Lucian Constantin
CSO Senior Writer

Hacker seizes Microsoft’s YouTube channel, removes videos

news
Oct 24, 20112 mins

Suspected hacker was possibly the account's previous owner before Microsoft officially claimed the account

Microsoft’s official YouTube channel was hijacked on Saturday and all videos hosted on it were temporarily removed. The hacker replaced them with others claiming that Microsoft is holding a contest.

“We are sponsoring” and “Make us a Background to Get Subbox!!!” were the titles of two rogue videos published by those responsible for the attack. Meanwhile, the channel’s description was modified to read “Wish to Become Sponsored? Message me.”

[ InfoWorld’s Windows expert leads you on a video tour of Windows 8. | Learn how to secure your Web browsers in InfoWorld’s “Web Browser Security Deep Dive” PDF guide. ]

One message posted by the alleged hacker provides an indication of what might have happened. “I DID NOTHING WRONG I SIMPLY SIGNED INTO MY ACCOUNT THAT I MADE IN 2006 :/” he said.

This suggests that the hijacker registered in the early days of the video-sharing website. The account was claimed by Microsoft, probably citing trademark reasons, but the original email retained access to it.

It’s not clear how this happened, but in 2008 YouTube started providing users with the option of linking their old accounts with their Google ones. This action became mandatory earlier this year and might have something to do with how the previous owner obtained access now.

If the user’s email address got linked with the Google Account used by Microsoft on YouTube, he might have gained the ability to perform a password reset. “If that’s true, then it’s a colossal foul-up by YouTube that may concern other well-known brands who have established presences on the video network,” warns Graham Cluley, a senior technology consultant at Sophos.

Microsoft didn’t comment about the method used to hijack its account, but has since regained control of it and restored the deleted videos. Meanwhile, the YouTube account of the user who claimed to be responsible has been terminated for violating community guidelines.

This incident comes after Sesame Street’s YouTube channel was hijacked and used to display adult videos last week. In order to avoid falling victim to such attacks, users should employ strong and unique passwords and review their Google accounts to make sure no unwanted email addresses have access to them.

Lucian Constantin

Lucian Constantin writes about information security, privacy, and data protection for CSO. Before joining CSO in 2019, Lucian was a freelance writer for VICE Motherboard, Security Boulevard, Forbes, and The New Stack. Earlier in his career, he was an information security correspondent for the IDG News Service and Information security news editor for Softpedia.

Before he became a journalist, Lucian worked as a system and network administrator. He enjoys attending security conferences and delving into interesting research papers. He lives and works in Romania.

You can reach him at lucian_constantin@foundryco.com or @lconstantin on X. For encrypted email, his PGP key's fingerprint is: 7A66 4901 5CDA 844E 8C6D 04D5 2BB4 6332 FC52 6D42

More from this author