Fake OBS Studio Hack Targeting YouTubers

  Рет қаралды 347,848

John Hammond

John Hammond

Жыл бұрын

j-h.io/snyk || Seriously huge THANK YOU to Snyk for sponsoring this video and their continued support of our channel all throughout 2022, and into the new year for 2023! Get started with Snyk FOR FREE ➡ j-h.io/snyk
🔥 KZfaq ALGORITHM ➡ Like, Comment, & Subscribe!
🙏 SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎 FOLLOW ME EVERYWHERE ➡ jh.live/discord ↔ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware

Пікірлер: 914
@StrokeMahEgo
@StrokeMahEgo Жыл бұрын
A few minor points: 1. The S in OBS stands for Software. 2. Always ignore all "ad" results on Google. 3. Always scroll down to actual search results. 4. Report ads that are sketchy.
@Hardcore_Remixer
@Hardcore_Remixer Жыл бұрын
Skip the 2, 3 and 4 by using an ad block extension or a browser which comes with an ad block.
@cristiandobrin5576
@cristiandobrin5576 Жыл бұрын
i always do this to be safe
@tammytheranger7645
@tammytheranger7645 Жыл бұрын
5. Notify OBS about this
@bigjoegamer
@bigjoegamer Жыл бұрын
@@Hardcore_Remixer To be more specific, use Ublock Origin.
@dark258
@dark258 Жыл бұрын
@AwesomeAnikin3279 They're doing it wrong :)
@DiamondSaberYT
@DiamondSaberYT Жыл бұрын
Actually it’s a big issue. Yesterday I was helping my family member install OBS, and as they googled OBS, the fake advertisements have occupied the whole view. We had scroll through at least 3 fake ads before we got the actual obsproject website. Google should definitely make a human ad verification, or improve their algorithms so they’d first scan the website before promoting it.
@moth.monster
@moth.monster Жыл бұрын
But they get paid by the malware! So why would they care?
@DaxyGamer
@DaxyGamer Жыл бұрын
@@moth.monster right that's why mobile game ads on youtube are always clickbait
@Theunicorn2012
@Theunicorn2012 Жыл бұрын
Actually it's a big issue. Yesterday I was helping my family member install OBS, and as they googled OBS, the fake advertisements have occupied the whole view. We had scroll through at least 3 fake ads before we got the actual obsproject website. Google should definitely make a human ad verification, or improve their algorithms so they'd first scan the website before promoting it.
@turtletastic.
@turtletastic. Жыл бұрын
@@Theunicorn2012 shut up
@tobeannounced_TBAEAS
@tobeannounced_TBAEAS Жыл бұрын
@@Carahato Mafia City mobile ads be like:
@aprilnya
@aprilnya Жыл бұрын
this is why people should have adblock. not just to not see ads but also for security. so many ads are scams or malware or that kinda stuff
@Theunicorn2012
@Theunicorn2012 Жыл бұрын
this is why people should have adblock. not just to not see ada but also for security. so many ads are scams or malware or that kinda stuff
@Josuh
@Josuh Жыл бұрын
@@Theunicorn2012 cant even type properly
@timrichter1980
@timrichter1980 Жыл бұрын
Until adblock is hacked itself
@chiefhydropolis
@chiefhydropolis Жыл бұрын
@@Theunicorn2012 this is why people should have adblock. not just to not see ada but also for security. so many ads are scams or malware or that kinda stuff
@TheShottyBoys
@TheShottyBoys Жыл бұрын
Guess what guys.. this is why people should have adblock. not just to not see ads but also for security. so many ads are scams or malware or that kinda stuff
@grunner7557
@grunner7557 Жыл бұрын
If Google is pushing these kinds of ads, I feel like that should be ground for a class action lawsuit.
@TuberoseKisser
@TuberoseKisser Жыл бұрын
I don't think they can vet every single ad.
@grunner7557
@grunner7557 Жыл бұрын
@@TuberoseKisser The largest search engine company. With literal billions of dollars at its disposal. With some of the most tech savvy employees in the world. Can't find a way to vet ads that THEY approve for their search engine. Yeah. And I'm the king of England.
@OneCSeven
@OneCSeven Жыл бұрын
@@TuberoseKisser they could if they wanted to, but it would be expensive so they will never do it. there's no "can" about it, only "won't".
@ulize.
@ulize. Жыл бұрын
@@OneCSeven they already have human verification, just they aren't paid anything so they don't really care
@ansel569
@ansel569 Жыл бұрын
I'm sure there's something in their end user agreement that they are not responsible for this sort of thing.
@NoodlyPanda
@NoodlyPanda Жыл бұрын
I remember one time Forbes ran an article about how ads were spreading malware, but insisted you turn off your adblocker to read the page/article only for their ads to also infect your computer with malware xD And some people wonder why adblock is required to viewing the web.
@lorekeeper685
@lorekeeper685 Жыл бұрын
ı use to not use itbut after using it hard to turn off cause stuff just euns better
@NoodlyPanda
@NoodlyPanda Жыл бұрын
@@lorekeeper685 Even though I'm on Opera GX I still use Adbloock, the browsers free VPN and the browsers adblock built in.
@lorekeeper685
@lorekeeper685 Жыл бұрын
@@NoodlyPanda I don't use opera not sure if it's good
@NoodlyPanda
@NoodlyPanda Жыл бұрын
@@lorekeeper685 It's actually really good. It's chromium based, but it's got all these extra built in features like a free VPN, RGX which does wonders on video and images, can control how much processor power and RAM the browser uses and integrates with different social media in a sidebar. Loads of other stuff. I highly recommend it.
@lorekeeper685
@lorekeeper685 Жыл бұрын
@@NoodlyPanda okay can you dumb it down for me What's RGX And how would the otter options effect me not much tech savvy and from turkey where info of such are either very limited or dubious
@kristiannanista4541
@kristiannanista4541 Жыл бұрын
Man we're going to need verified checkmarks on websites now 💀
@m9ddie
@m9ddie Жыл бұрын
LMFAOO
@borischafadarov7007
@borischafadarov7007 Жыл бұрын
Yes please
@mus0797
@mus0797 Жыл бұрын
You can by using McAfee plugin in browser
@user-yt4rs7ig1i
@user-yt4rs7ig1i Жыл бұрын
just check the url, it’s that easy
@cobaltdev
@cobaltdev Жыл бұрын
its not like this EXISTS
@yarr0
@yarr0 Жыл бұрын
Thank you for the PSA! Everyone should report fake ads every time they see them. Click the 3 dots next to the result to report.
@AwkwardTruths
@AwkwardTruths Жыл бұрын
KZfaq has gotten worse in vetting their advertisers. I've reported the same ad (an ad claiming that a fruit will 'kill' diabetes) numerous times and I still see it AND it's the same advertiser.
@kevinwong_2016
@kevinwong_2016 Жыл бұрын
Or the straight up virus links they host
@IamKyuTee
@IamKyuTee Жыл бұрын
This is why Google should investigate each ad and not let ads be visible to the public but visible to the advertiser as if it is while they check it. Also making sure they have tge actual purchaser by having a video chat with them holding up their picture ID and the registered business license in the country it is registered. It would stop a lot of this crap with that done. Also their ID address and the location of their ip address being at least same city and country.
@delayedplayer
@delayedplayer Жыл бұрын
This sounds insanely useful to put in place
@IamKyuTee
@IamKyuTee Жыл бұрын
@@delayedplayer Thing is anything really useful for the public seems beyond the capabilities ofvGoogke since I even told them the same thing about the scam video bads we fet in KZfaq. Having told them the exact idea over 10myears ago and several times a year is like talking to a wall built of dung. Yes I said a wall of dung since Google is a pike of crap at protecting the public against hackers abd scampers with their ads. In the end it proves Goigle is a profit Whore onky.
@candyrushsweetest
@candyrushsweetest Жыл бұрын
Agreed.
@mu11668B
@mu11668B Жыл бұрын
I am still surprised how Discord always chose to stay with profit after so many warnings from the industry saying they should block their CDN access from unauthorized connections to prevent payload hosting.
@DataLux-iq5fl
@DataLux-iq5fl Жыл бұрын
sounds like there partaking in Dark Patterns to me, no way there not aware of the issue
@balllord3546
@balllord3546 Жыл бұрын
true. should require a discord authorization token to download files from cdn
@mu11668B
@mu11668B Жыл бұрын
@@balllord3546 Exactly. I made a post on the Discord subreddit pitching the same suggestion. Turned out they probably couldn't care less.
@HeidenLam
@HeidenLam Жыл бұрын
Says a lot about Discord as a company
@Theunicorn2012
@Theunicorn2012 Жыл бұрын
I am still surprised how Discord always chose to stay with profit after so many warnings from the industry saying they should block their CDN access from unauthorized connections to prevent payload hosting.
@TheMAZZTer
@TheMAZZTer Жыл бұрын
It's worth noting malware authors will absolutely take steps to ensure the common AVs don't detect their stuff (they can run scans all day and tweak their malware until it's not detected) so it's not surprising Windows Defender didn't detect it. (You did go into it a bit with the mention of file padding,) All the extra files in the ZIP could be part of this attempt, though I'm not sure how it would affect things. Or it could be an attempt to randomize the hash of the file for whatever reason .
@Theunicorn2012
@Theunicorn2012 Жыл бұрын
It's worth nothing malware authors will absolutely take steps to ensure the common AVs don't detect their stuff (they can run scans all day and tweak their malware until it's not detected) so it's not surprising Windows Defender didn't detect it. (You did go into it a bit witn the mention of flie padding,) All the extra flies in the ZIP could be a part of this attempt, though l'm not surw how it would affect things. Or it could be an attempt to randomize the hash of the file for whatever reason .
@UltimatePerfection
@UltimatePerfection Жыл бұрын
It should also be noted that AVs cannot scan passworded ZIPs or RARs - if you come across a passworded rar or zip with person who posted it publicly telling what the password is (or telling you in email with passworded zip attachment), the password is there for the virus to avoid detection. Don't open it under any circumstances.
@payaso216
@payaso216 Жыл бұрын
@@Theunicorn2012 Actual bot
@THRE3KINGZStudios3kz
@THRE3KINGZStudios3kz Жыл бұрын
We needed this video… Beginners who wants to start streaming on Twitch needs to be aware.
@coolchannel9286
@coolchannel9286 Жыл бұрын
good thing i got the steam ver
@xXInfinityAuraXx
@xXInfinityAuraXx Жыл бұрын
@@coolchannel9286 same here
@yspegel
@yspegel Жыл бұрын
This problem is as old as internet its self, never search for the word "download". This always was a major problem with getting drivers. Search for the brand you need, then search for support/download once you are sure you're on the official page.
@xenogaming9173
@xenogaming9173 Жыл бұрын
Google has been doing things like this for years. Not just OBS, but anything you type in with an AD slap next to it. Sometimes comes out as a scam, so don't be surprised that you're dealing with a scammer problem.
@emocatte
@emocatte Жыл бұрын
This isnt the only thing. This happened wth MSI a few weeks ago. Google ad was promoting a fake MSI afterburner that I actually ended up falling for- and it was promoting THREE of them. The top 3 links were all slightly different websites but absolute 1:1 clone with the actual one.
@JumbleDrops
@JumbleDrops Жыл бұрын
I thinks its scary that it is that easy to just tell windows not to scan a certain file
@majoryoshi
@majoryoshi Жыл бұрын
if winget became remotely more common then this would be a complete nonissue.
@meat2648
@meat2648 Жыл бұрын
The fact that windows has a (sort of?) functional package manager built in is nuts and I'm shocked that nobody ever talks about it.
@DataLux-iq5fl
@DataLux-iq5fl Жыл бұрын
@@meat2648 right lol not even going to lie doing research on it now
@DataLux-iq5fl
@DataLux-iq5fl Жыл бұрын
oh, ok i got it just so used to file explorer lol
@notyoursurya
@notyoursurya Жыл бұрын
But sometimes it's a real pain writing AuthorName.PackageName Like, why can't you be like apt, rpm, npm ... 😒
@DataLux-iq5fl
@DataLux-iq5fl Жыл бұрын
@@notyoursurya Right
@CybersFutures
@CybersFutures Жыл бұрын
I have to say I have loved this channel for a while and their is always something new to explore, keep up the great work. And please do more malware analysis
@AdamCysec
@AdamCysec Жыл бұрын
Ive also noticed an uptick in malicious ads being promoted by Google/KZfaq.
@thomas-media
@thomas-media Жыл бұрын
I fell for the fake installer with help of google ads. No windows defender warnings before or after the installation what so ever. I was even more shocked how unsuspicious the program seemed. After I installed it, I already recognised that something was odd. But no suspicious tasks were found in the task manager. I decided to reinstall windows but I wanted to do it a day later because I had something to finish. A few hours later after I abandoned my PC without me sitting infront of it I suddenly became the message on my phone that my facebook account was locked because of violation of community standards. I immediately reinstalled windows and tried to get my fb account back. After it was unlocked two days later facebook showed me what happened. The malware magically posted ISIS photos and people with guns on my profile. But locally on my own PC. Immediately changed all passwords...
@boogieman97
@boogieman97 Жыл бұрын
The dots are represented as null bytes which means it is already utf16-le encoded since it is for Windows. Decoding to utf8 will remove the null bytes
@brighthades5968
@brighthades5968 Жыл бұрын
@@zfutox7224 the comment got removed but you replied so it shows the number
@zfutox7224
@zfutox7224 Жыл бұрын
@@brighthades5968 I removed it
@Theunicorn2012
@Theunicorn2012 Жыл бұрын
The dots are represented as null bytes which means it is already utf16-le encoded since it is for Windows. Decoding to utf8 will remove the null bytes
@boogieman97
@boogieman97 Жыл бұрын
@John Hammond, why there are so many fake comments replying on your KZfaq videos with weird telephone numbers ? Have you been pwned yourself ?
@bitelaserkhalif
@bitelaserkhalif Жыл бұрын
@@boogieman97 bots. I called it cirno bots because they're using same number sets with cirno
@meistroldcontent
@meistroldcontent Жыл бұрын
Those random files in the about folder are used to change the hash of the zip folder. Since those files can be anything, the web server can dynamically change the hash of the zip folder every time by editing the binary data of the zip file.
@StrokeMahEgo
@StrokeMahEgo Жыл бұрын
Seems like a half baked attempt to bypass AV signatures, even though most modern products are going to unpack the zip and signature the contents as well.
@peterz2352
@peterz2352 Жыл бұрын
Thanks for this elaborate evaluation! Very informative and this is a big issue indeed. I immediately informed (warned) my stepson since he and his high school friend use OBS for different projects as well as their bands' YT channel.
@SnakeEyesdiceroll
@SnakeEyesdiceroll Жыл бұрын
This happened with the AMD Radeon optimisation pack. Whenever someone downloaded it, it would download the SearchEsmia virus on your PC which is an aggressive browser hijacking malware. This happened to my other friend a few weeks ago. Virus type : Trojan
@DrMxy
@DrMxy Жыл бұрын
Don't know how anyone can use the Internet without an adblocker these days
@DarkFaken
@DarkFaken Жыл бұрын
Seeing you utilise anyrun sandbox to manually download and install the malware was mind blowing! I'd never thought of this for the 100mb issue! Thanks for sharing
@Cyborger1
@Cyborger1 Жыл бұрын
I recon when selecting the file to run in the sandbox, you could just give it a powershell script to grab and extract the file automatically from the known malicious URL (or a self-hosted ftp server if the download is no longer available).
@HidekoYamamoto94
@HidekoYamamoto94 Жыл бұрын
Anyrun does have the possibility to create a task with an URL file too - instead of uploading a file you can see it at 11:26
@BalloonFN
@BalloonFN Жыл бұрын
I think I should just say, I first saw this video when I was first using my brand new computer. The first day. I was installing all my essential apps and saw this video RIGHT before I downloaded the fake OBS. Thank you so much bro ♥️
@PolloCraft20_FIMF
@PolloCraft20_FIMF Жыл бұрын
Thank you very much for notifying us, we will take this into account to avoid piracy in this matter since it affects many viruses that aggressively steal information
@NytroDesigns
@NytroDesigns Жыл бұрын
This is another thing that's happening with Blender. I don't actually use Google myself, but I saw on the subreddit, people were talking about how there was a fake website promoted via ads
@konfushon
@konfushon Жыл бұрын
the transmission mechanism of the malware kind of reminds me of the Gootloader malware which used some SEO poisoning to gets itself to as many users as possible
@DimkaTsv
@DimkaTsv Жыл бұрын
I wonder what was that .exe that installer dropped into Roaming folder and set as autorun in registry. Also want to see, if that link on desktop lead to that C://strange_folder for proxy .exe that runs stealer and then opens up C://ProgramFiles/OBS Studio/obs_x64.exe Or how is original executable called...
@DataLux-iq5fl
@DataLux-iq5fl Жыл бұрын
@@DimkaTsv all above are great leads
@nordgaren2358
@nordgaren2358 Жыл бұрын
@@DimkaTsv I have looked into it a bit. They must have been swapping this file out often, as the hash I got for the zip was different than the ones Muta and John got. They must have really been swapping these binaries out quickly, as I downloaded mine a few hours before John did. It's a few layers of packed malware, eventually had to unpack it with a unpac.me. I think the `C:\Users\admin\AppData\Roaming\Hpyjpn\Ogtnuzcwp.exe ` file in Johns download is probably my `Bllfgyszs.exe`, and that exe is loads another binary into memory, and I know that one has the string to call to set the exception for the `C:/` drive. There is also a Test.exe, which I suspect has the main payload (I have confirmed it is the binary that calls out to eth0), but I am not sure where the persistence is, yet.
@DimkaTsv
@DimkaTsv Жыл бұрын
@@nordgaren2358 chain calling from somewhere based on registry entry?
@nordgaren2358
@nordgaren2358 Жыл бұрын
@@DimkaTsv like chain calling each stage? The packing program they used is what's calling each exe, afaict.
@TheInternetHelpdeskPlays
@TheInternetHelpdeskPlays Жыл бұрын
Absolutely fascinating. Thank you for that.
@Skippyxlxlxl
@Skippyxlxlxl Жыл бұрын
Yeah, ads on google are a massive problem because it puts it as the first link most of the time, so it really sucks because I remember when I was 12, I went to watch youtube, and I was bombarded with "beautiful ads" and got in trouble for a while until I explained what happened.
@bbelsito
@bbelsito Жыл бұрын
Never thought I'd hear muta mentioned in John's videos 😄 Nice surprise as an enjoyer of both your channels
@DataLux-iq5fl
@DataLux-iq5fl Жыл бұрын
Both are Awsome Content Creators !
@svenkund234
@svenkund234 Жыл бұрын
Just a comment for the algorithm ;) Great video like always :) And I found my first exploit (persistent XSS) in a probably really unknown (but important) software today and was able to report it (it should be fixed soon). Thanks for helping me achieve this with your interesting and informational videos, you are a big part of my journey in Cyber Security. Even though I am only a learnt electric engineer currently working in IT with Scada Systems. I would love to hear some of your thoughts about OT and especially Scada security. Sadly there is not a lot of information available about this topic currently but with more and more merging of OT and IT I think it is getting more and more important to have skilled people in this field for example to protect our critical infrastructure. That is why I want to go that route. Thank you for the inspiration.
@shuttlecrab
@shuttlecrab Жыл бұрын
Jeezos, the bots be botting in these comments, damn! Great video, John. Keep up the great work
@-_-_-_-_-_-_-_-_-_-_-_-_-_-ucq
@-_-_-_-_-_-_-_-_-_-_-_-_-_-ucq Жыл бұрын
I'm so glad I always have adblockers on so I don't see any ads like these malicious stuff
@kiea
@kiea Жыл бұрын
Google needs to face justice for scams
@sjcdmill
@sjcdmill Жыл бұрын
This hit near home. I installed OBS on the 29th and I know I googled for it first.. After some panic I viewed my site history, and I see it appears I went to the correct site. I tend to naturally avoid Ads for reasons like this but but I was not sure. I also downloaded the file again from the legit site and compared it's hash to my previously downloaded version then threw my original file in virus total too for good measure. Looks like I dodged a bullet this time.
@thenickstrikebetter
@thenickstrikebetter Жыл бұрын
Yeah ima check it myself. Do you know what to do if you download the wrong one (just in case)?
@CarlosXPhone
@CarlosXPhone Жыл бұрын
​@@thenickstrikebetter Uninstall the old one, and reinstall but with the official version. Always get it from the source.
@thenickstrikebetter
@thenickstrikebetter Жыл бұрын
@@CarlosXPhone thanks. I think I did it right the first time tho.
@CarlosXPhone
@CarlosXPhone Жыл бұрын
@@thenickstrikebetter i assume you downloaded from the official obsproject website. If so, you're good. This video assumes you clicked on a Google search, thinking its the official obs link. There are official programs (projects) that has "mirrors" of their official downloads, in that case... as LONG as you WERE on the official website, you downloaded the source file.
@thenickstrikebetter
@thenickstrikebetter Жыл бұрын
@@CarlosXPhone Before I checked, I was more worried that by trying to avoid the scam ads, I had accidentally skipped the real OBS and downloaded the fake one. Shortly after I made my original comment, I checked as best as I could. I think I'm fine.
@KeritechElectronics
@KeritechElectronics Жыл бұрын
Thanks a lot for bringing this up! Who would have thought... Damn scammers - and social engineering done pretty right, to be honest. GNU/Linux users are at an advantage here, unless the version in the repository is bugged.
@cromfrein5834
@cromfrein5834 Жыл бұрын
We're at even more of an advantage if we install a package that specifically builds it on our system, though flatpak solves most security issues at the cost of easy one-click theming.
@hopemoore
@hopemoore Жыл бұрын
That happened with Blender this year, too - right when I was in a rush and sleep deprived. Learned how to remove some malware from that experience. Anti-virus and other things didn't pick up on it - I even stopped it part way because it tried to mount a drive instead of just install. It was enough to still make it hard to remove everything, even after a full restore. It ended up being malware that tries to find crypto wallet info.
@wilvemoon
@wilvemoon Жыл бұрын
Can I ask you how do I know if I downloaded the righ thing instead of the fake one, I need some help😅
@hopemoore
@hopemoore Жыл бұрын
@@wilvemoon the malware I downloaded required a drive to be mounted as part of an install - the real version does not need that.
@SnowMexicann
@SnowMexicann Жыл бұрын
@@wilvemoon Go on your history and make sure its the right link, make sure everything is spelt correctly, you didnt click on an ad and run it through an antivirus and smn like virustotal.
@wilvemoon
@wilvemoon Жыл бұрын
@@SnowMexicann thank you!
@shredVFZ
@shredVFZ Жыл бұрын
Hey I didn't even know there is thing such as online malware analysis services. Thanks for video =)
@Johan-iw6mb
@Johan-iw6mb Жыл бұрын
Very good information, thanks for sharing.
@salmon85
@salmon85 Жыл бұрын
nice, this is one of the reasons I never use the ad links
@ChrisMowers
@ChrisMowers Жыл бұрын
admx files are group policy templates. Mainly used by enterprise/corp system admins, to configure a pc to meet the company requirements, but can be applied to any computer through GPEdit. Im wondering if the install is doing something with those
@razorwolf2758
@razorwolf2758 Жыл бұрын
This is why I never press the top picks, usually they are ads for scams
@tonyswu
@tonyswu Жыл бұрын
I've seen this with other websites / software too. There was one for Microsoft Office 365 not too long ago. I am extremely careful now when using search engine to avoid all advertisement links.
@adamstechroom8707
@adamstechroom8707 Жыл бұрын
not a fan of some ordinary gamers because he posted my command on twitter just to make a fool of me and i use to support him and even watch his videos so he does that to his viewers, his viewers then goes on to my personal business to say awful stuff about me all because of ordinary gamers
@DaxyGamer
@DaxyGamer Жыл бұрын
simply put twitter is a foolish social media
@adamstechroom8707
@adamstechroom8707 Жыл бұрын
@@DaxyGamer not the point ordinary gamers is a two face.... as someone who been supporting the goof and then he tries to make me look like a fool in front of all his viewers and supporters is not cool, one day it will come out about him. karma will get him one day :)
@GKhagah
@GKhagah Жыл бұрын
The ability for bad actors to use google ads for neffarious things is rediculous. First streamlabs using it to redirct traffic for commercial gains and now literally malware.
@LouisSerieusement
@LouisSerieusement Жыл бұрын
fantastic work thanks !
@theDane70
@theDane70 Жыл бұрын
Great subject, thanks...
@MaximeClasse
@MaximeClasse Жыл бұрын
I had been hacked by my KZfaq channel and I managed to recover it but it was because of obs studio that I was hacked on January 3. we must be careful or software that or uses on our google account.
@charliebudgie8358
@charliebudgie8358 Жыл бұрын
the fact that john plays scarlet instead of violet is the reason i'm subscribed to him
@_JohnHammond
@_JohnHammond Жыл бұрын
koraidon gang rise up
@sekinVR
@sekinVR Жыл бұрын
Thanks for catching this guys
@hamzarashid7579
@hamzarashid7579 Жыл бұрын
Thanks, John you keep me and thousands of people safe.
@biigsmokee
@biigsmokee Жыл бұрын
so you see an "about" folder with a bunch of .admx files (group policies) and brushed over them as "junk". nice work
@gooniesfan7911
@gooniesfan7911 Жыл бұрын
youtube "professional" content creators 😆
@stupidoldgamer
@stupidoldgamer Жыл бұрын
Those ADMX files look like windows policy files. The fact they are in the about folder screams get this crap off your machine. I'm guessing they are run by the installer so they can set the windows policies to aid the person wanting access to your rig. If you don't run as admin and have windows UAC enabled on any settings changes this installer won't be able to work.
@musicpicker
@musicpicker Жыл бұрын
Ive always had a gut feeling when it came to not clicking the ads, i always made sure to click the proper link, and this is the reason why
@Pippa015
@Pippa015 Жыл бұрын
I nearly downloaded this... So glad I noticed just on time.
@Rexzafi
@Rexzafi Жыл бұрын
Tip: always download OBS on the official OBS site to avoid malware like this
@IAmE9030
@IAmE9030 Жыл бұрын
That's not a tip
@kngames7746
@kngames7746 Жыл бұрын
not useful tips 101
@Rexzafi
@Rexzafi Жыл бұрын
I don’t download software through an ad
@danaraprapanca1856
@danaraprapanca1856 Жыл бұрын
No shit, dude lol
@RealStormfury
@RealStormfury Жыл бұрын
I'm slightly worried for myself, recently I downloaded OBS and I'm hoping I did go to the correct website. I'm not so intelligent with computers yet and I had no idea this was going around when I installed it. I just really hope my past self used his intuition and not destroy my PC only a month after I got it.
@pishposh798
@pishposh798 Жыл бұрын
same i did the same thing i almost downloaded it from the same sight you can know if your obs was in a zip then its the virus one but if its the exe without the zip then your good
@_Underscore_
@_Underscore_ Жыл бұрын
check your browsing history (and your download history)
@SnowMexicann
@SnowMexicann Жыл бұрын
All you have to do is check the website name, if it has bad spelling thats a big red flag, also check that it isnt an ad. If it clears those two then youll be fine. Also dont install shady shit.
@RealStormfury
@RealStormfury Жыл бұрын
@@_Underscore_ Sadly can't, at one point I cleared cache (and I guess indirectly cleared search history) because of a streaming service website broke and I had to do that.
@RealStormfury
@RealStormfury Жыл бұрын
@@SnowMexicann Yeah, now I'm more aware. Back then (like 2 or more weeks ago) I was unaware and unsure if I downloaded the correct one, I feel like I did but have slight doubts.
@A-lik
@A-lik Жыл бұрын
...I just downloaded OBS this weekend to try and start my dream of becoming a content creator. Thank you for justifying my ironic paranoia of all things online. (Thankfully I found the OBSproject URL first, but even then I was hesitant without even knowing about this fiasco.)
@musicboi9014
@musicboi9014 Жыл бұрын
I love your content!
@Soundwaiv
@Soundwaiv Жыл бұрын
Ohh.. I saw this when trying to reinstall OBS, I thought it was a real website! I almost downloaded it but I looked closely. If you noticed, there's a difference between the actual OBS website and the scam one-- it uses a different font. The normal OBS website uses Open Sans in all parts, whereas the scam website (that I saw) used Verdana. I was lucky to spot this, or I would have downloaded the malware probably...😢
@vectar
@vectar Жыл бұрын
Hi John! What OS/distro do you run on whatever your personal laptop/pc is? Like just your everyday system you use at home or w/e. Amazing channel and content!
@captainT0ad
@captainT0ad Жыл бұрын
windows, something around 10
@RJayz1002
@RJayz1002 Жыл бұрын
This is exactly what happened to me, I hope this does not affect anyone else that badly.
@honahwikeepa2115
@honahwikeepa2115 Жыл бұрын
Thank you brother
@kingdedede7
@kingdedede7 Жыл бұрын
Glad I installed OBS from the Steam store instead from the Internet otherwise my pc would be in danger.
@muskafella
@muskafella Жыл бұрын
I work in IT and I enjoy these videos. Great work!
@spanishdexter
@spanishdexter Жыл бұрын
The ADMX files are group policy templates for Active Directory. Interesting they randomly included those.
@Fate025
@Fate025 Жыл бұрын
This happened to me when I tried to download and reinstall VLC media player as well. A popular open source video/media player. The top result was a google ads result that directed me to a spoof website that wasn't the original VLC website. I recognised the URL quickly enough and didn't enter it, but I could see how unsuspecting, first time users could be duped into downloading and installing malware.
@userhandler0tten351
@userhandler0tten351 Жыл бұрын
When you realize that all the software hoarding your friends make fun of you for is actually based.
@DarkReaper1053
@DarkReaper1053 Жыл бұрын
I always do that too. Not just for security in knowing it's a good exe without any funny business, but also what if the original link is shut down and the software is no longer accessible? I've had that happen in a few cases, and having the setup file backed up has saved my bacon.
@pabblo1
@pabblo1 Жыл бұрын
@@DarkReaper1053 Same, I've hoarded a bunch of old Minecraft mods that would've become lost (or hard to find) otherwise.
@maikeru6158
@maikeru6158 Жыл бұрын
Data hoarding is very based indeed. Also seeding torrents
@dim_mek
@dim_mek Жыл бұрын
i get deep down and suspect how they hosted it and i found it..... its Ubuntu server apache server look at the 404 page it tells u its apache server but the real one have its own 404 page ... so its server running linod or home server check it and try it to brute fore the server(ssh)
@NoportOfbot
@NoportOfbot Жыл бұрын
Good to be up to date
@marcelahernandez369
@marcelahernandez369 Жыл бұрын
I recently switched from Xsplit to OBS and i also had this issue where I came across a fake OBS website. I never even clicked on it, i just immediately found it suspicious that so many websites allowed you to download OBS. So I went straight to their official twitter page to find the official website lol
@Sparks621
@Sparks621 Жыл бұрын
I just reported about 30 crypto scam/spam comments under this video and I encourage everyone else watching to do the same. You might wanna add the name of the scam to a comment blacklist.
@georgesiere161
@georgesiere161 Жыл бұрын
Oh, just great. Any tips on quickly determining if the OBS studio I downloaded and installed is the malicious variant? Does the malware version function as expected?
@nordgaren2358
@nordgaren2358 Жыл бұрын
The malicious one just installs regular OBS. It embeds the regular installer into the fale exe, and launches it. I'll look a bit deeper and see if there's something to look for. Idk if John went that deep in the video yet, as I haven't watched it (I was looking at this malware with him last night, so I know what it is)
@nordgaren2358
@nordgaren2358 Жыл бұрын
Do you have your original exe or your browser history to look at? The malware version comes as a zip, but OBS is just an exe download.
@DataLux-iq5fl
@DataLux-iq5fl Жыл бұрын
yeah just compare file sizes from your installed binay and the one from the original source, thats the fastest way
@DataLux-iq5fl
@DataLux-iq5fl Жыл бұрын
@@nordgaren2358 might suggest to look for .dll swapping or process hollowing,
@nordgaren2358
@nordgaren2358 Жыл бұрын
@@DataLux-iq5fl well, the installed OBS is just OBS. The installer, however, is a much bigger file and comes in a zip with an About folder. So if you have that, it's something to look at. Can also look for some of the filepaths in this video, incase the loader didn't delete them! Also check if your antivirus has an exclusion for the C drive.
@livefreeprintguns
@livefreeprintguns Жыл бұрын
Any Run allows you to create a new task with an external link to a program that it will automatically grab from the web and place into the VM before you are presented with the GUI.
@vettel5346
@vettel5346 Жыл бұрын
Thank you for the video! I will be more carefuel after this, because when I want to download something I always check if the site has been certificated, and the malicious website has been as well. I'm actually angry that they were able to certificate the site, but I'm also curious about how were they able to do that.. -Take care everybody!
@Arukateru
@Arukateru Жыл бұрын
Anyone can get an SSL certificate. It doesn't mean the website is trusted, it only means that data sent and recieved from it is encrypted in transit.
@gabrielandy9272
@gabrielandy9272 Жыл бұрын
certified websites just means the browser could verify and make sure the data is going only to the owner of that website, however it does nothing to make sure the data of that website is not malicious.
@Coffreek
@Coffreek Жыл бұрын
Maybe John's next video should be on this crypto clown who's spamming the comments? It would be a nice clapback.
@DataLux-iq5fl
@DataLux-iq5fl Жыл бұрын
@John Hammond This is a great idea when you have your next spare time
@Luted09
@Luted09 10 ай бұрын
ADMX files are XML-based files that provide registry-based settings to the Group Policy Editor. aka its directly attacking the system registry
@RJARRRPCGP
@RJARRRPCGP Жыл бұрын
A name like that has my mal-site senses tingling!
@kevinlopez3414
@kevinlopez3414 Жыл бұрын
I love that John knows about Mutahar ❤
@sanja909
@sanja909 Жыл бұрын
Thanks !
@html.g0ld3n27
@html.g0ld3n27 Жыл бұрын
I found actually a decent method to not get caught in these situations. If possible, go to any of the OFFICIAL project/business etc. social media and, most likely but probably not appliable to every single one of them, they will have the original website linked on their profile.
@skore9975
@skore9975 Жыл бұрын
Now that anyone can buy a checkmark on Twitter, even that is somewhat risky
@html.g0ld3n27
@html.g0ld3n27 Жыл бұрын
@@skore9975 but there's a way to see if it's bought or not, isn't there? Like, click on the checkmark and It shows If it's bought or If It was actually achieved or granted bcs It's an official organization.
@xntumrfo9ivrnwf
@xntumrfo9ivrnwf Жыл бұрын
John, this almost happened to me recently but with a financial app (TradingView). I was on another PC and wanted to quickly check a price chart - googling Tradingview and clicking on the 1st result gave a copy of the official page. A download started immediately but fortunately I got suspicious before opening anything
@yourstereotypicalnerd
@yourstereotypicalnerd Жыл бұрын
The thumbnail scared the hell out of me
@ArSiddharth
@ArSiddharth Жыл бұрын
Nice video!
@novanightmare6289
@novanightmare6289 Жыл бұрын
ADMX / ADML are group policy setting files, so it is likely if you install this, it will change a bunch of your system settings based on the templates that are there.
@concordolindavdd
@concordolindavdd Жыл бұрын
same happened to me, but with GIMP. Be careful with that one too
@Noah_Callahan
@Noah_Callahan Жыл бұрын
This happened to me once. I clicked on the first Walmart and it lead me to a scam website saying my computer was hacked. It wasn’t actually hacked, but still annoying.
@shayanhj6236
@shayanhj6236 Жыл бұрын
please do this with TLauncher as well
@MrYossarianuk
@MrYossarianuk Жыл бұрын
Good example why Linux has far better software management. You download from a centralised (verified) repository rather than downloading random links off the web.
@cloud_s_97
@cloud_s_97 Жыл бұрын
that same thing happened to rufus (a tool for making a bootable usb drive for any iso file)
@yizesus
@yizesus Жыл бұрын
I recently fell into this kind of ads by notepad++, the website is completely identical but I found out after I install so I'm good!
@gekinatracksuit9710
@gekinatracksuit9710 Жыл бұрын
1:19 that's a pretty cool way to say virtual machine
@Fearagen
@Fearagen Жыл бұрын
I tried searching "obs download" myself on my signed in browser session and an InPrivate window tab but it seems the ad was reported enough that it got taken off the search.
@toreopp
@toreopp Жыл бұрын
I was hit with a fake obs on top of google results weeks ago, so they have been active a while. I noticed after clicking the installer that cmd window and weird stuff popped up and background processes that was not normal. I then proceeded to reinstall Windows...
@EshaanMasterMusic
@EshaanMasterMusic Жыл бұрын
me and my friend actually saw that there was a fake obs and we reported it, and it disapeared afterwards almost instantly.
@thestoryof4__501
@thestoryof4__501 Жыл бұрын
omg this happened to me in October 2022 :( the hackers went on both of my youtube accounts and posted photoshop videos to phish my subscribers.. and also during the weeks i’ve been seeing how they been trying to login to my paypal and venmo and stuff so i had to change all of my passwords and emails :(
@maikeru6158
@maikeru6158 Жыл бұрын
That’s why package managers are so great
Finding WEIRD Devices on the Public Internet
27:48
John Hammond
Рет қаралды 219 М.
Become a Certified Penetration Tester with HackTheBox CPTS!
16:25
John Hammond
Рет қаралды 99 М.
Chips evolution !! 😔😔
00:23
Tibo InShape
Рет қаралды 42 МЛН
The King Of Malware is Back
19:27
John Hammond
Рет қаралды 190 М.
The Malware that hacked Linus Tech Tips
10:13
The PC Security Channel
Рет қаралды 1,5 МЛН
Exploring Ransomware Builders
50:00
Cyber from the Frontlines
Рет қаралды 1,5 М.
How Hackers Write Malware & Evade Antivirus (Nim)
24:04
John Hammond
Рет қаралды 382 М.
Infiltrating Roblox’s Fake Middleman Scam
18:57
No Text To Speech
Рет қаралды 307 М.
catch EVERY reverse shell while hacking! (VILLAIN)
19:03
John Hammond
Рет қаралды 216 М.
Windows Defender vs Top 100 Malware Sites
10:15
The PC Security Channel
Рет қаралды 593 М.
My channel was hacked and I lost everything
16:31
GoHerping
Рет қаралды 158 М.
What Jumping Spiders Teach Us About Color
32:37
Veritasium
Рет қаралды 1,7 МЛН
Google Has a Serious Malware Problem...
24:43
SomeOrdinaryGamers
Рет қаралды 559 М.