Government Hackers Inspired by YouTube Spam Bots
ฝัง
- เผยแพร่เมื่อ 30 ก.ค. 2024
- 👉 Free $100 Cloud Computing Credit seytonic.cc/linode
Timestamps:
0:00 Government Hackers Copying TH-cam Spam Bots?
4:24 FBI Defends Their Offensive Operations From Privacy Concerns
8:16 Linode
8:55 Outro
Sources:
thehackernews.com/2022/09/ira...
www.proofpoint.com/us/blog/th...
therecord.media/iranian-milit...
www.bleepingcomputer.com/news...
www.bleepingcomputer.com/news...
therecord.media/fbi-doj-defen...
therecord.media/fbi-operation...
• DAAG for NSD Adam Hick...
www.theguardian.com/technolog...
www.virusbulletin.com/blog/20...
www.google.com/search?q=cyclo...
www.techtarget.com/searchsecu...
www.malwarebytes.com/blog/new...
threatpost.com/fbi-proxylogon...
www.justice.gov/usao-sdtx/pr/...
www.cybernewsgroup.co.uk/fbi-...
www.techtarget.com/whatis/fea...
proxylogon.com/
===============================================
My Website: www.seytonic.com/
Follow me on TWTR: / seytonic
Follow me on INSTA: / jhonti
=============================================== - บันเทิง
A guy in Finland was recently found guilty of "Unauthorized access" after accessing a government answering machine. He changed the answer machine message to informing them that they shouldn't use the default password to secure their answer machine. Even though the court agreed there was no criminal intent, they still found him guilty.
No good deed goes unpunished
did he served time?
Computer Fraud and Abuse act is quite the precedent on a worldwide scale
@@Lucas-cm8zq Nah, he got a fine. The exact amount is income-based and not publicized, but probably around a quarter of his monthly income.
do you have a link to an article?
These 2.0 bot threads are so annoying and it seems TH-cam can't get rid of them.
they can't even get rid of the normal bots
TH-cam can't even get rid of the "It's finally here {youtube link}" spam...
Feel like a 1 or 2 min comment rate limit (per account and ip) would be soooo easy and you stop 90% of all spam
They are too busy removing features people like and saying its for "harassment"
all they had to do is to check if a comment contains “number,space,number,space,number” and remove the telephone number comment
seems pointless removing the malware and leave it not patched for some one to exploit it again, seems strange and just another invasion of privacy rather than notifying the victims with details.
How does this Bitcoin thing work??
They didnt patch it because they themselves want to use it
Patching it may involve updating or changing a number of dependencies on the server, which could cause seemingly unrelated things to break. You wouldn't want to inadvertently take down the server.
Better than a knock on the door by the FBI….
I learnt Multi Persona impersonation today.
I thought I was an expert in Social Engineering. I am privileged to always learn something new
That is crazy! Where can i find him?
@@NikiTricky2 i heard his name is rick astley
@@ImInSpainWithoutTheS And he lives in Albuquerque, 308 Negra Arroyo Lane.
lol
@@baltazar5326 thanks, omw from the wes
I want someone to create a virus kinda like what the FBI did here, but more irritating. It would just do stuff like insult your bad/reused passwords, disable malware (while making absolutely sure the "victim" knows that they were dumb enough to download malware), and give you a page-long lecture on FOSS every time you download something that isn't.
I second this. It's similar to prankware, but more educational
Not sure about that last bit (I love FOSS as much as the next guy but that's literally just pop up ads for it) but otherwise, not a bad idea. Exploit known vulnerabilities, to get them fixed. Use the CVE's to destroy the CVE's as it were.
@@robonator2945 actually, yeah. It should be two different things: one virus is rude but helpful, and one is literally just a stereotypical arch user living in your computer.
Working on it
seems ethically questionable. that and the already existing NPCs that do not like FOSS operating system alternatives will have more of a reason to shill their propaganda more if this "malware" of yours become fruition.
Can you imagine if these guys outsourced their comment scrip editing to say, Fiver. That alone would be a game changer for their “click through rate”, to use an e-commerce term here.
they are too stupid
That reminds me of a virus some years ago that installed a back door. There was a program being passed around that would _use_ this back door to shut down the compromised service or something to that effect, *when it was probed by the virus's attempt to spread* . This was created because some people were sick of a certain group that was not fixing their infected machines.
The reporting of this went on to say that people shouldn't be doing it. But I remember thinking at the time, "Who do I even call to report the intrusion attempt?"
Imagine what an AI will be able to do with multple persona impersonation some 10 years from now, or even 5.
or now
@@truerandomchannel right? Watch totallyNotSuspiciousChannel now to learn the terrible reality!
Just watch this comment section
@@erg0centric
But these are dumb. Imagine when they are believable.
It's already here, just open Twitter.
The “malware” wouldn’t have further infected the computer. It’s only purpose was for recon. If the victim reported back interesting processes or ip addresses, the threat actors would have sent another “actual” malware. Proofpoint knows this because you can look at the macro inside the doc file.
Fun fact: My cell mate back in 2010 was a bloke that hacked the Australian NBN (National Broadband Network). He was a really nice guy. Definitely out of his element in prison lol. I looked after him though. He was safe
Love the videos keep them coming!
Thanks! Will do!
Nice, already seeing spam bots on a video about spam bots
deadass youre right... youtube needs tp fix this
@TH-cam real did you watch the video lol you're just going to get reported with all this ad spam
The Federal Bureau of Investapo wouldn’t lie, of course. Absolutely trustable.
We have investigated ourselves and found we do nothing wrong
I think this is a malicious comment.
I love how their financial guru always sounds like a psychic. Like lady Sophia or miss Lydia
Miss Lydia still running I saw her the day before yesterday someone tried to get me with it
Thank you as always!
You're welcome : )
@TH-cam real sus
This channel is brilliant.
I can think of 10 techniques youtube could use to detect this shyte, wonder what thousands of yt workers are doing 8hrs a day
TH-cam annoycing they fixed the bot problem is like when Gorge W Bush sat in front of the "Mission Acomplished" banner during the war. They did N O T H I N G.
I know this isn't the point of the video, but the spam bot comment train has more flaws than that imo.
Like... it's just not believable. What are the odds that that many people have had dealings with this one guy who no one has ever heard about?
And even in the one you showed, the first 2 comments are exactly the same for the first 16 words.
But that's another thing about those scams isn't it. People who notice the errors and the weirdness probably won't fall for the scam. That's why old scam emails so often had grammar and spelling errors. It attracts the vulnerable and weeds out some of the ones who would get suspicious later on.
Not shaming anyone who falls for these. Even the best can fall for scams.
When you spot them though, and you know a few things about the internet, it all just looks half-assed, or like they didn't quite know what they were doing.
The scary part is, we might find it obvious but others won't believe us.
Like if someone said "no way these are real people you're just paranoid. Can you prove that they are bots?"
How would you be able to prove that common sense is common sense?
We can go back a little bit and ask ourselves " If we can prove that these bots are bots to others, what other things there are that can't be proved?"
Is it even possible to wake up a delusional human?
P.S as of proving bots are "bots", you can simply click on one of them to see their comment history. They just take turns in copy pasting the same comments over and over.
Yeah I had already spotted a type of bot chain and it was the same as you described in the bot 2.0 and the couple I looked at all had double comment entries except for a couple of people that looked like real people falling for it
I've seen double comments that have something to do with lag(I think), but they're completely different
@@tsquitz I saw the pattern I mentioned in a couple of videos by Jack Rhysider. Just look for a comment that has several replies that starts off with something to do with investing..
@@christenw.1726 they're always mentioning the same made up person too..
@@rockhoggaming yep. Once you (collective) pay attention it seems so obvious right?
@@christenw.1726 yeah when you pay attention it really is just so blatantly obvious that its just complete and utter bogus. its so sad people out there fall for it.
The FBI didn't just remove the malware. They also installed their own backdoor in the process.
Nah bro they didn't. They promise.
Johnti has no plans for evil hacking; just goes with the flow.
Oh that bitcoin guy in the thumbnail prob flabbergasted that btc didnt work out
Jokes on them, the local scammers already milked us all dry.
Been seeing lots of those, its so annoying when youre tryna find genuine comments and you see those
these scammers are getting ridiculous
I am glad that the FBI assisted those entities.
Does anyone have this Korg by Proofpoint template
I would realy love to see how theese macros get machine info and public ip and on what channel on telegram they share that
these bots going wild on this video, the irony...
whit the case of exchange:
that's what happen whit proprietary software, what do you think? those backdoors were made for the fbi/cia/idk, i'm not from the us
if the source code id free, there will be always some people interested in the security of it, and so it will be patched (you can't hide anything in face of people)
and i mean, we all know that every closed-source microsoft product has backdoor, and of curse, most of all does
Haha they just went in and secured the back door for themselves. They don’t like competition.
This is why I don't send ANYTHING important via email, nor do I reply or open ANY emails. If someone needs to talk to me about something they can see me face to face at work. And if they don't work with me there's no reason for me to talk to them in the first place.
What about important automated emails, like a site's email verification, payment confirmations, etc.
Why can't I search for these bots (account) and find them on YT or Google for them ? Interested to see what is on their YT channel
We need a cloud-native government, which is why govclouds are a good thing. They provide the security - often airgapping whole data centers inside SCIFs - required by the US Government. Because you can't hack what isn't there.
I know that when I recommended my company went pure cloud there was significant resistance, especially from the global network manager.
But the Board went for it.
They made huge savings by getting rid of on-prem crap, and I was forced to learn how to exploit cloud instead of just getting by on my knowledge of pwning AD DS, Exchange and SMB servers.
Everybody won - especially me, having found that MS Teams Electron app is the gift that keeps on giving 👍
uh, yeah no this sounds like an absolute security nightmare. Sure, maybe if it was done perfectly and with perfect cybersecurity, sure, it's better. Quantumly secure cryptographic communication, smart card authentication, all the servers being hosted in a dedicated high security location, etc. but in practice it's going to be hosted on some bog standard service like amazon AWS, with user-chosen passwords, bog standard encryption that'd be lucky to even be E2E, etc.
Except now, you've localized the point of failure. If I were an attacking government instead of having to assault EVERY government building to bring down operations, I could just strategically strike a few data centres. I mean fuck, even WITH perfect cybersecurity, the best firewall in the world ain't gonna stop a Javelin or Iskander.
Let's put all our eggs in one basket what could possibly go wrong.
@@robonator2945 So you're saying you'd prefer random government agencies being responsible for patching and firewalling their own Exchange servers, and having difficulty finding qualified employees to do this because it's no longer an industry standard? And you're saying that the above would be more secure than data centers protected by federal agencies? I'm disputing your logic.
@@StephenGillie literally yes. Decentralization of data is how systems are made secure. If the government is incapable of handling data safely maybe A : they shouldn't be in power or B : they shouldn't have that data to begin with. Offloading the problem to a centralized point of failure doesn't fix any of that, it just means it's quite easy to find on a map and sent a bomber over.
8:00 "something tells me i wouldn't be so lucky if i did something similar". I mean, there's only one way to find out really :)
I like the way you think
Hello, Great content. keep up the good work... Don't forget the uber hack on your next video🙂
If I got hacked by BBC then I would have tried to sue
Just take the BBC like a champ
wsp bot hows it going
as an Iranian I'm ashamed
3:03 lmao Comic Sans...
I was gonna listen to a dnd podcast, but this will do
Ooh I do love a good dnd podcast 🎲
Are you a new player, or a seasoned veteran?
This platform, it’s great but also has some issues like this. Bots.
Good bot
@@captainkatz1775 who?
Agree. Check out the legit channel about earning money quickly.
2:58 why is the email signature in comic sans???
Let's goo
I don’t trust contacts I receive from TH-cam comments lol
Hackers always love cats XDD
hey seytonic! I have a very half baked malware on my hands named the Nominatus ransomware! he actually did send this out before but he updated it. BUT HE STILL DIDNT OBFUSCATE IT AT ALL LMAOOOOOO. you should make a video about this, I can send the link to the file and the project files if you would like!
8:04
"BBC Privilege"
No way did you just say that 🥵
These kind of bots I've seen in Facebook.
When one bot says: I heard somewhere is giving away free laptops, does anybody know...?
And another bot yeah is a link or something like that...
so did you get the link? :D
Seems that using Open Office, instead of MSO avoids a lot of macro hacks lol
Application Guard for Office mitigates these kinds of attacks
@@siddiki9778 and then that app is also proprietary............ when literally you can just disable macros alltogether. :\
@@generic6099 It comes default with your Windows install iirc. Besides, you may need to enable macros in some situations. Application Guard defends you in those cases (I'm aware that you can just run those macros inside a VM but a VM is heavier than Application Guard containers so there's benefit in using it in some scenarios).
Macros are disabled by default in office
@@impoppy9145 That doesn't help people from being social engineered into opening them. MDAG or Windows Sandbox helps you in those cases.
If you leave software installed by a hostile country on your computer you are in essence providing support to that hostile country. In most countries providing support to a hostile country can land you in jail. Maybe the current American government will not take it way, there are certainly many other governments in world that would once they figure this out.
a good way is telling is if they have a first and last name as their youtube name with a real picture of a person i know this is weird but most of them are like that
once worked for BBC a long long time ago. Good to see they still think they are omnipotent.🤔
Based Ronald Reagan quote. Can't wait for my first million to trickledown in a few years
you know its fake if they have a profile picture of themselves
I'm just going to say a bunch of keywords which bots look for bc im bored. bitcoin, gift, banned, tiktok ban, youtube, youtube ban,
printf("Hello, Seytonic!");
No mention of the Uber breach
BBC Privilege Lol 8:03
Aaron stein lol. Classic Iran
You should cover wtf happen in Indonesia bro
We have battle with hacker
I don't even use telegram or whatsapp
What about the Uber hack
I also run my own mail servers (not on premise tho) and also not using M$ software. Go mailcow go OSS.
Any reason why the "hello world" was purple this time
I tend to randomise it, just for the hell of it.
@@Seytonic fair sounds like a me move 😅
hey seytonic is there any vpns you would recommend?
Based on his past sponsors, it’s probably Private Internet Access! I think he was the yt with them as a sponsor, it might be nationsquid 😂
Mulvard seems to be good, but don't nail me on that.
If I remember correctly, Mental Outlaw made a video on that
Yep, I remembered correctly
th-cam.com/video/hPrMtIXUh1s/w-d-xo.html
@@SIMULATAN Thanks for the suggestion ill try it out
I didn't do PIA, I've heard good things about mullvad - but it's been a while since I've used one tbh
Spotted those bots myself. :)
No information on Uber hack?
It came a bit late for this video.
A TH-camr named thiojoe has a decent open source python tool for spam comments. Do check it out now
Yeah, it barely works... He tried though, but his program isn't A.I and these bots learn to bypass any stuff you put in place.
hi! did you see those spambots v3? with a sus profile, it copys a topish comment!
If you opened up that Microsoft office thing on Libre Office on Linux, would your computer still be compromised?
most likely not, but that’s not an excuse for anything
Technically yes but also no
If you don't know, you don't know if you should be messing with it. Is this snake poisonous to humans?
Yeah, I certainly wasn't planning on it. I was just curious if Linux users also needed to be cautious of word attachments.
@@cameronmoore136 just always open it in a net disconnected VN just to be sure no matter the OS you use
Ah, Telegram? That's the sole platform that all bots chat on
Speaking of bots, why do they invite you to podcasts and never answer anybody?
I believe all of us are against government encroachment, but for some reason this case is somehow acceptable; There was a court order and the target companies knew that the FBI is coming to fix the co's door lock to prevent intruders to eves drop. I mean, if governmetn wants to fix something in my house for free, please do. EDIT: Roof is almost 10 years old needs to be changed.
This is what the government should be doing in the name of "national security" if they really need to, instead of dragnet surveillance and trying to ban E2EE.
spams talking about spamming bots, how's that possible doesn' that break AI limitations
Ah yes, Reagan: that paragon of non-intervention & liberty.... 🤔
Instagram and telegram are filled with them
I have a hard time understanding the purpose of Linode in a world where WSL 2.0 exist.
You're comparing apples to rocks. They're two entirely different technologies. Linode is a cloud platform and WSL 2.0 is basically just windows running the Linux kernel so you can run EFL binaries. Linode is closer to AWS or Azure. I personally use it and I still have no idea why you brought up WSL 2.0
Seen one or two? TH-cam is filled with millions of these comments
Now, supposing i have a boobie trapped pc with the malware on it, what gives the FBI the right to remove files fr my server if specificlly left it there while monitoring it in a sandbox?
If this ever became the norm, it wouldn't make a difference, as competent people would gain the tools to protect themselves, whereas vulnerable systems would get FBI protection. I see nothing wrong here
@@blisphul8084 it is still theft of data by a 'friendly' government in another country, without the permission of the owner of the server, or government in the other country.
Once again, why right do they have to do this?
Also, if you're running a pipeline that is critical to national security and you let yourself get hacked by Russia, you have no right to complain about then being hacked by the US government to clean up your mess.
@@blisphul8084 what part of sandboxing is omitted from your brain
@@dennis8196 I see, I misread. If you're doing that, you should probably make a checkpoint in case something like this happens
Bitocin is the future was a comment posted by abot that was running on Internet Explorer
Botnet, "Swatnet" Please redirect your flame botnet at our DNS servers.
Social engineering made automated
Yeah no, the glowies are not fooling me
Do you think BBC should be charged? I think it makes sense they weren't. I like government that can tell why they shouldn't enforce a law like this BBC operation.
1:07 replies is older than the comment that dont make any sense ?
Watching a few of these video's I can't but notice these discovered hacks are not that sophisticated or smart. I wonder about what the sophisticated hackers are about.
1:00 the replies are older than the comment itself
0:58 calling that comment innocent is weird, when probably that is the trap comment or something
lol
People who claim to fall for these scams are really the creators of the scams trying to scam themselves for insurance money
Lol you argued about the FBI hack as if the Chinese attackers don't pose any threat to users' privacy. I'd stand with FBI for this case. Not being able to shoot back when criminals are actively shooting innocents is the worst thing you can do under that situation.
Sure thing, the Chinese hackers pose a threat, but how can you say that the FBI doesn't? Whats to say that they can't just hack into a server to supposedly help, but then proceed to steal data and potentially make a backdoor themselves? If someone is not capable of running a server properly, than they simply shouldn't bother running one. If that means others are affected by poor server security, then the FBI should at the very least notify the server admin/company of the problem when possible and move on. Often exploits can't be easily fixed and the "good samaritans" can easily break other stuff in the process, ironically making the server less secure.
Maybe a better way of making sure things get fixed is by fining companies that manage vulnerable servers in case that a notified vulnerability is not fixed within a certain reasonable timeframe.
@@pipodrankje
The better way is to enforce laws that require companies to take care of such issues. Microsoft had already notified their customers _before_ the FBI hacks, and clearly, these business owners didn't give a crap. The data on the servers, however, are likely _not_ owned by business owners but by the employees and customers. I don't trust the FBI either, but compared to the Chinese government, the FBI seems much more trustworthy.
Also, you missed another huge point. For APT attacks, the duration that attackers have access to servers is a thing. Weighing the cons between losing more data to autocratic war-promoting ruthless Chinese attackers and having unauthorized access from the FBI, I'd gladly choose the latter. Not to mention FBI still went through court works.
Again, I stand with my analogy, it's a terrible idea to take guns away from officers just because "killing people is bad". Of course, it's bad, but ending a mass shooting by downing the perpetrator is _always_ better than having more innocent shoppers killed.
BTW, TH-cam in banned in Iran😂
:D
@Seytonic Hi
Hi
I’ve recently seen comment chains with the same format with a political message under certain videos directly unrelated to the subject, but close in terms of recommendation. Mostly pro-russian narratives.
So you’re 25 years old
honestly the FBI thing feels like what they SHOULD be doing. Y'know, actually protecting people. If your system is insecure enough that they CAN get in by exploiting PUBLICLY, KNOWN, VULNERABILITIES (that means PUBLIC, known to everyone, not just the FBI) then them remotely accessing your machine to fix the vulnerability is far better than someone else accessing it to actually screw you over. I would say that if this were EVER done again it NEEDS to be formalized to put proper legal ramifications to it's misuse, but all in all, the FBI actually fucking helped people here and they did so without leveraging governmental privileges. They used the exploit any other hacker could have, to remote into your system, and fix the bug. Fuck they even got legal permission beforehand and, hopefully although not explicitly stated here, did warn the server hosters about the vulnerability directly prior to making unauthorized access.
It's one of those things where it's very fucking close to being a major overreach, but they didn't leverage any governmental privilege, got formal permission, hopefully contacted the individuals beforehand to give them the chance to fix it themselves, did it all above board, only used the exploit that was an actual threat to the server and didn't use some outside method to gain access, and (if they are to be believed) took the privacy of the individuals into consideration.
I'm sure as fuckin hell no gov simp, but on this they did a good thing. I think if we want the government to actually become a tool for good, you have to acknowledge when they do actually do something good. From what I can tell this was above board, fairly done, an honest attempt to secure others' systems, and generally the government doing it's job at providing services to people. Assuming everything I've understood is correct, the only ONE other aspect that I think might taint this would be if the individuals running the servers, for one reason or another, explicitly responded saying that "I'm aware of the issue, I'm choosing to keep it". That'd be fucking weird, but if you explicitly want your system to be a certain way, the government doesn't have the right to step in and change it. But, realistically, I think most people were just being lazy.
I'm siding with the FBI on this one, despite not liking or trusting them very much. Let this be a wakeup call to companies that they should step up their security practices.
I'm sure they're only doing this to have power.
wow invent a virus and got the antidote,na not sus at all!!!