We Got Hacked AGAIN

[@stillmoms]

The “they caught me at exactly the wrong moment” part is crucial. No one is “too smart” to not fall for something like this if they’re caught in just the wrong moment-usually when they’re under some sort of other time pressure and stress and therefore aren’t thinking clearly. It happened to me with my Apple account on one particularly hectic morning when I was late for work, and I’m a 30 year veteran of “using computers on the Internet”. It only takes one perfect situation to catch you off your game to leave you with a mess to clean up. The good news is if you’re using a password manager and unique passwords for every service (including your password manager), it’s less likely something like this will totally ruin you.

[@jonlewis5061]

From the scammer’s perspective they got him at the right time! 😂

[@Nalianna]

If they send 10,000 emails, they're certain to catch someone on a wrong moment, and that's their strategy.

[@VerdantBBX]

this is such an important thing to remember. Scammers are usually good at what they do and If they catch you at a time in which you're stressed, distracted or a multitude of other factors, thats all it takes for anybody to fall for a scam. I was subject to a scam in my last workplace an still to this day have trouble actually discussing the details of it because of the odd sense of shame i feel for allowing myself to fall for it. It's hard to get past those feelings but its important to remember that its not a fault of you and your abilities/intelligence, Its the fault of the scammer doing terrible things and exploiting people when they feel vulnerable.

[@nextbizzy]

I am "too smart" not to click on scam links in my email.

[@crimson3859]

I'm a big advocate for using physical security keys on anything important, especially if the service could be used to gain further access to other things.

[@Dirtyz1234]

If it makes anyone else feel better, my wife is now (today) the type of person to click on a text message link because "USPS" was unable to deliver a package and then proceed to enter our credit card information 😤 She told me to check the mail for a package that she was having an issue with and I asked her if she clicked on any links... Our cards are now cancelled 😂

[@trinitygames5537]

God bless you 😅 i wish you the best

[@SuperSmashDolls]

I can't believe Twitter's out here cancelling CARDS now, smh my head

[@ClutterLustRott]

Damn, everyone got that text today.

[@fakjbf3129]

@@Dirtyz1234 I’ve been getting that text every coupled of months for the past year, I guess some people have to fall for it every once in a while to be worth it.

[@Plznojudge]

Nice catch

[@AlansWay3DPrinting]

There was a CEO of a cybersecurity company who got caught by their own internal Phishing testing and had to go for internal company phishing training. It can happen to anyone when their alertness drops. We have to be vigillent everytime, the hackers only have to be successful once.

[@DaemosDaen]

I'd be impressed if it were someone who actually does the work. like a Sysadmin or Secadmin. CEOs, generally make decisions, sometimes not very well informed ones, and has someone else implement them.

[@amb1u5]

​@DaemosDaen if it's a cyber security company there's a good chance the ceo has hands on experience.

[@XIIchiron78]

...Crowdstrike? Ah but wait that would require actually having internal testing and training (btw CEOs are usually MBAs who have no knowledge or expertise over the things they manage in the first place)

[@uncrunch398]

Everyone will fail when social manipulators are constantly working on them. Everyone who doesn't believe everything put out by those desperately trying to keep their media mainstream is constantly watched, often worked on by a social hacker more directly. Think of how China works. Only a fool thinks that isn't global, just more subtle most other places.

[@Swizzle5795]

I used to work in audit. It’s shocking how often the c-suite members, the ones most entrusted to act in the best interest of a company, fail the phishing simulations.

[@dany_fg]

one of my family members was part of a cyber test at their workplace and they clicked the phishing mail link. somehow the site didn't load and later the cyber security team congratulated them on not falling for the phishing attempt.

[@Entropy67]

Maybe the site was blocked internally, which is still a success but due to your IT team

[@robertt9342]

Task failed successfully!

[@Lantrex]

I kept forwarding them to my manager and asking him to print them (they used pdf files) because "our printer was down".

[@apIthletIcc]

Lol bro had ipv6 disabled 😂

[@battlekingad8291]

Thats exactly like that 'The office' meme with Michael Scott.

[@tiagotiagot]

You guys should start a tradition of yearly pentesting, hire a company that does all the stuff, lockpicking, phishing, hacking, social engineering etc, and let them pick a time and date without telling anyone they don't need to, and have a separate crew to follow them (or have them carry bodycams or whatever and be interviewed later or whatever format works), to get an infosec documentary video as a bonus :)

[@TomTKK]

That's not really going to assist with this type of attack. They all need phishing awareness training.

[@ProfSplendorFaction]

@@TomTKK They include cyber security in pentesting its not just physical.

[@bigmew]

security is optional

[@TomTKK]

@@ProfSplendorFaction But a pentest is not going to train the end users, its aim is to compromise the organisation and generate a report, that's not training. Phishing awareness training would be a recommendation on that report.

[@boiwithadoge]

@@TomTKK yes the goal is to use pentesting results to see what needs better training and security

[@ICEconchy]

Phishing can happen to anyone, its just human error. Glad to see its back!

[@loopernagic4658]

This. It is not about how smart you are. Our mind has time to rest and anyone has their time when their defense is down. Your awareness is not active all the time.

[@canadianwithabeard]

It "could" happen to anyone but that doesn't mean it can happen to anyone. I've not once been phished because I am very stringent on my information and emails that came through. Some of us pay attention a lot more than others when crap like this happens because if we aren't diligent then that is when something will happen.

[@HorsesArePeople2]

@@canadianwithabeard I agree. I haven't been phished/hacked/had any viruses since like 2008 and I always disable my firewall and windows defender.

[@shellderp]

not me lol ez

[@Mythicalgoon]

​@@canadianwithabeardthe irony of this guy not realizing he's the exact person op is talking about lmfao. "Everyone has a moment when their guard is down" even you bud.

[@Andrei-ng2yz]

For the first time in history, the grill has become an element of a hacker attack ))))

[@the3nder1]

Not true at all. The person behind the KZbin hack still works for them.

[@DuneRunnerEnterprises]

"Swordfish"???

[@giusdb]

The grill is connected to super fast wifi, so they found the right time.

[@bigmew]

lmao right

[@ku8721]

See that's the problem with charcoal, with propane you can just turn the grill on and off. I tell ya what. Taste the meat... not defeat!

[@Decodeish1]

NOTE: Password resets should NEVER ask for old password.

[@kek22219]

A very good point. Something not alot of people notice given we are so conditioned in certain ways.

[@Dung30n]

sadly, this is often not the case in the enterprise segment. heck, even windows asks for current password when you go change it.

[@AmeshaSpentaArmaiti]

new yorks unemployment benefits website does, iirc.

[@KingFinnch]

@@Dung30nwindows doesn't really matter because there's a hundred other ways to get admin rights without a password if someone has access to your computer, just consider the whole thing and every file compromised

[@Wavepush]

Windows AD domain accounts do

[@chad_levy]

This is among the reasons you use a password manager. Even if you know your password, your password manager will validate the URL.

[@p0358]

Twitter changed their URL and suddenly that doesn’t work. They did a lot of wonky unprofessional crap and conditioned their users to except amateur-esque stuff at every point

[@realcartoongirl]

now they just have to hack your password manager 😂

[@spicybaguette7706]

​@@realcartoongirlwhich is a lot harder than phishing someone

[@imtherealvict1m]

also why you should use the right password manager because if someone gets access to your password manager and it’s not good they have access to all ur passwords

[@imgladnotu9527]

​​@@p0358unless you use a password manager that doesnt allow you to define a URL manually, this should be a non-issue. some password managers even allow you to manually fill a field with a set credential and save the site for that credential.

[@TheCloudCreation]

It's important to mention that even if you try to navigate to the website manually, to never click on the "sponsored" result for whatever website you are searching for. I cant remember which company it was, I think it was MSI, but a phishing site was getting the top search result whenever people looked up a gaming peripheral company to download their application to control their peripherals and the site had almost exactly the same url and copy and pasted the real MSI api download site so it was virtually indistinguishable.

[@lunaticwastaken]

I once searched the website "lieferando" (german food delivery), and when googling for it, on the top there was an ad that looked 100% like the actual website. Even tho the ad showed the correct url, when i clicked on it, it suddenly asked me to provide credit card information, and when i looked at the url it was suddenly `liefernado`. Thank you google, for absolutely nothing.

[@skyrimax]

Something similar happened with OBS and a bunch of streamers got their stream keys stolen by a malicious version of the software the sponsored site distributed

[@Vysair]

adblock, dns blocking, scripts, etc

[@TheoHiggins]

My mum ALWAYS clicks the sponsored link, I tried to explain why it's a bad idea but she doesn't seem to have taken it onboard

[@skyrimax]

@@TheoHiggins if you can, install an adblocker on her browser

[@BrandonIngli]

15:00 Also be careful that you're looking at the actual site for whatever business you're interacting with and *not* an ad placed by a bad actor nor an AI generated summary containing bad data.

[@twixieshores]

To add to this, if you use a particular site regularly, bookmarks are your friends.

[@luketurner314]

@@twixieshores And if you use multiple/several sites regularly, bookmark folders

[@lussor1]

Imagine not using ad block

[@screes620]

I work in IT, some people are completely clueless. Once had a lady call me, not because she thinks she got a phishing email, but because the link in the phishing email wasn't working and she wanted me to make it work. /faceslap What makes it even more egregious, our internal email server automatically places a tag of [EXTERNAL] to the front of all email topics from email addresses that are from an external to the network address, and everyone is taught to never click links in external email addresses unless you know 100% it is legit, because you just requested that person to email it to you.

[@realcartoongirl]

good for you to block websites, these people can really be kind of 🤪

[@RageofaNation]

Don't even google the number to your bank. Check the back of your bank card.

[@BlokedAgain]

I legit have never noticed that. Good advice!

[@QWERTIOX]

For your knowledge, some cards don't have numbers other than in case of lost, also not everybody has physical cards

[@lussor1]

brave or duck the number

[@bigmew]

wait its on there wth

[@robotman5105]

Well just don’t click the sponsored number one top result on a Google search for sensitive services like your bank.

[@afd33]

I've been getting realistic paypal emails lately. They skip my junk mail folder and everything. Pretty much do what they say. I log in to paypal not using the link in the email, see there's nothing there, and forget about it. I could definitely see how someone could fall for it though.

[@MagoLP]

I've been getting legitimate PayPal emails that look like phishing mails. They tell you to log in using the link to get some free stuff. How are you supposed to tell them apart from actual phishing mails?

[@butwhytharum]

The best is receiving emails about money being withdrawn from a bank I don't use... I call all in a panic and ask what to do when I don't use that bank.

[@realcartoongirl]

i know its fake because i deleted paypal long ago 😂

[@zwenkwiel816]

only paypal emails I even glance at are the ones they send me when I need something. like if I didn't initiate the email exchange I'm not even going to look at it.

[@bigmew]

its scary right.

[@deasterbrooks]

Moral of the story is anyone can get caught if they catch you at the right time (wrong time). I almost got nabbed by one when I was at a party...it is so easy to have it happen if your distracted by something going on around you.

[@bloepje]

No... Anyone with a bad mail user interface that doesn't show the e-mail address.

[@deasterbrooks]

@@bloepjethe reason Linus fell for it, was more about circumstances than anything else. Could that have helped, maybe but realistically it was about the party and the previous hack. Even the most ardent person given the right set of circumstances can be hacked. Even Jim Browning got phished and he hacks the scammers…it can happen to anyone.

[@iZian]

Some people say I’m silly for storing 2FA in a manager which can autofill it. But… it won’t offer to fill my 2FA automatically on a spoof site… Source: accidentally been there done that, wondered why the 2FA wasn’t offering to fill, realised the site was subtly not the right site.

[@bigmew]

autofill? naaaaawwwwwww

[@uncrunch398]

Some security researchers suggest 2FA is inherently insecure. But, maybe an exception is if your second factor is something like an encrypted hardware key that you only plug in as needed.

[@Thetasigmaalpha]

Got a text message 2 years ago from the NHS saying I’d come into contact with someone with COVID and I’d need to test myself, I could have the test for free but would have to pay postage and packing . I got to the point of entering my card details when I suddenly fell. why would the NHS Charge shipping on a public heath issue. They still got my address and phone number and I’ve been getting scam calls ever since.

[@gryyphyn8639]

It's rough getting tagged with a phish. Thankfully, I've never taken the bait in the real. Internally, within our enterprise partner phish testing, I have absolutely clicked on two of our internal tests. It's super hard with the newer AI generated phishing tools. They're so GD official looking. Even hover checking links or exposing the full address is incredibly difficult unless you know absolutely every domain your company owns and which ones it doesn't.

[@danieljensen2626]

I've learned to be more careful but I probably clicked on the first 5 test phishing emails my company sent out when I first got hired. Now I'll tend to err on the side of ignoring real work emails if I think they're suspicious at all.

[@zwenkwiel816]

what are these internal phising emails like though? cuz if they come from your actual employer it's kind of cheating. I mean they literally have all the insider information they could ever want and a social/cultural experience that matches yours (cuz they work for the same company) like some scammer from India or something doesn't have any of that....

[@John.S92]

Another thing is to ask the caller about the information they have on you, don't trust what they *are* who they say they are, but as you start looking for correct numbers to the bank or similar such, you might as well see what else they have on you, asking them to verify your social security number and name is correct, your bank number and whatever else you could think of that the caller might be able to supply, if nothing else, you'd learn what info they gathered/have about you.

[@robinbegley1077]

Its hard when most scam email detection tricks dont work on a touchscreen when your on your phone. You dont always see where the email came from, if you could recognize the fake look alike address. its incredibly hard, if you can at all, see where a link goes before clicking it. On iphone you get a page preview if you click and hold but I don't recall ever seeing the address. And when was the last time you interacted with the footer buttons on a web page? You would have to scroll to even see them on your phone. And with the state of twiterX, wouldn't you believe part of the site is broken?

[@apIthletIcc]

Long press on anything you think looks like a link in an email, being careful not to lift too soon causing a click to be registered, and you can see more of the link or copy it and paste into virus total! I sent in about 200 links last year and can confirm helped crack just a few botnets and a few phishing domain infrastructures. You can do it too

[@brooksfriess3139]

Really great that you guys were so open about this. Anytime this happens and people hide it we lose valuable information. I have not been fished yet but I know that's mostly because of training and hearing about stories like this.

[@Tall_Order]

>Linus: I was rushin... (russia pun) Me: If you're not rushin, you're goin' too slow. So quit stallin. lol

[@jonasnielsen1799]

But he needed to put in the password

[@sdzkhelya]

good one

[@diegonei]

Nice

[@AmeshaSpentaArmaiti]

I'm not Lenin you get away with this one, I'm Putin you on trial.

[@bigmew]

rushin...

[@Louis_Varga]

You should take a burner phone to Defcon.

[@Nik-rx9rj]

In case anyone doesn’t know or doesn’t see these types of attacks much: these happen all of the time and are the biggest security risk in any organization. Poor memory management in code and phishing emails are the two most common attack vectors for attackers. Linus shouldn’t feel bad about this. It happens to everyone.

[@ajealicethefemme]

Luke teaches internet security for 25:44 haha. This is really nice to hear from the channel, as this is advice that we need to give to so many people who aren't as tech literate or knowledgeable as we are. Having a video to say that even the greats fall short sometimes, and then teach ways that many people can protect themselves would be brilliant!!

[@modellking]

Got fished once, actually checked the DNS record of the site I was at, which seemed somewhat plausible.What got we was a perfect recreation of a Steamlogin in a emulated windows/chrome browser window.... Turns out that was not enough to do any serious damage so they tried to contact me to get more access, so I reset my password while stalling them sucessfully...

[@DoatesndMore]

The amount of bots in the comments wtf...

[@JM-wd3dk]

IIts crazy KZbin hasnt done anything about this issue. Almost every channel is being bombarded by bots.

[@Carrion0409]

​​​​@JM-wd3dk youtube doesn't care. These bots make them money by engaging. Since Susan left, the platform has taken a massive dip. It wouldn't shock me if youtube themselves were making bots

[@DoatesndMore]

@@Carrion0409 Yea but eventually advertisers will stop paying as they will realise whats happening

[@Carrion0409]

​@@DoatesndMore hopefully that'll happen sooner rather than later

[@ProfSplendorFaction]

@@Carrion0409 Yea, im going to assume that because they arent going to do anything about these bots that advocate for Cheese Pizza that the people working at KZbin also enjoy a Cheese Pizza

[@fakjbf3129]

“a whale is not a fish” unless you classify all vertebrates as fish, a there’s a very good argument for doing so.

[@Kleyguerth]

Fish is ill-defined, there's no way to biologically define "fish" in a way that *doesn't* bundle all vertebrates with it

[@channelofsindre]

Mammals usually are not classified as fish. But fish is not a well defined term

[@mzuogha]

8:30 lmao "fool me twice, shame on you" pie

[@LoganChristianson]

The phrase is "Fool me once, shame on you. Fool me twice, shame on me."

[@c1nqbl7]

Fool me twice, I'll put the blame on you​@@LoganChristianson

[@cretinousmartyr3522]

Theory: Linus subconsciously fell for the phishing attack because his drive to create content and teach people runs that deep, as well as knowing it was an account that was sacrificable, especially for the sake of the videos.

[@Sandeee]

Never Google a customer service number. Somehow Google also can give out fake numbers. Always use the official website for customer service contact.

[@gblargg]

24:01 Brings back memories of all those popular KZbin people back then, that we never see anymore. It was so different back then.

[@3ftninja132]

Hats off to Linus for falling on his sword, admitting that he done F-ed up and turning it into a learning experience for not him but his audience too.

[@gblargg]

Password reset emails seem to be training people to click email links. Usually that's the only way to reset as they send you the email when you request a reset. You're expecting a reset email during a narrow window of time so it's unlikely that a phishing one will fool you, but generally you are being trained to trust links in email. So when you get an email to reset your password outside this context, you'll be primed to not think twice.

[@giusdb]

It's different, here it was said that there was suspicious activity and to reset the password. The reaction should have been to go to x, use its reset password function, and click the link in the next email. And often password reset emails say not to do anything unless you requested the reset.

[@Zanthum]

16:04 "don't trust that the caller ID is valid" I have gotten caller ID as my own number. I was in class and couldn't answer, called it back later and got my voicemail inbox. I was very confused for a minute

[@xandermc21]

could’ve been a cell site simulator. A lot of police depts have them

[@twirre]

Use password managers, people. On phishing websites, password managers won't autofill because the domains don't match. If it doesn’t autofill when you expect it to, that's a huge red flag.

[@xionico09]

Phishing scams are obvious on the surface, but given life coincidences and timings, anyone can fall for them

[@_aullik]

Its always funny how fast it is to reset 2FA yet everyone enforces it to give you a false sense of security.

[@Qimchiy]

Still more secure than not having it. But on top of that, the biggest security risk or vice versa is the user.

[@bigmew]

i dont get it. they should improve it in the future

[@bigmew]

the amount of bypasses is insane

[@Qimchiy]

@@bigmew to be fair, the website did also ask for Linus' 2FA for his Twitter. So he himself gave the keys to the second security door.

[@FireLord334]

If you receive an email like this never touch it. Always go to your account yourself and reset the password that way. Never just trust an email like this. Give every email the attention and respect it deserves.

[@commanderoof4578]

Unless you are signed into a site it they will NEVER ask for your old or existing password Enter old or existing password for absolutely everything ive even changed a password on is only ever shown when signed in and going to change the password from inside the account settings Also resetting a password never asks for 2FA, 2FA is for signing in not for changing a password they are separated for this exact reason

[@zwenkwiel816]

what if they fake you being logged in though?

[@commanderoof4578]

@@zwenkwiel816 im never logged into anything so thats not a concern for me For others tho it might be... Anytime i get a password reset email i go to the actual site first and check if im logged in on my phone and just change the password there first and formost Otherwise if i have 2FA on i ignore password reset emails And if its a someone or something logged on and again i know i have 2FA on i will go to my browser myself login and check the sessions / allowed devices I dont click links inside emails unless i was the one how sat there and requested a password reset

[@PartialBrainRot]

I know its not common but search engines can be manipulated in terms of contact info. For banks specifically, if youre called or emailed by someone who claims your account is at risk for whatever reason you should ask for their name and extension, then call the number listed on your physical bank card.

[@Efreeti]

Linus' privacy might be so dead, but he's done an ADMIRABLE job with his kids' privacy. Not even having their names shared on any video, repeatedly referring to his eldest as "boy" or "son" rather than by name, things like that. Can't even 100% say for sure I know the order they were born in, honestly. I think that's admirable.

[@DanTDMJace]

Pretty sure that their names were stated in a Channel Super Fun video

[@henrysanecdotes5323]

Just goes to show, YOU ARE NOT BETTER. You are not smarter than hackers, you are not better, you do not know better. You may be those things most of the time, but confidence is gonna shoot you in your foot if the stars align. Just be careful and take threats seriously. Don’t be rash. Live by those rules and you can hopefully avoid some scams that would have otherwise caught you off guard or tricked you

[@SWinxyTheCat]

The nice thing about my password manager is that it doesn't autofill unless the domain name matches, as another layer of swiss cheese

[@Bagline]

another justification for not using email on my phone except in an emergency. I always highlight the link to see the URL before clicking, on top of the server and thunderbird's own spam checker. and then PW manager is like "I have no memory of this place". This is also why I HATE that companies will use 500 domains. Is this microsoft? i have no idea. edit: OH, and you load a site and it's like "lol, here's 20 other services we use that you've never heard of before" so you can't implement a good domain whitelist without breaking EVERYTHING

[@angellic6437]

Veritasium did it!

[@secretspy410]

Different incident

[@aussiescotsman4145]

Timing is a huge part. The only phishing scam i hade ever fallen for was for a toll network that i had hone through the day before and was going to pay it off that day.

[@rmp5s]

It happens, man. I've worked in IT security for almost a decade now and have seen some phishing emails where I'm just like, "damn...I probably woulda clicked that, too." Seen some REALLY good Apple imitations, but the best, by far, was a USPS "sorry we missed your delivery" one...not only did it look SPOT ON, they also sent it, no joke, to a shipping manager.

[@darkphase7799]

In Australia we have a lot of calls where they claim we owe a tax bill and that there is a warrant out for our arrest. The first time I had that call I nearly fell for it. But I did ask for their name, the place they work at, and how I can contact them back. They refused to give me a return phone number. That was what made me truly believe it was a scammer.

[@TheItalianoAssassino]

I didn't even know Luke had a channel of his own. 😂

[@blackwing1362]

A while ago my bank called me because I fell for a phishing scam, and I just wasn't skeptical at all. I definitely should have been, but thankfully it was real. They called me minutes after I actually fell for it, and then all they asked me was "was this you" and "do you want us to change your card". No identifying information at all. I said yes change my card and it was done.

[@blackwing1362]

For context, It was that standard USPS scam, but on that day I had just happened to have a delivery from USPS that was late by a good bit.

[@da1g]

missed opportunity to make the merch "got phished?"

[@kroxfire]

Strangely enough, I've been stuck in a similar situation. End of a 16-hour shift, was expecting an important parcel, picked up an unknown number and typed the OTP. Spent the better half of the next day with the bank

[@Jmhawks]

Its because of the hair

[@EvanAintDead]

No doubt 😂

[@willking4512]

Something I have been learning recently: Confusion means something isn't lining up with your mental model of the world. Yes that is the definition, but if you can recognize when you are confused, then you can start looking for what isn't lining up.

[@Matrh88]

It was mentioned that hovering the hyperlink would show it not going to an x domain, however now a days it's common practice for all hyperlinks to go through a 3rd party cookie tracking service to measure engagement from emails. I don't think it's deliberate that many companies use it for their reset password emails too, but I have seen it plenty of times so hovering the hyperlink is not always applicable

[@JamesR624]

"I wanna go home..." Yeah.... "...and start filming this immediately." WHAT?

[@CalgarGTX]

The only time I got scammed in a MMO very long time ago was a day where I was doing 3 things in parallel. When you multitask things, your usual safety check and 'this is fishy' detector falls apart very quickly.

[@techllama]

Just pointing it out as it wasn't discussed in this video but I ALWAYS check the domain in the browser address bar before entering any sensitive information into a website, 100% of the time - it really doesn't take any extra time.

[@Tall_Order]

I only check my email once a day, and i dread doing it because of all the spam. No matter how many i mark as spam, it just keeps flooding in. And I've opened new email accounts, and never used them, yet they get spammed. So the email providing services must be sharing our email addresses with advertisers or something.

[@the_undead]

What is your email service that you use?

[@filemot25]

I use ProtonMail with SimpleLogin and don’t get any spam anymore - Also make a habit of unsubscribing from everything you aren’t interested in

[@seabream]

There are other potential explanations. You might have a compromised machine somewhere in the chain. Networking equipment, whether on or off premises can have vulnerabilities that are used to suck information into databases that can be used for various purposes, including spam, right from when you signed up for the address. You or your provider could have a computer with malware on it that the e-mail address passed through in the creation process. These could give the result you described without your e-mail provider selling your information to spammers.

[@Tall_Order]

@@seabream Anything compromised would not be on my end. It would either be on the end of the email provider or the isp.

[@TheViggokid]

My mum got very close to being scammed by people claiming to be from HMRC (the tax people of the UK). I came home one day and found the door on the chain, her crying and terrified because they had threatened to come round to her house after she was finally told by her bank that it was a scam The deepest circle of hell is meant for these sorts of people...

[@gigachadster]

I love listening to tech from a guy that falls for basic phishing

[@crisdebug8675]

A good point that I've learned about computer security: it's like a machine's efficiency. It can never be 100%, you'll always need at least one hole, which is the legit one, the one where you get in. You can always have due diligence and you can have extra steps for your internet security, but remember it can never be air tight.

[@trickvro]

This really shows that NO ONE is completely immune to being taken in. Probably one of the worst things you can do for your own Internet security is to let yourself think you wouldn't fall for obvious tricks. (Not saying Linus was guilty of this, to be clear.) Atomic Shrimp has made videos in his scam-baiting series talking about exactly this. It's a constant cat-and-mouse game out there.

[@JacobP81]

It can be easy to be phished if the URL looks a lot like the real one.

[@NicCrimson]

I never click links in emails I always go directly to the site.

[@Apheleion]

Sorry you got hacked but, happy about the team looking to jump from twitter lol

[@mari_023]

I think the wale not actually being a fish (but rather a "fake fish") is extra funny in the context of phishing

[@GeneralNickles]

The whale on the "got phish" design should have a black fedora to represent "black hat" hackers.

[@aaronmaynard42]

If I had a nickel for every time a LTT account got hacked, I’d have two nickels. It’s not a lot but it’s weird that it happened twice.

[@PeterswoLP]

we actively send out phishing Mails, in case, that something breaks through our security lines, our Users are so used to check the Mails, that they are trained to notice this kind of stuff. so important

[@invisiblekid99]

It's so, so easy to say "oh I'll never fall for something like this". But there are two big things to consider. 1) Timing. As Linus said, this was such bad timing. Anyone can take their eye off the ball, and as mentioned being quick with something like this, if real, is critical. 2) Workload. How many people not falling for this have very little at stake being on-line? I mean I PROBABLY wouldn't fall for this, but I get boring emails, I'm not busy person and don't have a business that could be effected from hacks. Linus is a very busy person and even on an off day, is business aware but with very little concentration applied to it. In a rush and not "in the office", who is seriously 100% confident they would spot New Password, New Password, instead of Confirm Password. Anything that isn't 100% means you can be hoodwinked. If I were to get a banking issue, that's different. I'm dropping everything and calling them direct.

[@ehstaley]

Dan's humor is the most under appreciated. I love his dry sense of humor!

[@filippofanton8224]

I want a hubleberry pie shirt with the text "It's ok, my mouth does that anyway"

[@TTYLIG]

It really does feel like LTT is just starting a new peak era if not THE peak era

[@Konrad-z9w]

My company did a test once sending a phishing mail to everyone. 25% clicked the link. Twenty-fucking-five percent.

[@DonDuracell]

We do this at work about every other month to 20% of our employees and those who click the link then need to do a half an hour security briefing. After now a year of full briefings last week was the first time we had empty seats in the seminar. 🎉

[@antagonist99]

In the Bundeswehr, the S2 would send an email from an obfuscated account to everybody, telling them they were chosen to win an Amazon gift card. You're not supposed to click the link, obviously. Still, there will always be people afterwards with an appointment with the unit's S2 because they *did*. Me, personally? I'd just forward the link to one of our S2 officers with whom I was pretty friendly, telling them I didn't click the link and if that qualified me for actually receiving their Amazon gift card. "You're not supposed to forward the mail, and no." Every year.

[@anthonygillette]

Twitter is a hellscape anyway

[@Deja117]

I usually check the sender of the email, that's the first most important thing to me, as usually it will be from an email tied to their domain. Additionally, I keep a few different emails for different accounts. There's the "important" ones, and the actually important ones. Then there's an email I sign up to random stuff with, scammers often spam that one, and it's funny reading things there.

[@preston_s.]

This is an informative case study. The only reason I knew about any of this before this video is that my employer takes phishing very seriously. Most people don't know what phishing is, how to identify it, or what to do about it.

[@saskmuddinatv]

I am genuinely surprised Linus fell for this. That's rule #1 never follow links through emails.

[@miciso666]

also no thing ever goes: insert old password here. seriously? why?

[@JimNortonsAlcoholism]

Or just look at the URL

[@valenrn8657]

Only the paranoid survive - Andy Grove, founder and former CEO of Intel.

[@The_Cadaver]

Twitter is an absolute dumpster fire. Just let it go.

[@jtnachos16]

I've managed to drill it into my elderly parents to NEVER click on a link or image in an email. If the email is legit, you will be able to access whatever it is trying to tell you to do, by going from the official website itself in a different tab without EVER clicking on the email.

[@urbanlucky98]

With calls I really don't know anymore these days. I live in an EU country and got a call a week ago from a 'police' officer, who was looking for me, he had my full name, my address, and he asked me if I had been in "SET" place. I was kinda spooked, so I called the national and local police department which both informed me that is was fake. But when I checked the employees who worked at the specific station he said to be from his badge ID, everything checked out. Also he did an interview once and his voice matched up. Either they were actually looking for someone and didn't wanna tell, or it was fake. But it was hard to verify and it's one of those things where it's like 'why would a fake cop call me to ask if I was in "SET" city??'.

[@__mk_km__]

What's even funnier about the IP location is that you *can't* even access twitter from russia So, if you see that in an email you can be sure it's a scam

[@Capyman-cn9mf]

I like how they list future steps ignoring the most crucial. Stop, breath, think. if it is a breach 5 extra minutes won't make a noticeable difference.

[@bergerle]

I feel you. I also like to think I'm above this, but I had a slip up once. I got a work email that sounded like it was actually related to an IT support ticket I opened the day before (total coincidence). The login page looked legit (even the url, which was actually a real Sharepoint url, I checked even that). A major red flag should have been that my password manager failed to get the right credcentials automatically (because the login url didn't match), but I thought it was just a hickup. Luckily it wasn't a real phishing attack, but just a test by the company to see who would fall for it. And they did something quite clever: once you entered your real credentials, the system would use them to automatically sign you up for a cyber security awareness seminar.

[@whitepawrolls]

Note for the future. If you EVER get a link like that in an email don't click it no matter how legit it seems. Instead go right to the website instead. In this case you would have seen if the information was real or not in the message.

[@XIIchiron78]

10:01 I feel like the stupid name change is an underrated player here. Because, "well, I guess they could be using multiple random domains" is pretty valid when the website is LITERALLY JUST A LETTER and has changed multiple times

[@PhoenixShep]

One of the reasons why I prefer watching waveform instead of the wan show is because even though they are similar I feel like they keep interrupting each other like 5 times a second

[@joshcarlson9352]

"just caught me at the wrong moment" sounds like something i might say to cover up my inebriation.

[@The_Slavstralian]

The major takeaway is. If it gets someone as tech savvy as Linus, it can get anyone. Please be vigilant people. STOP take a breath and slow everything down to double check the things going on. A few moments to clear your mind is not really going to cause too much issue

[@shutterbugsid1467]

I literally felt like Linus was acting like Homelander "I am BETTER!"😂

[@Maurus200]

There is a reason why I never click on links in emails I do not expect to get. If I do get an unexpected email I always go to the source website or phone app to make any necessary changes rather than using the email.

[@toastermon2272]

Acting fast is definitely important, a month ago my Sony Account was hacked and while I only have it for HD2 and didn't care much, they took maybe 3 minutes to completely take over my account and make a purchase. After finally finding a support phone number, the support was actually very quick to rerverse everything and get my account back. Sony can still f themselves for a variety of reasons but at least that experience didn't leave a bad taste.

[@cobusbekker4664]

The problem comes with being preoccupied with something and not paying 100% attention, and that's what they are hoping for. You want to rectify the problem as soon as possible to minimise the damage while busy with something else.

[@dakota.zimmerman]

The only sure fire way to avoid this is just take up the practice of never clicking links no matter how legit it looks. If you get any email like that, just ignore that and go directly to the real website you know of and try to login and/or reset your password there, if it requires doing it in an email, trigger the reset email yourself and wait for that new one to come in. Emails are never a place to click links unless you were expecting that email from someone you know or its a 2 factor or rest thing you KNOW you triggered. Its just not worth taking that risk. I wish companies would default to not including links like that and just send the email to tell people to go to the website to reset their password, it would be more inconvenient but would have a huge impact on account security if people were required to manually trigger the reset themselves. Edit: Really though, very glad how transparent Linus and the whole LTT team is about stuff like this. Great teachable moment for everyone and the humble pie is great. I typed up the above early and Linus did eventually briefly mention navigating to the website manually to reset passwords, I wish he would talk more about that so more people can hear about it. The part describing how to tell if something is real is great but I'd just recommend these days to always assume its fake right from the beginning.

[@MaverickBlue42]

Uh, where's the link to guy's video about it? You said it would be below...

[@joeyf504327]

Link to John's video?