Posted on 08/04/2024 12:35:56 PM PDT by Openurmind
I have detected a serious YouTube security threat that needs exposure. All IT and security experts welcome to please check into my findings and chime in. Here is what I found so far.
Years ago this was a problem. Just going to youtube or Google mail at all even on another tab without logging in would load strong spyware in your browser and even in your machine permanently which required reinstalling your OS to remove. It tracked logins on other tabs and was gaining access to keyboards, microphones, and cameras even if you just landed on their site by accident. Folks caught on and exposed it and then it stopped.
It is back... I am starting to get the warnings again so they are up to their old tricks again. You can't even load Youtube up on another tab and be safe on the one you are already in. As soon as you do it crosscripts and tries to hitchhike with you into the site you are logged into or logging into giving them direct over the shoulder API account access. I discovered it because our site has IP detection security that kicks you out on the fly if there is any change of your IP address status forcing you to log back in and verify it is actually you. But my IP address remained the same.
So it detected the second IP address trying to access my account along with my current IP address as soon as I landed on youTube. Our site immediately kicked me out and made me log back in with warnings about the crossscripting from Youtube coming from my developer tools. They are attaching a real time cross domain API to our browsers that gathers credential and identity data about our logins. I had to go clear all my data and history cache before I could login safely without it.
This is serious, this is not just for sites like the FR, it is every site you log into with credentials. Work, business, shopping, banks... Everything. So If you use youtube or Google be sure and clear everything in your cache before you go log in anywhere else. And DO NOT use it while already logged in anywhere. It immediately jumps in bed with you and is also logged in with you. I am testing now but the only cure I see that might be easy and work to prevent it would be to bring up Youtube in a second browser to run YouTube in separate from the other browser where you are logged into or logging into other sites. I am still testing this option to make sure the browser does actually keep them apart from each other. hopefully it will not take tweaking to make them secure from each other. Any and all help from the experts here is welcome.
They just went off and ruined it for those who like to share YouTubes...
When you close the browser and open a new one is the malware still active?
I use the Duck Duck Go browser which automatically blocks trackers. I don’t know if it would prevent this.
-SB
???
Need to keep abreast of this.
I wonder if this is related:
I just got a new smartphone, which, unfortunately, had google on it. When I tried to install an app for driving directions, it forced me to open a google account.
The next time I attempted to use my new phone, it wouldn’t accept my fingerprint or my password. It was essentianly a paperweight.
I was so disgusted that I restored the factoy settings and am returning the phone.
It took all day and several phonecalls to both my carrier and the manufacturer to learn how to wipe the phone, and ended up going online on my desktop to find out how to do it.
Everything was fine until I went to google.
What do you think?
“When you close the browser and open a new one is the malware still active?”
That is exactly what I am testing now. I am hoping they are completely separate so that the scripts cache from one does not affect the other. But I am afraid that by default they are tied together with the same cache. If so there needs to be away to keep them isolated from each other to help with this problem. Might have to make a custom route to a second unique cache.
So they can capture things like your bank account user name and password, even if you use a password safe?
Very well could be. they are playing some new games right now. And despite what we think about their expertise they make mistakes in programming too.
“So they can capture things like your bank account user name and password, even if you use a password safe?”
A password safe might help. But for those who don’t use one they are gathering your credentials and IP of the sites you are in. And because they are over your shoulder riding in with you they very well could be gathering even more data.
It is not good. There should not be a second IP address from Google attached to yours when you are logging in other sites thinking you are secure. I suspect this second IP address is a real time direct API connection to Google.
.
Is what Google is doing illegal?
“I use the Duck Duck Go browser which automatically blocks trackers. I don’t know if it would prevent this.”
Good question. It just might. But what I have found is Google has a way to override everyone and everything. So it would need to be tested.
“Is what Google is doing illegal?”
Unfortunately no. they can do what they like and it is up to us to protect ourselves from them. This is business as usual for big tech. We have to remember Google is owned by Alphabet, and Alphabet is owned by BlackRock, Statestreet, and Vanguard.
“When you close the browser and open a new one is the malware still active?”
Sorry I didn’t answer this correctly. the script remains in your cache until you go clear your data and history cache. But some browsers you can set to dump the cache every time you close it. In which case closing it and opening it should clear it for you.
Thanks.
I think I am going to abandon my Yahoo and GMail email accounts and move to protonmail exclusively and continue using KeePass.
Looks like using a second browser opened still uses the same common cache files. So they are going to share that same bad script. Looks like a second browser needs to be renamed unique and then configured to use a second different cache of it’s own. This is going to take some homework...
I don’t understand all of this but I do know that I don’t like paying subscription prices for YouTube.
I’ll just be content with my flip phone, as I FReep on a desktop and use alternate search engines.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.