the point. 2FA is not important/relevant to the session hijacking. The issue is that Google does not enforce 2FA 100% of the time when you (or the hacker who has access to your account until the session expires) request changing an account password. Simple as that! If they did, ie you ALWAYS get a confirmation SMS, the hacker cannot take over your account.

[@Ash_18037]

​@@cr7pt0pl4gu3 The real issue is google do not enforce 2FA 100% of the time when you (or the hacker who hijacked your session because you ran an dubious exe) change your account password. So 2FA is central to the reason people actually lose their account and google could easily fix that. But I guess they decide if people are stupid enough to run an promo executable they deserve to be hacked. I can think of no other reason why this exact hack is still happening a year later.

[@MarkoFavre]

I don't watch Sim Racing videos much anymore, but I'm giving you a subscribe to help build your subscriber count back up. Hope everything goes back to normal or even better, Dave.

[@tallpaul7130]

Ditto, just subscribed, best of luck buddy, can happen to the best mate 🤷‍♂️

[@here2race]

Actually it's not very helpful. I mean from youtubes algorithm perspective dead subscribers (those who don't watch content from the channel) are not very good as well.

[@MarkoFavre]

@@here2race you must be fun at parties.

[@here2race]

@@MarkoFavre at times yeah

[@Genx-sim-scene]

That sucks Dave, but I'm glad you are back and thanks for the info.

[@FunWithTheBugs]

So sorry to hear this happened to you, but glad it got resolved quickly. I can only imagine the nightmare it put you through.

[@Arcane808]

All the best to you Ripple, I'm glad you're back. You're one of the good ones

[@PhilipThompson]

Ah man, sorry to hear this! The same thing happened to me after I gained my first few thousand subscribers. Thought I'd made it to have a sponsorship offer... Shouldn't have clicked the exe file! Fortunately all the hackers managed to get into was my Facebook account. They tried to run ads of thousands of dollars, but thankfully the credit card linked to my account had expired. My youtube channel was luckily untouched.

[@ChasingChevy]

You're literally one of the most genuine dudes on KZbin and it's a shame this happened to you. I'm glad to see you got your channel back and you're using your platform to spread awareness about this scam.

[@mattrittman]

Sorry to hear this man. The SAME EXACT thing happened to me last year. It was a freakin nightmare. You’re lucky they didn’t delete your community posts. I seem to be one of the very few that had my community posts deleted 😢

[@davecamyt]

Yes it was truly awful, but I guess it could have been so much worse 😁

[@mattrittman]

@@davecamyt Yeah for sure man!! Glad to hear you’re back up and running though 🙂

[@NoNameLeft1500]

Happened to me years ago with my email adress. I was a freelancer back then.. and they sended out spam mails with viruses inside to every contact in my email account, so also to every client too. That felt very embaressing in that moment.

[@robholmes812]

It's such an important message. I work in IT Security and our number 1 message to everyone in our organisation is "be wary of emails, if you're even a little bit unsure, check". This is pretty much the way the vast majority of hacks happen now, so thank you so, so much for sharing this Dave.

[@christian_clark]

I do as well. Emails are always such a vulnerable point of malicious activity. Scary how quickly an executable can snag a session token.

[@SimRacingLife]

I had the exact same email sent to me, however because of work and lifestyle changes I've not been able to keep my channel going and not uploaded a video in over a year. So for me I smelt a rat straight away, and yes I avoided it by looking at the e-mail address. This is what I do with any email I receive these days and have done for just over 6 years. The internet is awash with scammers and hackers these days as there is a lot of money to be made, social media platforms being the worst overall, but you just need to be mindful whenever you get an email/text etc. Glad you got everything sorted though, boy it's good to have you back Dave!

[@VMVarge]

Everyone will be back Dave then some. You do a ripper job and we all love what you do

[@tswany11]

I was one that unsubscribed when I saw that I was subscribed to Tesla. I'm glad you're back and I'm resubscribed!

[@nobass_stub1394]

Better still ... don't open the email and contact the company directly. Always scan all files and keep protection software up to date. But very happy your back online and doing what you love to do and share :)

[@URABIKER]

Sorry about that brother. Glad everything is back to normal!

[@MrMiller_77]

Lost me Dave, was unsure what or how I had a sub to the false chanel. Glad you posted an hosest report of the incident. Now you're back, I'm back. Keep the great content coming!

[@matto9734]

Good to have you back Dave! I was a little bit puzzled when your account was gone today...

[@advanceddarkness3]

Glad everything worked out for you Dave!

[@PrimeKOS]

Dave, loads of alarm bells ringing on that email, the email addy alone is suspicious in itself. Additionally the vagueness in their email structure and not being specific to you is normally a dead giveaway. It’s all automated hence the dear content creator and follow up email just saying hello. Glad you got it sorted and lessons learnt mate. Now show us a master class in racing ❤

[@JaradS99]

Thanks for the update Ripple, hope its all resolved soon.

[@michaelw6277]

Wild. Happy to see that you’ve got it back under control.

[@ProjectSimRacing]

I'm happy you got your channel back mate! And thank you for the information!🙌

[@steverubino7190]

Davey Boy , Im so sorry this happened. Im glad your back ! I am still subbed.

[@dhsRacing0620]

I just subbed after seeing GP Laps comment on Twitter to you. Glad you got things back!

[@joaogonzalez7672]

I was one of the 1700 😊 woke up this morning with a YT notification from Tesla, unsubscribed immediately. Don’t worry, I’ll be back! (for a small fee, of course 😊😊😊😊). Very useful video, thanks Dave!

[@samdajellybeenie14]

Hey Dave, I unsubscribed at first because I had no idea what Ripple was. But now I'm back! Glad you got everything back.

[@RALLYTechnical]

Hi Dave, I am sorry you had to go through this. It must have been absolute torture. I know trying to build subs in sim racing is tough as hell. Glad to hear it's all sorted now. I just wanted to say thank you for doing this video. My channel is now at the point where I am having company's contact me and it's served as a reminder to be cautious and not everything is as good as it seems. Again thank you for doing this video.

[@jimpfitzinger9604]

Dave, horrible situation. Glad you got this sorted out.

[@jspearm1983]

Im glad you’re back! And I’m glad they didn’t wipe your existing content!!!

[@noobdaddyraces]

Sorry to hear about this and glad you are back. We are still here.

[@davidgill9363]

Thanks for sharing your experience Dave. Glad you are back and okay

[@SlightlyDusted]

Good to have you back Dave! Usually a fake email is easy to spot, no spelling mistakes in that one though made it look legit. Unfortunately you probably won't be the last person to fall for these scams but good on you for acknowledging your error & highlighting for all of us that unless we're more careful it can happen to anyone, even ex-cops

[@BW_87]

Glad you’re back Dave, these mails are NOT easy to spot. I work in IT and have regular training to avoid such things and even then some come close to getting me.

I saw this Ripple channel on my KZbin yesterday and was wondering why, so I deleted it, but I didn't notice your channel disappeared. This morning while looking for new content to watch I noticed that there was nothing from you and then I saw that your channel was missing. so don't worry, I'm back as a subscriber and I'm sure many of them will join us too

[@TeinakiPalu]

so glad you got it back mate . i had to resubscribe i hope everyone who was unsubed by this can get those numbers back

[@youneslaamarti1149]

I almost called my wife crying when I heard the news ! Glad you got it back Dave. Stay strong mate we love you ! Cheers from Paris

[@DaveAndreason]

You are a great human being Dave. Thanks for sharing and caring. Glad to see you are on the sunny side of this. Love your work.

[@mitchjackson9815]

It completely ruined my afternoon yesterday I couldn’t watch your videos after work!!!!!! I’m so glad everything is all good Dave!

[@patquagliato483]

keep your head up! you got our support!

[@SURG3NT]

Crazy, I was looking for your channel today about the triple monitor stand review you done a while back, I finally found ur channel but yes it read ‘ripple’ I fought was strange, anyhow good to see u back! 👏

[@isctony]

Glad you are sorted Dave - kudos to you for being bold enough to tell the story as you can feel very stupid when things like this happen. The fact you have told your story means you will have stopped other people making the same mistake.

[@SimRacingMotionDoc]

What a nightmare Dave, luckily you are up and running and let the subscribers come back and even more

[@206cubsfan]

Glad you are back! I was so confused last night when I went to watch your videos and your channel was gone. I hate thieves!

[@aplomBomb]

Sorry you had to deal with that Dave, thanks for sharing the details!

[@markabercrombie3763]

Yesterday I looking for your latest Mac from the back video, I started to worry about you when I couldn't find that video and then none of your other videos, glad to hear you got everthing sorted and you're back online.

[@mdahlis]

wow, that's a nasty incident. Glad it seems to have worked out, and thanks for sharing your experiences. Now keep up the good work with simracing.

[@mbgmadbull1141]

I'm just glad you're back dave.

[@djmobi79]

Glad to see you have got some of those subscribers back Dave. I absolutely love watching your content, so also glad it doesn't seem to have dampened your spirit

[@orloxsis]

Hey man I'm Glad you're back! I was worried about it!

[@xovermars]

Welcome back Dave, glad all is well again. See you on the grid!

[@The_BenboBaggins]

This makes some sense now - I noticed last night that I had a Tesla channel in my subscription list, which I thought was odd because I have zero interest in Teslas. Tbh, I put it down to the algorithm trying to push it on me, and ignored it! Never thought it would be the hacked face of an actual KZbin channel!! Really glad you got it back so quickly! It's terrifying how far they'll go with this sort of thing!

[@dannyman12]

I'm offline for one day, and this happened! Your channel is under your proper name right now Dave. Glad to hear this is resolved. I'd love to hear that these creeps are caught and punished for there behaviour!

[@juccavtr]

Sorry to hear that, but glad you sorted it out, and back on track again 👍 One of firsts steps for me, when reinstalling Windows, is to to tick that button in FileExpoler, Always Show The Extensions, amd for known file types. Then you should noticed it too it's an EXE actually.

[@anthonylwalker]

This explains why I was confused yesterday as to why I was subscribed to the Tesla US channel! Glad to hear you've gained control, and it'll slowly come back! I'd hate to think about the hard work you've accomplished just disappearing!

[@busterstevenage]

I wondered what had happened when one of your videos I had queued up went private. Pray that all gets sorted fella!

[@Lucas_Pit]

Awful experience Dave, glad you got things sorted and it didn’t get worse than this. Probably you can state you got even lucky it was ‘only’ this. It feels terrible indeed…. Happy your back in business though and looking forward to your next video.

[@ATG_42]

Hang in there Dave! Were here for you, I actually did have my house broken into, closed the door and changed the locks behind my back with my belongings in there (Sim included), horrible feeling, i hear and ache for/with you. Keep up the epic content! See you on the grid.

[@LargeFry1]

*Whenever there is any doubt, there is no doubt* Glad you got things back in shape, mate.

[@MarkArmstrongGaming]

Hope all is sorted dave and thanks for the heads up

[@davecamyt]

Thanks Mark. Hope you're well mate

[@MarkArmstrongGaming]

​@Ripple.corpor._ still no house matey so unfortunately still no rig but hopefully back on the youtube this year once i get a home :) take care mate keep up the awesome content

[@mattihelenius2]

Hey DAve, hopely all is good soon.. all the best

[@Sophi3Box]

Hey Dave, sorry this happened to you. Your videos pop into my recommended all the time and you seem like a cool dude. I hope everything ends up like nothing happened.

[@Splattzero]

I just started with iRacing, I really like your channel and content, It happens to the best of us, heads up and take my subscribe, u deserve it

[@Hixy-ACC]

Chin up mate! Always good for your viewers to learn this lesson. Thanks you

[@22minplays]

That's a bummer you got hacked! The first email looked pretty legit. The only thing I saw that was a little suspect was using the word "cut" for payment. Thank you for sharing with us all.

[@ITzDisengageNZ]

Hey Dave, great you got the channel back. For reference always check the sizes of pdf files if you suspect something. These supposed pdf files tend to be huge in size compared to normal pdf files. Always check that if you're unsure

[@Bartaaron04]

I’m glad everything got sorted out in the end, I’ve only subscribed recently, but it would’ve been a shame to lose all your past content and everything

[@CKSimRacing]

I feel so relieved that you're back again Dave. I sat down that evening to check if you've got something new going on and your channel disappeared from my subs list. Immediately i thought "oh no, now he's gone because recently he said that he'd scrap it all for good in one of his videos..." later on reading on your discord what happened i was just hoping that you don't lose all of your content, which obviously is your income and could've ruined your entire business...so happy you've got things sorted now and I'm really looking forward to your next content!!

[@ericwhiting100]

Saw a post about this on Reddit this morning. Glad to see you got the account back.

[@JacobCappello]

Good to see you back man! Got a swifter fix than even i got. Looking forwared to the future! Be sure to set up some security codes and backup emails 👍

[@CrazyHenkie777]

Thank God for the voice of reason in our lives! Really glad you're back Dave!!!

[@jamesdaniel8020]

We got your back Dave. Glad you got it sorted quickly.

[@razzjaxx]

Commiserations Dave, and a big thumbs up for being so candid about it. I can imagine this was a harrowing ordeal, but from the looks of it you have made it through with minimal loss and you are now even more acutely aware of the risks. Going through the video and seeing that originating email address, I couldn't help but lament "Oh Dave noooo you did not", but then again as an IT professional I guess I have a trained eye for these details. Hopefully without sounding too patronizing I would urge everyone to NEVER consider an email where the originating address's domain (the part AFTER the @) does not match who they pretend to be ; and when it does match, do verify that the domain is indeed connected to that entity by visiting it in a browser.

[@Pozer714]

I was wondering where you went, glad your back though!

[@DavidMcClellandPhotography]

Sorry to hear about this Dave and glad to hear it's pretty much all sorted. I wonder if some of those 1700 subscribers were unsubscribed automatically because I was. Obviously I've re-subscribed. Only 1699 to go! 👍

[@barnabyjames]

Wow that is terrible - I was one of the people that unsubscribed since it showed up as something else but this showed up in my recommended videos anyway so hopefully you get everyone back!

[@Josey_Wales]

I'm glad you got your channel back! Really love your content but I knew right away what most likely happened. A cod youtuber I check out from time to time had the exact same thing happen to his channel. Imagine if those types actually put some of that effort into their lives instead of scamming.

[@DMAX_DIY]

Holy Crap Dave.. That is absolutely crazy and sorry to hear the hassle it must have caused you. you have a great channel.. Thanks for posting this video though. we all need to keep a sharp eye .. DMAX

[@rickdubbink]

Saw the random livestream pop up and knew someone got hacked, but didn't realise it was you. Shame to see you lose quite a few subs, but I'm glad you're back!

[@sherfillouisy]

Thanks for the update “Ripple” 😂 hope you everything back to normal.

[@ryanmccormack2458]

Thankfully KZbin acted quickly. It took another channel which I'm subscribed to about 3 months to regain control after his account got hacked. Glad you got it all sorted. 👍

[@chrisc3825]

GL, be safe. Invest in a password manager like 1password, don't stay logged in, and learn from the mistake! Surprised even Microsoft Defender didn't pick up the executable. Glad you're back!

[@I_Like__bananas]

Dont put your passwords in someones hands if you cant know what they'll do with it or how its protected. Better look into open source software like keepass. There are a lot of ways to get it synchronised with your devices

[@chrisc3825]

@@I_Like__bananas 1Password's security is pretty well-documented. While storing stuff locally in some manager may seem safer, one of the problems becomes how do you safely sync across devices while ensuring that you don't fall into some of the original problems we're attempting to avoid, like password sharing. Certainly it can and is done, but the bar to entry becomes well-above the average computer user's technical know-how or willingness, sadly.

[@justeddie6836]

Glad you didn’t dramatically retire but what a shame you got hacked!

[@rudybertazzo]

I'm sorry this happened to you, no one is safe! Thanks for the detailed video, very informative

[@pitspeedtv]

First line of defence: If the @THIS does not match or come close to "I AM THIS"... They are NOT THIS... This goes back to the 90's! Sorry you got hacked.

[@paulcole]

Oh Dave, I do hope you’re still in touch with your old team - the bants will be EPIC!!

[@WNxJohnDoe]

I’m glad you shared this and KZbin recommended it so I found it. I saw the livestream figured it was one of the channels that went dark and unsubbed immediately. Glad to be able to resub now that you have control again. Great thing to share openly, I’m sharing it with family because it’s a thorough example of the experience start to finish.

[@monfoxtrot3123]

Hey Ripple! Glad you got control back!

[@DouglasThom]

SO GLAD to have you back, Dave! I can't imagine how that was and I'm really happy you had the presence of mind and perseverance to see it through.

[@79SHANEO]

Hang in there Dave, absolutely devastated to hear this has happened to you. I'm not going anywhere, take care mate

[@reljaljubobratovic4806]

Subscribed back. Sorry to hear this happen to you. Yours is by far my favorite channel that I constantly return to, morning after morning before work, to check out if there's a new race by Dave to watch as I have my coffee. Keep on kicking man, and thanks for all your efforts.

[@JeffEdwards258]

Glad you're back Dave! I had unsubscribed and now I've re-subscribed.