LinusTechTips Twitter Account Hacked (and how to secure yourself)

Follow-up Video: • Update on LinusTechTip...
(Please bear in mind that the thought of this being from infostealer malware is absolutely speculation until there is some root cause analysis shared from the official sources)
Linus' Personal Tweet: / 1822776600632709206
Learn Cybersecurity - Name Your Price Training with John Hammond: nameyourpricet...
Learn Coding: jh.live/codecr...
WATCH MORE:
Dark Web & Cybercrime Investigations: • Tracking Cybercrime on...
Malware & Hacker Tradecraft: • Malware Analysis & Thr...
📧JOIN MY NEWSLETTER ➡ jh.live/email
🙏SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎FOLLOW ME EVERYWHERE ➡ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/discord ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware
🔥KZbin ALGORITHM ➡ Like, Comment, & Subscribe!

[@_JohnHammond]

Full disclosure, I did not have my Yubico security key and hardware token set up for my own Twitter/X account while recording this video -- so totally fair play to call me a hypocrite 🙃 This is a good reminder for everyone, including myself, to get that prepped and lock things down! (And please bear in mind that the thought of this being from infostealer malware is absolutely speculation until there is some root cause analysis shared from the official sources) ((And I believe it was the LTT KZbin channel that was compromised previously, NOT their Twitter/X account, so wanted to be sure I included that correction)) (((And I've cleaned up the backup code with KZbin Studio. It was regenerated multiple times anyway, but I appreciate your concerns))) ((((And the YubiKey that I show in the video is not the YubiKey Bio, which has the gray circle and accurately makes a fingerprint template -- so I'll be getting that fixed up too!))))

[@mishal_legit]

Time to get one big john.

[@la_sn3ak3r19]

😮

[@alaindanielherrera1199]

This comment Is 9 minutes older than than the video.

[@WebDesignerAmy]

I am now going to invest in a Yubico security key. 🤣 Also thanks for the tip to check out what "connected apps" were still tethered to a x/twitter accnt. I apparently had quite a few to deactivate!

[@jmr]

I didn't have 2FA on my secondary account until it got hijacked. I was able to get it back either because I was fast or lucky. 😆 Do as I say not as I do!

[@dyerseve3001]

Way ahead of the hackers, don't have a twitter account anymore.

[@mishal_legit]

x

[@dyerseve3001]

also being a nobody helps too

[@la_sn3ak3r19]

Or mastodon

[@jmr]

😆 I was thinking the hackers might be doing me a favor if they stole mine.

[@jmr]

@@mishal_legit Elon can't make me stop saying Twitter and neither can you! 😆

[@jmr]

You should not be able to make certain changes to accounts without re-authenticating. Companies like Twitter and KZbin need to do better.

[@cinderwolf32]

In general, security is a joke to these companies.

[@n_n]

@@jmr I'm so curious as to who you are online. 3C domain + handle + early verified 👀

[@ManWhoLostTheWar]

@@n_n seems he's just an old engineer

[@n_n]

@ManWhoLostTheWar Most likely has connections. I don't see him paying for any of it nor would he be in the com Even after some digging I couldn't find much history that explains away the early verification and stuff. Odd but cool to see there's still people like that out there as most get this stuff unethically.

[@ffffffffffflo]

Oh yea, surely having to re-authenticate even more often is going to solve the problem.🤦‍♂ Totally not gonna get people used to enter their login info and be less alarmed about where they actually enter it.

[@KarlRock]

It's always some kind of malware on an employee's computer, I think? Hackers often pose as sponsors and try to get KZbinrs to open email attachments. Thanks for the video John.

[@seansingh4421]

And that’s why strong Applocker policies are a must to prevent script execution

[@n_n]

@KarlRock You'd think a channel dedicated to tech would have employees that know or at least trained **not to run random files even if they look legitimate** I guess not though

[@LiveType]

Yes, it's typically employees opening stuff 'sponsors' send and getting sessions hijacked. Less than 20% of the people at LTT would have any intimate knowledge of this stuff. I would have thought they had changed some policies about what can and can't get opened. Maybe not? Strict app locking policies should prevent this from occuring but that takes effort to implement and then enforce.

[@TomTKK]

​@@n_n Mistakes can still be made

[@muizzsiddique]

​@@n_n You just need to be caught slipping one time, and it'll be over. Not everyone is at their 100% every second of the day.

[@Person01234]

Disabling 2FA without going through support should require 2FA. I mean, you need your password in order to change your password in a simple manner (you can reset it but then you need access to another account, the email), being able to just toggle off 2FA without having access to the 2FA is unforgivably bad design, something we already know is a bad idea.

[@xBintu]

Absolutely Or with the backup codes, which can't be seen anymore without 2FA, easy solution

[@raylopez99]

Yeah but what if you lose your phone number? I guess you can re-create your phone number, but I recall back in the day when I changed my phone number I was locked out of some (obsolete and not really used) accounts like a Hotmail account I occasionally used. That's because they would send an authentication message to the phone number that was no longer mine.

[@Person01234]

@@raylopez99 Then you have to go through support and probably provide some other kind of evidence, or a different authentication factor (such as the backup codes the other guy proposed, which is itself a form of 2FA). The toggle is fine if the ONLY way to access your account is through a method that uses 2FA but when there are other ways (such as the login token, or a simple password) then you simply shouldn't have the ability to disable 2FA without using 2FA.

[@NGabunchanumbers]

Ive had issues with services that did it that way. I changed my phone number, and didn't update amazon (because I dont use amazon much, if at all). Amazon didn't let me get into my account. They also didn't let me close my account. Support said I should be able to, but it just didn't work. The new person who got my old number was able to use 2fa to get into my account and order stuff. Well, then I called my bank and had them cancel it. But it did send to my email the address of where it was going to show up. It would be funny for me to go there and be like "yup this is mine I paid for it"

[@TessaBain]

​@@raylopez99Phones are easily spoofed. No one should be using that for 2FA in the first place. The option shouldn't even exist. Doubly so in certain cases where they just make it seem like it's a scam. Every time I call one of my banks now, they have to send me a code that I need to read back to them, which is exactly what scammers do. Until I found out they had made that change last year, I was confused why people thought scammers doing this were legitimate. There is no good reason for them to be sending you a text, but they do. Their newest option to get around this is using your voice, by the way. In the age of AI, they want you to turn on """"""security"""""" features, which allows all of the other security features to be turned off by voice...

[@LinuxAvali]

I think the root of the problem isn't that Linus doesn't have 2FA, it's that Twitter doesn't require you to confirm your 2FA code to make security changes to the account, which is a big no-no. He had this same criticism for KZbin when the LTT channel got hijacked. It will let you reset all the security stuff without asking for your password or 2FA code again, assuming you are who you say you are.

[@KennethLongcrier]

John actually did a review of the Malware Email that LTT, received and that Email requests the 2fa key. Microsoft actually does it better by pinging your MFA device and requiring you type that code into the authenticator app.

[@itsonlybrad2278]

Best way to protect your twitter account is to just delete it

[@delta_cosmic]

yeah, they should never come back. No one needs it.

[@EBKTV_AU]

Better still. Don't use the platform at all!

[@bripbrap]

protect the account; protect the world!

[@KajuTheRudeMonke]

I second that

[@KajuTheRudeMonke]

@@PedroKing99 Freedom of speech on Twitter... lol

[@puerlatinophilus3037]

If infostealers can just steal your token and use it on a different device in a different country AND even change password & e-mail address... What's even the point of 2FA? I'm mad.

[@ecu4321]

@@puerlatinophilus3037 now that you mention it, do hardware keys like yubico help at all with these session hijackers like infostealers?

[@Zullfix]

2FA protects against password leaks, and thats about it. Ideally, services should tie session tokens to your HWID, IP, browser fingerprint, or any other potentially unique information to make token stealers less effective.

[@morsikpl]

The point of 2FA is to prevent logging in by someone when there is password leak. Some security is still better than no security.

[@klopferator]

@@Zullfix It's easy to say that, but on the other hand there's demand towards browser developers to limit any way of fingerprinting for privacy concerns. (IP isn't really viable, I tried that on my website and found that in many cases my IP address can change on the fly without me even noticing it, sometimes from an IPv4 address to an IPv6 address and vice versa. After I logged the issue for a few days I've come to realize IP address changes happen so frequently thanks to the way many internet providers work nowadays that it's unfeasable to use it as a security factor.)

[@waralo191]

Usually 2fa is on a different device, like your phone.

[@ya64]

Rather than just sending an alert that someone logged into your account from a different place in the world, that login should be challenged in the first place.

[@minorfall4380]

I agree, bad design and plenty apps do this. Why let me know I may be hacked without a way to block it off. At least from the original link that is also in your email. So, you can then put in a ticket with minimal damages. Though not saving to PC or cache is the smart choice. Sad you can't depend on the platform to fix this issue or even see it as an issue.

[@JackShoreman]

Then every normie everywhere will complain when their ISP resets their modem/router with an update, VPN users will encounter issues, and about 500 other things that support teams at these companies don't want to deal with. Convenience is the enemy of security, but most customers will take the convenience first and foremost. Who do you know that honestly could be bothered to purchase a hardware key? How many even use software MFA? It's just not in the cards at the moment.

[@minorfall4380]

@@JackShoreman I agree with that. The smart thing would be for it to be an option, to opt-in for. So people who want to be more secure can have a way and people who don't can have their convenience. 👍🏿

[@wpgspecb]

REAL companies do this, not twitter though....

[@BillAnt]

A one or two hour delay for any security change with email and text notifications should give the legit user enough time act in case it's a bad actor.

[@cinderwolf32]

Twitter's email has the energy of saying "L bozo"

[@maxave7448]

Most helpful tech support response be like:

[@miss_sapphire]

Please do not blur sensitive information. Blackbox it completely

[@LegacyVision.]

Good luck resolving information from a destructive box blur

[@nurmr]

@@LegacyVision. Blurring can be reversed. It's not too hard.

[@zeeZerl]

Some blurring can be reversed, yes. Better safe than sorry, always box it. If you want blur for the effect, add fake text on top of the box and blur that.

[@JackShoreman]

@@nurmr entropy and god disagree.

[@SolarLiner]

​@@JackShoremansearch for image deconvolution. It can absolutely be done, the techniques are of the 2000s era, you can also de-motion blur. It's not perfect but it's been used by police to make license plates readable despite out of focus and motion blurs in the captured images. Entropy doesn't enter the picture (pun intended) here because blurring is not a random process but a well-defined deterministic operation called a convolution, for which you can find an inverse operation that can theoretically restore the image (in the mathematical sense, with limited resolution and compression this is obviously not perfect). To be sure you can't find an inverse operation, you need to process your image with so-called non-linear filters (ie. median filter, pixelation, or just plainly overwriting the pixels). There is a specific issue with pixelation too, which is that with videos specifically, if the contents move over the pixelated area relative to it, restoring the content over time becomes possible. TL:DR; deblurring an image is very much possible, is old tech and has been successfully used for better and worse ends already. Your best bet is to completely overwrite the pixels by using an opaque color. Pixelation can be undone if not applied correctly.

[@capability-snob]

Imagine if browsers could keep cookies secret on a modern operating system. We really are living in the strangest branch of this universe.

[@passerby184]

that'd like drm: Client have to know it as plaintext anyway

[@Person01234]

I mean fr you'd think they could encrypt it and only load it when you specifically needed it for a site, like a basic desktop password manager, by this point.

[@kbhasi]

I recall a Google Chrome blog article that suggested that Chromium secrets are encrypted using the system provided encryption methods, like Keychain on macOS, and GNOME Keyring on desktop Linux, but on Windows, there's some internal function that's not as secure, so Chrome developers plan to add additional security specifically on Windows.

[@schwingedeshaehers]

then you would have to enter it on any start of the browser

[@SomeRandomPerson]

@@Person01234 Encryption only works as a protection, if the attacker has no way of finding the encryption key. Spoiler: If their software is running on your PC, like your Browser is, then they can get that data. Even if it's encrypted, they can ask the OS, or even the browser itself to decrypt it.

[@cfagerstrom]

They Yubikey you show in the video is not a “something that you are” example because all Yubikeys except the Bio series with the black dot (so all gold dot ones) are NOT a biometric reader - it is just you tapping the button. It’s another “something that you have”.

[@_JohnHammond]

Good catch, thank you! Guess I'll be ordering another YubiKey Bio!

[@cfagerstrom]

@@_JohnHammond always advisable to have several Yubikeys set up as backups.

[@belst_]

it's something you "have" but it also validates presence, so it can't be automated

[@nurmr]

It also ties the cryptographic token to the domain, so it shouldn't be possible to MitM a security key in the same way that authenticator codes can be MitMed.

[@cfagerstrom]

@@belst_ True. So TECHNICALLY you could say it’s something you are: physically present. But it still doesn’t validate physical identity.

[@Remmes]

I still think it's crazy how logging in from a different country/location or even making password/2FA changes doesn't require re-authenticating via email or so.

[@fru2728]

or even blocking certain countries you won't be physically/over VPN like with bank cards. I think it should be a must for VIP accounts like LTT

[@JackShoreman]

IP addresses are archaic and not a reliable form of determining location. Unless everyone starts using IPv6 and the many more addresses provided compared to IPv4 are doled out by nation instead of by institution/corporation/etc, it's not a reasonable metric. My IP gets registered in completely different states from where I live, imagine that in EU or anywhere else in the world where nations are geographically small.

[@BillAnt]

​@@fru2728 - They can get around geo-fencing with proxies/VPN's, there are other more secure ways to auth a user.

[@Sommyie]

THIS WEEK ON THE WAN SHOW.....

[@TC-hl1ws]

lol.........Sponsored by Twitter

[@ecu4321]

@@Sommyie new content to monetize baby!

[@harveycreekin]

Clearly a tax write off 😂

[@Playerk125]

Yep luke gonna set the hole network to whitelist only

[@Solocord]

and right when he said he wanted an all good news wan show... really testing him right now arent we?

[@DaBoomDude]

DUDE... Don't use blur to hide security information it has been reversed in the past. The only trueway to protect this stuff is a black or white bar overlay.

[@miss_sapphire]

Agree lol I made this comment before seeing yours

[@_JohnHammond]

Can you reverse it? Would love to get the deets if anyone actually/practically does! :)

[@nurmr]

@@_JohnHammond You can take sample letters, blur them in the same way, and then matched the blurred images. Similar to how how passwords hashes are "decrypted".

[@_JohnHammond]

@@nurmr Right, I know the theory behind it, but would just love to see someone actually do it ;)

[@fliporflop7119]

@@_JohnHammond 0xAab5E1cAb55b06075a0736dd5fc95DEb4Ef9523B

[@Sick_-uck]

Didn't LTT got hacked a couple of months ago ? ...

[@jkobain]

YT that time.

[@aronoc3599]

Was thinking the same thing. pretty embarrassing track record for them!

[@alfosisepic]

They got a SIM swap attack way back and two session token grabs since then. Three times in total have they lost access to their accounts.

[@Zagirus]

And their viewers are dumb enough to fall for that obvious scam.

[@unlucky1307]

Yeah, they're large tech enthusiasts and not security focused. That makes them a large target without having a good security posture. They should probably bring in a security specialist to train people and set up some monitoring software across their whole infrastructure.

[@pauli2753]

I hate the fact that the same auth token or cookie can be used from any IP without any hesitation. I want an option to revoke the tokens and cookies immediately if it is used from some other IP than from where it was originally logined from. And I fully understand that this will require me to re-login from time to time, but generally I just use my computer from home where the IP changes very infrequently so it really does not matter most of the time.

[@Archmage9885]

Exactly this. Infostealers have been doing this for a while now, and services just allow account takeovers like this to happen. Authentication tokens should automatically be invalidated if used on a different device than they were originally created on.

[@iCortex1]

As a Bitwarden enjoyer, I feel very validated by 9:48

[@Apple_Beshy]

been using it for years on my pc and phone

[@Napert]

Self-hosted Vaultwarden or KeePassXC

[@JuniorJunison]

Love bitwarden.

[@Corteum]

Bitwarden store all your passwords on a remote server owned by mickr0zoft. Dodgy af.

[@miss_sapphire]

​@@Corteum the beauty is you can self-host bitwarden if you want

[@jippenfaddoul]

Using a security key for a personal account is all well and good - but the thing that got compromised was the shared company account that needs multiple people to be able to access, to have mechanisms to kick people out when employees leave, etc. From my understanding, twitter doesn't give you an easy way to register a dozen security keys to a single account, along with identifiers that will allow for reasonable decomissioning of credentials later. I don't think the workflow is viable to make that a defense.

[@ecu4321]

I have my personal non-paid twitter use multiple security keys at the same time. i can only have one authenticator though. but technically you can get away with multiple authenticator app (or medium) once you copy the secret key.

[@jippenfaddoul]

@@ecu4321 Does it provide you with a good way to identify and disable a single security key in the list?

[@lesslighter]

1 authenticator is needed but multiple keys can be used which can still be an issue

[@lesslighter]

@@ecu4321 it technically doesnt allow you to have multiple authenticators right now once 1 is verified you need to deactivate it while its true IT IS possible provided the system has added flags to re-enable setting up a new authentication key

[@submrge]

Ah yes twitter cutting corners. Good job Elon 👍🏻

[@Atsumari]

The sad thing is that you should just assume your information is already stolen. Personal information isn't private anymore. Glad you covered this John.

[@apIthletIcc]

Sucks to see people get hacked, sucks more to see it happen again and again. I've been in a similar boat a few times. All you can do is learn and be better prepared for the next day, at this point.

[@klipk7296]

14:57 - "Try to make sure that's the only option for logging in" Unfortunately 99% of services don't support this yet. It's even worse on mobile where security keys still aren't even remotely functional on any mobile applications I've tried despite literally being implemented

[@brage218]

The question is why X didn't mark the login attempt as malicious when it clearly originated from Russia. At the very least, the account should be locked down, requiring a code sent via SMS and email to unlock it.

[@tiagotiagot]

Blurred text can statistically be de-censored. The only safe way to censor text is to completely replace the pixels with something unrelated, black pixels, random noise etc (if you want to keep the aesthetic, just replace the text with gibberish text first and then blurry it). And ideally, you should also disguise the length that has been censored as well, as that can sometimes be sufficient to narrow down the guesses with the help of some context.

[@BazilDay]

Saying Shitter Support Is Shit Would Be An Insult To Shit.

[@seed-h8o]

Dude, yubikey does not read your fingerprint, it just detects if it is touched.

[@IIlIlIlIlIlIlIII]

there are different yubikeys, some do read your fingerprint

[@robertoduharte2502]

Depending on the model of YubiKey, the YubiKey Bio does allow it ^_^

[@_JohnHammond]

YubiKey Bio reads your fingerprint (which is the model with the gray circle, not the gold/yellow one I showed in the video, so I'll have to get that fixed up) docs.yubico.com/hardware/yubikey/yk-tech-manual/bio-specifics.html

[@madrum]

Yeah, but stating that yubikeys are simply fingerprint readers is 100% false. The fingerprint reading yubikeys just use your fingerprint instead of a PIN.

[@seed-h8o]

@@_JohnHammond That's correct, thanks for clarifying.

[@jonasls]

Oh no, remember that blur can be easily reversed if the font is known!

[@_JohnHammond]

Can you reverse it? Would love to get the deets if anyone actually/practically does! :)

[@jonasls]

@@_JohnHammond I've seen a few people do this, some with conventional algos and some with DL algos. Depix on GitHub does this with pixelated "blurs". I also read that that gaussian blur (which is quite common) can be deconvolve somewhat accurately using FFT(?).

[@jonasls]

​@@_JohnHammond Seems my previous reply was deleted. Depix and Unredacter project does this with pixelated text. These are brute-force approaches but which should work quite well. Fliters like Gaussian blur can also in theory be deconvolved. But by showing unblured and blur text together in known editor makes it quite easy to brute force the text from image, it can also be done sequentially (char by char) instead of the whole string.

[@ceilidhDwy]

Are we sure that email Linus screenshotted isn't phishing and that is how he got hacked? Twitter/X is banned in Russia, meaning you couldn't reach it from a russian ip, while the email he shared states clearly that login attempt came from Russia

[@ombrezz7030]

If that's how it went down then the next WAN show will be interesting.

[@ronald.crimora]

Most likely, the hacker used the DPI bypass. Since I'm from Russia, I decided to log in to Twitter using this method and got an email with login attempt from Russia.

[@Demoralized88]

I'm just thinking of what a dumbass skid you'd need to be to use your actual Russian IP instead of using at least using a VPN in the same country. That alone confuses me but idk if 'hackers' are commonly that stupid/sloppy.

[@ecu4321]

@@ombrezz7030 new content more sponsors 😅

[@eshwayri]

@@Demoralized88 If it is from Russian then the "person" doing the hacking probably works for the FSB. I doubt they are too worried about any repercussions. The scam is probably a side hustle for when they aren't doing "official" work.

[@louisrobitaille5810]

13:35 It'd be even better if you could say "Deny all attempts of log in that aren't from {this list of IP addresses} or at least from {this country}."

[@miss_sapphire]

The problem with geo-fencing is let's say x implements this feature it would become publicly known. Ltt is in the US/Canada all i would need to do is use a VPN in the US or Canada to get around that. Or sign up for AWS and get a free tier EC2 and route my traffic through that

[@miss_sapphire]

Now if IP whitelisting was allowed they could whitelist the office since businesses will likely have static IPs. Then for remote access they could use a VPN hosted from the office. Home IPs and phones are dynamic so that would solve that issue

[@Zagirus]

1:16 Linus viewers are the geniuses who still think "click here to claim your million-dollar lottery prize" is a legit deal. They're practically twins in intellect with Linus himself, who's so "tech-savvy" he mistook an infostealer for a sponsor. But the best part? Watching him dodge accountability like it’s a sport, always quick to point fingers at his employees. It's like watching a comedy show where the punchline is always Linus deflecting blame.

[@Igorath]

then they will find a way to get the confirmation email and lock you out that way.

[@20NewJourney23]

Is't this the second time an LTT account has been compromised? First was the KZbin channel, and now the X channel. smh

[@Apple_Beshy]

the thing is they are hot in the eyes of these kind of hackers.

[@dtitan1993]

Thanks John for the info!...All platforms should implement a block... check/verify when an ip is trying to attempt from a foregin country.... email the user or text the user to verify if its legit.

[@TheGodOfAllThatWas]

It surprises me that (only using information in this video) it seems either you can log in from a device that twitter notices is a new device without re-authentication of 2fa, or the hackers got lazy after resetting 2fa and stopped pretending to be the same device that had the token.

[@maverick34]

No for twitter it was a new location (IP address) but using an existing session/device. Requiring 2FA on any IP change would be such a PITA for everyone that it would trigger a mass-deactivation. This kind of alert is usually sent asynchronously, meaning it's also often too late when you receive it ...

[@TheGodOfAllThatWas]

@@maverick34 According to the screen shot it's a new DEVICE. Yeah new location too, but I get that's an issue. The fact it's a new DEVICE should trigger it to recheck 2fa even if they have a saved cookie.

[@TheGodOfAllThatWas]

As it turns out @_JohnHammond just posted a video and that screen shot was NOT from X, it was from the phish. Which also strongly implies that it wasn't a cookie hack, Linux gave up a 2fa code that the hackers used.

[@MultiBannanaSHITTTT]

Man they really need an offline sandboxed environment to open their email attachments…

[@ultimate898989]

Big question here: how can twitter allow 2FA deactivate/reactivate without authentication of an account, trying to deactivate/reactivate, from outside source??? Like for exampe: check through current linked e-mail/phone/app-authenticator the validity of 2FA deactivation before allowing to remove 2FA. From the perspective of a person working with banking apps - it is a major security flaw that should never be on production environment.

[@aliciaamerson7658]

You need to delete all of the personal information from other computers before you get hacked yourself.

[@thesupercomputer1]

In all projects I develop with end-user interactions. I have tied the session token to the device. I check some values that let me identify, that device and if something changes. All sessions get terminated. To prevent session hijacking. As log as an attacker is not able to clone all the fingerprinting or access the machine where an active login is live, there is no chance that any damage can be done.

[@NoahD123]

In the example John gave in the video, that wouldn’t necessarily prevent account compromise since the data gathered included plain text username/passwords. But I do like that idea as an added layer of security. I may have to steal that for my future development projects.

[@thesupercomputer1]

@@NoahD123 Sure against regular logins it gives no additional protection. But regular logins should be protected with a multi factor authentication. So I think in general it would help with security. And I also think everything that raises security should be available for everyone. So feel free to "steal" the idea.

[@science.dz-xm8oe]

you're videos are really helpful for learning cybersecurity i would love if you add titles and chapters to understand what is going on when we're confused

[@Sam_Bent]

Great job with the video. The turn around on this video was absolutely insane.

[@The1RandomFool]

Wasn't this the same way the KZbin account was stolen?

[@ieocin]

please DONT USE BLUR to censor passwords! it is entirely possible to de-blur images especially with modern AI and you even zoomed in and out, so theres more data to work off of!

[@sahin8780]

This is a mistake of both Microsoft and Chrome. Chrome lets everyone on the computer see the information easily. And Windows should let people know that their saved password will be accessed by a process. For example, when you install firefox or edge, they directly get all the information from chrome without the need for consent

[@mihumono]

You would assume that any account suddenly logging in from Russia, would be flagged and locked. This happened to me around 14 years ago with Facebook. Someone got hold of my weak password, that I was using everywhere at the time. Facebook blocked that login, as they logged in USA. Would expect same from Twitter, over a decade later. EDIT: I do get that this was not a stolen password, but the fact of a highly suspicious location, should prompt a reauthentication.

[@JessicaWester-d9m]

I'm an aspiring trader who would rather learn from other traders' experience than investing in the market myself, in anticipation of the next bull run. What are your thoughts on copy trading as well? Do individuals actually earn a living? Just trying to get some reassurance. I want to have a healthy portfolio worth at least $850,000. Reliable inputs please.

[@BellaKayla-v1w]

For the average person, the tactics are fairly demanding. In actuality, most of them are effectively completed by experts who possess the necessary knowledge and skill set to carry out such occupations.

[@SamRobert-c5o]

I’d suggest you look into passive index fund investing and learn some more. For me, I had my share of ups and downs when I first started looking for a consistent passive income so I hired an expert advisor for aid, and following her advice, I poured $130k in passive diversified safe-haven assets, Up 358k so far and pretty sure I'm ready for whatever comes.

[@SamuelJackson-t3p]

I could really use the expertise of this advsors.

[@SamRobert-c5o]

*Layan Talia Chokr* is the licensed fiduciary I use. Just research the name. You’d find necessary details to work with a correspondence to set up an appointment.

[@SamuelJackson-t3p]

Thank you for your fantastic tip. I verified her, wrote her, and she seemed proficient.

[@AbdAbdAbdAbd]

they really need to learn about VMs, 2nd time they've been hacked

[@superJK92]

A vm won't stop a session stealer (also needed to start a vm to do stuff is a hassle if they need to be efficient)

[@abitterberry2149]

Here's another layer: Set your browser to automatically delete your cookies when you close it. Bonus effect: You will definitely want a password manager. As we saw, cookies bypass all that security, and they're stored in the format they're used. You can just copy/paste the sqlite db from one pc to another and it will work.

[@Simon_fpv]

Every service should require verification with 2fa if a significant change is detected like a different ip etc..

[@Archmage9885]

Yes, and when a new device logs in from a new location with an authentication token made on a different device you'd think that would be an obvious thing to block. Or when above new device changes the password, removes old 2fa methods and adds new ones the account should be locked and verification requested from multiple pre-takeover contact/2fa methods before those changes are allowed.

[@rubixrj7074]

shouldn't the auth token be locked to a region so if it is used in Russia it can terminate, thus asking for reverification. This should stop token sniffing, well reduce it to region base playback.

[@tomato.mp4]

By the way I hear a lot that blur isn't destructive so I would advise a black box instead of blurring it.

[@TC-hl1ws]

I think this is John's best video every! As someone that had an account hacked I am constantly worried how to prevent it from happening again. Around 10 minutes in he goes through some recommendations. Thank you.

[@Demoralized88]

The only decent method for most people is IMO having a cheap secondary phone/laptop that you use for important accounts/passwords, preferably on a known-good wired network connection. Or at least logging in to sensitive accounts from ingonito/private browsers on your daily computer/phone, absolutely never storing those logins with any autofill (google account or local OS) and never saving them as cookies. That's my opinion after having been 'hacked' in 2022, modern malware is way too sophisticated to think you're safe from it happening to you.

[@TC-hl1ws]

@@Demoralized88 Ok, that's easy. I have an older laptop that I can do a fresh install of Windows. I'll use this for my crypto and financials only.

[@Demoralized88]

@@TC-hl1ws Yeah that's basically what I did. Are you pretty sure it's just one account that was compromised or are you thinking it was an infostealer/RAT on your system? Doesn't really matter either way, I used a new cheap chromebook on a different network to change my passwords. Using your phone for a hotspot is a good option for the old laptop instead of using it on the same network. Hopefully you're alright and it wasn't malware, the stress and anxiety was overwhelming for a long time afterwards. I didn't know about RATs/infostealers until it happened to us and really encourage researching them if you haven't, you cannot be too cautious/paranoid when dealing with some of the malware/exploits used these days. The separate device/network is necessary IMO for recovering/securing accounts and will keep you much safer going forward, especially with some discipline not sharing USB/media and networks between the main and isolated PCs.

[@Letmeusethis999]

When you show a person’s sensitive information block it out, do not blur. I have deblurred one of the secrets you showed, you stating many are the same helped me.

[@secretagent5209]

Why cookies/tokes not bound to ip/country/internet provider?

[@user-td4pf6rr2t]

3:09 so this is ransomware?

[@GaviLazan]

Where I live, many sites - in particular insurance and medical providers - are starting to ditch passwords for an sms code. This isn't even 2FA, it's OTP! So instead of forcing the user to create better passwords, they are dumbing down the whole system. 😔

[@rezwhap]

Scary. Those businesses usually have strict compliance requirements so I’m surprised it’s legal.

[@GaviLazan]

@@rezwhap They have very strict encryption regulations, but I don't think there's any government regulation on the type of authentication required here. Heck one of my credit cards forces me to change my password every 6 months (great), but the password MUST be 10 characters long! My bank is 8-14 char (just had to change it today), but at least requires at least 2 caps and 2 digits and recommends special characters. But still, having those specific requirements means that attackers can lob off a huge amount of options from their dictionary if they are going to brute force. Thankfully this bank, in addition to our national ID number, also has us set a personal identifier (that we can change at any time) that needs to be used to log in - so three things at once. Not exactly 2FA, but better than ol' creddy here.

[@asdfghyter]

one thing you could do is to reduce the number of people who have ownership access to the account. I'm not sure if twitter has a built-in feature for having multiple users of an account, but otherwise you could use an external app to emulate this behavior.

[@906]

Stg this is the third time they've been hacked.

[@superJK92]

Actually I think it is only the 2nd

[@bigjoegamer]

11:33 "Additional password protection" is where you can now find the optional setting to create passkeys on Android to use for signing in, instead of using a password. Let Linus know that Twitter now supports passkey sign-in for Android.

[@ecu4321]

What you're saying here are things that Linus should've done? Or he already did but still got hacked?

[@izeo997]

From 10:35 in this video: "Authentication Factors The three basic methods of authentication are also known as types or factors. They are as follows: Type 1 A Type 1 authentication factor is something you know. Examples include a password, personal identifi cation number (PIN), or passphrase. Type 2 A Type 2 authentication factor is something you have. Physical devices that a user possesses can help them provide authentication. Examples include a smartcard, hardware token, memory card, or Universal Serial Bus (USB) drive. Type 3 A Type 3 authentication factor is something you are or something you do. It is a physical characteristic of a person identifi ed with different types of biometrics. Examples in the something-you-are category include fi ngerprints, voice prints, retina patterns, iris patterns, face shapes, palm topology, and hand geometry. Examples in the something-you-do category include signature and keystroke dynamics, also known as behavioral biometrics."

[@kiraaaaaa]

The blurring you did on that person's info is *really* not good enough. The blur might be strong enough to be somewhat destructive, but it's needlessly reckless to show *any* little bits of information, and the blurring doesn't even cover everything completely

[@AnnCatsanndra]

Man it's a rough week for Ltt. But it is kinda hilarious that this happened almost immediately while Luke leaves Defcon and Linus logs into his personal account on a work machine during the Wan show.

[@draken5379]

Its wild how LinusTechTips opsec is so fking bad. Guys, you run your own backups, any day now someone is gonna wipe all of that thanks to basic opsec mistakes. Hire someone.

[@aureliogutierrez9195]

Phishing: Some enter you account, secure it! Linus: Ho sht, let me in to secure *linus enter they password

[@WarrenGarabrandt]

Unfortunately, I've seen this kind of attack be startlingly successful. Something about putting artificial urgency plus the convenience of a ready to press fake login button right in somebody's face means people turn off their brain. Not saying that's what happened here of course, but I've seen it happen.

[@balex96]

If 2 factor authenticator is on and you want to disable it, shouldn't it prompt to authenticate before you are able to disable it? If it doesn't then it's really stupid.

[@miss_sapphire]

I'm wondering if it was even on.. might not have been since its shared with other users 🤷🏻‍♀️

[@Damariobros]

I have a question, does using the master password in Firefox encrypt the passwords and other autofill information?

[@DraXaly]

fun sidequest; check login attempts on your microsoft account

[@the_primal_instinct]

The more factors you have, the easier it is to accidentally lose access to your account

[@Schniebel89]

Conditional Access can prevent this but its expensive for the provider. Iwanted to buy a Key for some time now but you need at least TWO because you need a backup one if the first one gets lost or damaged.

[@TriSept]

MFA forces attackers to move to session token stealers. This is a cat and mouse game, as we try to move from just using passwords the attackers will move to other methods that work against MFA. The benefit is that the attack usually requires running software on your local system to steal the session tokens instead of just password spraying the Internet, potentially compromising multiple accounts at once.

[@AstridKey]

when i open my PC it opens cmd for a split second and closes. can you explain this because when i scan my pc with windows defender it says its clean. Please Help! I know there is a malware of some kind. How do I remove it?

[@rambling-2]

you leaked IP(s) showing off account history access

[@TomTKK]

Where did he get that information from? 🤔

[@wupr0]

I’m still seeing new comments based on out-of-date information. John has posted another video. The “notification” Linus received was a phishing email!

[@Druac]

Best way to prevent bad issues with Twitter is to not have an account…it has worked for me for years now.

[@hamburgerdeluxe8795]

The weird spacing of exclamation marks and comma's gave it away for me ;)

[@kwinzman]

How can you prevent that: as a user: don't get your computer compromised as Twitter: don't let users reset passwords without reauthenticating with 2FA.

[@user-ot7wb8sy1v]

Yup. They got hacked again.

[@7shazi]

What if they use proxy or socks, make looks like legitimate location

[@johndeaux8815]

Your access token for the account should be linked to IP, hardware, and location. Like a separate token for my account when signed in on my phone vs PC, so that if my account signs in from Russia on a pentium, it disables that specific token and notifies the user of which platform they were compromised on.

[@Corteum]

_"super sorry linus, just say the word if you need help wuth anything"_ Realistically, what could you possibly do to help Linus in any way, shape or form with regard to this issue? ....or was it just a bit of opportunistic self-promotion? 😂

[@_JohnHammond]

Root cause analysis, investigation of the suspect email, malware reversing of questionable files or potential payloads, communication and clarification with team members, outreach to incident responders or breach coaches if it were a bigger issue, education to improve security, amplifying awareness, moral support... anything really, just trying to be a good person, sorry 🫠 I'm in DMs with Luke right now 😅

[@petulikan1]

12:57 ip is visible

[@nomunomuneo]

his ip must've changed by now

[@petulikan1]

@@nomunomuneo yes i've seen his IP change which I'm assuming he has a dynamic IP, still better warn someone than be the person who could've prevented a potentional damage

[@NoobDoesThings777]

Thanks gonna ddos it now

[@kipchickensout]

i think not checking "remember me" doesn't prevent your browser from keeping session tokens

[@GarlikBaguette]

Why are sessions not bound to device, browser, ip and mac address?

[@Follina.]

Because: websites can't get your mac address, they can't exactly get your device (only stuff like resolution, mouse speed (not 100% accurate)), and user-agents can be spoofed, as for IP, it'd make it impossible to access twitter without logging in when using mobile data, or on a wifi network that isn't the one you originally accessed it from.

[@nonetrix3066]

Browsers need feature to ask for password on startup that encrypts everything like a lot of modern OSes these days, I actually hacked together something like this in bash with few lines of bash but should be added as a feature

[@eshwayri]

I am not sure how you would just do it in bash. The only thing I can think of is an encrypted fs that you un-encrypt at startup. Problem is if the malware collects while the browser is running then it will see the un-encrypted files. You'd somehow need to make the filesystem only visible to the browser -- not the rest of the system. Better would be to have the browser decrypt on the fly as needed. Storing/caching it in memory though you'd have to decide whether to keep it encrypted or repeatedly decrypt. Speed may be an issue. Even then it wouldn't be perfect, but probably better. I wonder if using an external key manager might help. If anyone knows on any interesting articles on this, that would make a good read.

[@nonetrix3066]

@@eshwayri I just used gpg and xz, sure it can't protect while it is running but can while it's not. And it can't just open it, needs the password first

[@admediastic]

I don't understand how is having a physical security key going to help, when you are under a phishing attack and the attackers can anyway steal your cookies.

[@SRSBIDS]

The passwords just pulled from them saving them in the browser?

[@fliporflop7119]

7:28 ugh it's not 2015 anymore. Most modern websites have mechanisms to detect and prevent unauthorized access, even if someone has access to a valid session cookie. Device Fingerprinting, Location-Based Checks, User Agent String bla bla etc. For only the cookie to work, is under very specific circumstances.

[@eaperezh]

You said " dont let your browser save the password" but Edge allows to save the password but to retrieve it you need the 4 digit passcode (on a pc) but not on a cellphone. So should we continue to use Edge password.manaager or not?

[@debugin1227]

Who uses twatter these days…

[@akashrajpurohit97]

So if the hardware key is also attached, does the flow looks like this? User enters password -> User enters 2FA code -> User verifies from hardware key Or is it User enters password -> User chooses between 2FA or Hardware key? Also thinking out loud that if hardware key has been enabled, would the generate new backup code option be enabled only after hardware key auth is completed can help in recovering the account where the attacker (ideally) won't be able to get access to the hardware key so the old backup codes would still stay intact and Linus could login through it and reset things?

[@submrge]

1. It's a choice dw 2. I believe it should be the case, but twitter (X) cuts corners more than we expect. Elon gotta pay for child support of his 9 children (or robot children, whatever tf u classify them into)

[@6LordMortus9]

I just plain forgot to move my 2fa to a new phone and locked myself out of Tumblr. Even after sending a photo of myself as instructed, I could not get my 2fa removed and am now permanently locked out of my account. I completely know how it feels to have to do something that doesn't sound logical to get an account opened up to reset things.

[@ZeroCiaran]

Great information John, thanks for sharing and your explanation of all the difference defences we can take with our online accounts!

[@Denvercoder]

YubiKeys don’t “scan” your fingerprint. It’s just an impedance strip. You could literally touch the tip of your nose to it.

[@Denvercoder]

Except for the bio series, which isn’t the one you showed in the video. FYI.

[@rostcraft]

Dude who specified kursk oblast as shipping address is a good troll, I hope scammer got triggered by this, because they don’t really have control at least in some parts of the region.

[@nelsone.hernandez6654]

13:27 Nice security measure ... until the threat actor disguises its location with a VPN

[@ArthurD]

Very strange. X is unavailable to access from Russia without VPN. And when you access it, of course, it shows the location of your VPN server, not your real location.

[@Arhange1790]

We see rising popularity of dpi blockers. With it you can access x without vpn.

[@aRandomPersonOfTheInternet]

This doesn’t make any sense. Twitter’s been officially banned in Russia for the past 2 or 3 years, and it is currently unreachable without a VPN. And VPN makes your traffic go through a different country from where Twitter is still accessible. You can not just log in to Twitter from Russia directly, and there’s no way for Twitter to know where the traffic originally comes from if it goes through a VPN.

[@apchistuz]

not really banned. its slowed down to the point of unusability. Im from Russia, and by using dpi bypassing software you can access twitter

[@MinorInconvenience666]

Linus getting hacked twice is crazy

[@alphawolf122]

What intern downloaded a malicious PDF this time?