Leaking the email of any YouTube user for $10,000

Comments

• givesomefucks@lemmy.world ⁨1⁩ ⁨month⁩ ago

  To clarify this is about someone identifying a vulnerability and getting $10k from Google for it

  source

  • mrnarwall@lemmy.world ⁨1⁩ ⁨month⁩ ago

    I was just thinking “maybe I can just give them my email…” but of course it isn’t that simple

    source

    • AdamEatsAss@lemmy.world ⁨1⁩ ⁨month⁩ ago

      I’d pay $10,000 for your email.

      source

      • -> View More Comments
  • JoYo@lemmy.ml ⁨1⁩ ⁨month⁩ ago

    that’s the real maricle here, an actual payout of a bounty.

    source

    • Ledivin@lemmy.world ⁨1⁩ ⁨month⁩ ago

      …huh? Bug bounty payouts are not even remotely rare in either the industry as a whole or Google specifically.

      source
• flames5123@lemmy.world ⁨1⁩ ⁨month⁩ ago

  When FFXIV implemented better blocking tools this past summer, there was an option when blocking a single character to block the entire service account. This would be fine, but the implementation they went with is client side, and when you select that option, you get the service account ID. Which means that if you’re blocked by someone, you can’t made an alt character to stalk/harass them. But with third party tools, we can see this account ID. The stalker could just use a new account and find the person’s account ID that they were harassing and find any alt character they have in the game. They’re changing this soon as a third party tool popped up and is now able to do this, full source code leaked so there’s no shutting it down until the game devs change how it’s done.

  This sounds super similar, but the implementation that you had to do for google is crazy.

  source

  • redeven@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Saying full source code leaked is a little wrong.

    Plugin was always open source, and all plugins for that framework are required to be open source by the framework’s licensing.

    Doesn’t change the fact that once one person did it, the code was available for anyone, though, you’re right.

    source

    • flames5123@lemmy.world ⁨1⁩ ⁨month⁩ ago

      Ah yea. Idk why I said leaked since it was published that way. Nice call out!

      source
• qaz@lemmy.world ⁨1⁩ ⁨month⁩ ago

  Here’s a POC of the exploit in action:

  This video has been removed for violating the YouTube TOS

  source

  • pHr34kY@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Sharing a video about a Google security vulnerability on Google’s own platform. What would you expect?

    source

    • qaz@lemmy.world ⁨1⁩ ⁨month⁩ ago

      They did disclose it to Google before, and got a bounty but it seems the moderators from YouTube didn’t get the memo

      source
• tja@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

  So… Google Mail will not show me emails if their title is 2.5 million letters long? Pathetic

  source
• funkajunk@lemm.ee ⁨1⁩ ⁨month⁩ ago

  Fun read

  source
• Dil@is.hardlywork.ing ⁨1⁩ ⁨month⁩ ago

  This and some browsing of the public Facebook account will get you into most people accounts with minimal effort, social engineering is wild and made me lose interest in being a hacker growing up because it was too easy and made me uncomfortable. (I wanted to be mr robot so bad, I was delusional lol)

  source

  • Maiq@lemy.lol ⁨1⁩ ⁨month⁩ ago

    Remember back in the day when you could get apple users emails through a simple number incrimination in i believe the app store website?

    The documentary The Hacker Wars highlighted the issue and if i remember weev went to jail for it. I probably need to rematch it again.

    Also if people are interested in that kind of documentary The Internet’s Own Boy is a heartbreakingly excellent story of what the US put Allen Schwartz through.

    source
  • Dil@is.hardlywork.ing ⁨1⁩ ⁨month⁩ ago

    (This was when facebook contacts would/could get added to yahoo contacts or whatever? IDK I had 100s of emails in there)

    source
• afk_strats@lemmy.world ⁨1⁩ ⁨month⁩ ago

  It took them 147 days to fix this?!?

  source