Telegram Has Been Hacked

Рет қаралды 193,070

20 күн бұрын

Learn Cybersecurity - Name Your Price Training with John Hammond: nameyourpricetraining.com
📧JOIN MY NEWSLETTER ➡ jh.live/email
🙏SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎FOLLOW ME EVERYWHERE ➡ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/discord ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware
🔥KZfaq ALGORITHM ➡ Like, Comment, & Subscribe!

Пікірлер: 272

@KvapuJanjalia 18 күн бұрын

I'm not afraid of a calculator! Bring it on!

@cringemaki 18 күн бұрын

Everybody gangsta till the calculator app starts to ask permissions for camera, microphone and location 💀

@yukiplaysFr 18 күн бұрын

💀

@TobbeOakleaf 18 күн бұрын

Oh it will be problems! Count on it!

@BillAnt 18 күн бұрын

At 8:14 that evil laughter Muaahhh!! lol

@Raymi20- 18 күн бұрын

@@yukiplaysFr**salutes to the therian** Ma'am how can I help you ma'am

@ghoulbuster1 18 күн бұрын

TL;DR The exploit disguises as a fake video that when played executes python code, requires python to be installed for it to work.

@mushroommanny 7 күн бұрын

saved me about 10 mins bro ty

@why1851 18 күн бұрын

too much rce exploits bro 💀💀💀💀💀💀💀

@sunbleachedangel 18 күн бұрын

What are others?

@amaankhan8436 18 күн бұрын

Xz utils, rust, palo alto

@sunbleachedangel 18 күн бұрын

@@amaankhan8436 Palo alto?? My company uses that lul

@why1851 18 күн бұрын

@@sunbleachedangel there was a rust rce CVE-2024-24576, aint that effective though

@yipo1 18 күн бұрын

@amaankhan8436 xz is a backdoor not an rce vulnerability

@Spiderfffun 18 күн бұрын

RCE after RCE, I hope kids wont have to learn about the year of the vulnerabilities, 2024, in the future

@SLZeroArrow 18 күн бұрын

Thy Digital Apocalypse is drawing nearer by the day

@wildstorm74 18 күн бұрын

Defected by a typo as well.🤦 Talk about ebmassment.😒

@atomgutan8064 18 күн бұрын

This is literally cybersecurity history.

@TehPwnerer 18 күн бұрын

No it will be certainly eclipsed by the number of them in 2025

@wildstorm74 18 күн бұрын

@@TehPwnerer I agree with you, I think people are going to use the idea to build a similar process.

@osiristeam6959 15 күн бұрын

They should have a list of trusted extensions instead of a list of untrusted ones.

@zeteya 11 күн бұрын

Very bad idea

@rafayahmed6259 10 күн бұрын

@@zeteyawhy?

@zeteya 10 күн бұрын

@@rafayahmed6259 Many reasons, one being a good extension can turn bad one day, but an extension that was bad to begin with will never turn good.

@DoorThief 18 күн бұрын

I just got a SNYK sponsored ad by John Hammond before his own video

@NileGold 18 күн бұрын

@h5e 18 күн бұрын

I did too

@alek002 18 күн бұрын

It's rigged!1!1!1!1!1

@thecrew8612 18 күн бұрын

Saaame

@kbabe3915 15 күн бұрын

The scrum meeting: "Yeah, an approve list is too short, let's write out every single extension that could execute code instead of just choosing some image and video formats that we support."

@user-hp2dr5qc8p 13 күн бұрын

A whitelist can get annoying tbh.

@kbabe3915 7 күн бұрын

@@user-hp2dr5qc8p Ah yeah, you're right, much more annoying than a 0 day. Also a blacklist had to have been annoying from the very start.

@januzi2 18 күн бұрын

Wait ... we can hack those spammers that are sending us the messages to text them?

@AstralArchivists 18 күн бұрын

Bet the three later agencies are punching air rn. All their exploits getting found.

@BillAnt 18 күн бұрын

While reading your comment. lol

@MrCobalt 17 күн бұрын

You think every exploit exists because of "three later agencies"? 😂

@ohmsohmsohms 17 күн бұрын

@@MrCobaltgiven the past of their involvement with 0days, I wouldn’t be surprised if they were aware of maybe 1 of the RCE vulnerabilities discovered this year

@v-y 15 күн бұрын

@@MrCobalt theres no way this was an unintended oversight

@0xC47P1C3 18 күн бұрын

Funny seeing you in ads on your own videos lol

@te-weikaigai1836 18 күн бұрын

I'm glad that I migrated to Debian + KDE two months ago. I still have my Windows on my drive, but never want to boot it anymore. The KDE environment in Linux is just much better than Windows.

@HyBlock 18 күн бұрын

who asked?

@KLR-3 18 күн бұрын

Welcome to the family.🐧

@te-weikaigai1836 18 күн бұрын

@@HyBlock the implication was that I'm not affected by windows RCE anymore.

@freerice9595 17 күн бұрын

I've tried making Ubuntu and Linux mint my daily driver many times. Can't do it. But for home labbing and running servers it's perfect.

@shiiy5131 17 күн бұрын

it's just so much more superior, once you try it you never go back lol

@cvl14 18 күн бұрын

This just shows how blacklist are ineffective as a security tool

@ThisIsJustADrillBit 18 күн бұрын

The fuzzing begins ❤

@BillAnt 18 күн бұрын

LPL has entered the chat, fuzzing locks are fun. hehe

@AuxiliaryPanther 18 күн бұрын

@@BillAnt...we're getting an SQL injection on three, oh it's binding. A little malware on four, and we're set. Going back to three, gained root access to run our query, annd now we're in.

@BillAnt 18 күн бұрын

@@AuxiliaryPanther lol that took like 30 seconds.... not a very secure lock. :D

@actng 18 күн бұрын

Thanks John you explained that very well

@milanvucetic1292 18 күн бұрын

3:55 Not me watching the John Hammond video and getting an ad with John Hammond in it. Some may say it's a 2 for 1.

@BillAnt 18 күн бұрын

Taking it up the a** without lube. lol

@yessintaktak9200 17 күн бұрын

Hello john . I am a big fan of your content can you make a roadmaps for us form when need to start 😅❤

@TheMAZZTer 18 күн бұрын

Oof, this is why blacklists can be problematic, with a whitelist they would not have had this problem.

@BaggerPRO 18 күн бұрын

Except perhaps for the problem of naming this list as "white" 😁

@joshallen128 18 күн бұрын

@@BaggerPROblock allow lists?

@BaggerPRO 18 күн бұрын

@@joshallen128 , Yeah, it looks like it's fashionable to call these lists that way now :)

@BillAnt 18 күн бұрын

A block list is usually shorter than a white list, but it's just a matter of decision.

@joshallen128 18 күн бұрын

@@BillAnt Deny list because block sounds like black with an accent

@acessor9899 18 күн бұрын

This one RCE was indeed fun to use, gotta find more ;)

@1hw3 18 күн бұрын

hello vro

@Luzum 15 күн бұрын

im gonna touch u vro ♥

@mrhassell 18 күн бұрын

Requires Python to be installed in the local path as a global environment variable.

@runedust9875 18 күн бұрын

Having a whitelist instead of a blacklist would prob. be more secure and reliable. Basic security not?

@tablettablete186 18 күн бұрын

I was thinking the same

@xion637 18 күн бұрын

@@tablettablete186 governed by implicit deny. Also agree.

@user-mk3zz8zn9b 18 күн бұрын

nah, its not think again

@rian0xFFF 18 күн бұрын

depends on size

@vladislavkaras491 13 күн бұрын

Thanks for the news!

@cyber_space09 18 күн бұрын

Wow good job I want more info ❤

@jabrowski_ 18 күн бұрын

Interesting shiz John. Liked and subbed, stay safe

@planktonfun1 15 күн бұрын

every vulnerability whether or not its trivial, can and will be leveraged

@sevuszeld5015 18 күн бұрын

the title of the video is not that nice because i thought it would be a vulnerability that accurs right now. anyways. Thanks for sharing.

@abandoninplace2751 18 күн бұрын

They are identifying files by extension. Nice.

@wiertgo 18 күн бұрын

I got an ad from you on this video

@shadflur874 17 күн бұрын

How do u register for that forum?

@johndeaux8815 18 күн бұрын

Hate the red border on the thumbnails, I assume I've already watched and scroll past half the time

@SchooiYT 18 күн бұрын

Nice Video!

@higurashinerd 16 күн бұрын

Part of whyI never share diagnostic data with devs. It’s so nosey now

@hackcode2240 18 күн бұрын

Amo tus videos

@ShadowManceri 18 күн бұрын

I find it very bizarre that you can execute a file in the first place. That seems like a bad idea in many ways.

@user-hp2dr5qc8p 13 күн бұрын

How do you suggest to open a .txt file?

@ShadowManceri 13 күн бұрын

@@user-hp2dr5qc8p .txt file should be read, not executed.

@madscientist15808 18 күн бұрын

Hey there John

@oncetwice6366 18 күн бұрын

Who's idea it was to hardcode bunch of files there. They'll just keep updating it every timea new file type that can execute code comes? Sounds like horrible idea.

@dimike96 18 күн бұрын

Surely some communities would have a very high hit rate for python being installed on a windows machine right?

@crism8868 18 күн бұрын

Yup. All data science and AI nerds.

@Bromon655 18 күн бұрын

Anybody even slightly interested in programming has a decent chance of having it installed on their computer. I refuse to believe less than 0.01% of users were affected.

@paulwesley3862 18 күн бұрын

@@Bromon655a) is the 6th most downloaded app - is your grandma programming? b) die this you must use it on your PC. how many people just have it on their phone?

@ToniMorton 18 күн бұрын

calculator opens in my nightmares.

@user-fp7fs9xl2t 18 күн бұрын

Great Content ...

@r35p3ct00 14 күн бұрын

Такое чувство, что на безопасность всем насрать, только ты можешь себя обезопасить, не кликая на всякое говно

@RebziSquad 13 күн бұрын

Если человек наивный, то его никакая защита не спасет) Однажды мой знакомый запустил подозрительный tampermonkey скрипт в дискорде, говорит "2FA стоит же, чего бояться?". В конечном итоге украли его токен и смогли получить доступ к аккаунту.

@PasqualItizzz 18 күн бұрын

Tis the season to find folly, tra la la la la, la la la lol

@Javv1721 Күн бұрын

Me as python developer and windows user💀

@anthonymcevans8191 15 күн бұрын

“It is not by default installed” **laughs in Linux**

@zheil9152 18 күн бұрын

1:48 macOS has it installed by default, last I checked at least

@dom1310df 18 күн бұрын

Does mac have a similar concept of file extension associations as on windows, so a pyzw file will open with python by default?

@chiroyce 18 күн бұрын

Not anymore, used to have Python 2.x

@mrfoodarama 12 күн бұрын

Oooff... thank you John... cant believe im one of those 0.01% .. slackin

@fokyewtoob8835 18 күн бұрын

Music to my ears

@commanderpaladin 18 күн бұрын

I like cats. Btw we can all be farmers. No tech no rce problems 😎

@Bromon655 18 күн бұрын

3:28 lol. They backed themselves into a corner with that statement.

@allxrise 16 күн бұрын

They might have been logging something like "There is no any program to open this file-type/mime-type" perhaps? Or they just RCE'd to everyone... Who knows?

@Bromon655 16 күн бұрын

@@allxrise I’m more inclined to believe they were just fabricating a number as an attempt at damage control

@reijin999 18 күн бұрын

yeah but it updates every hour so it's chill

@momentum9319 18 күн бұрын

what is "flair"

@sophisticatedserpent1512 18 күн бұрын

The red bars in the thumbnail made me think I already watched this video.

@ernestmugo1765 15 күн бұрын

Right, I thought so too!

@DoingFedTime 15 күн бұрын

Bad stuff for many. One of the reasons I always tell people to NOT use this medium.

@paul-olof 18 күн бұрын

Haha so specific but I would've been at risk

@benherbst3620 18 күн бұрын

CRAZY

@couldntgivafuk 18 күн бұрын

I've never liked the idea of "allow" and "deny" list... just deny all and allow the user to specify.

@wildstorm74 18 күн бұрын

I can't wait for new exploits that uses this idea in similar way now.😅 If you know, you know.😒

@manasmahanand732 15 күн бұрын

With a bit of social engineering this could have been pretty terrible

@Pem7 18 күн бұрын

2024 is on fire with RCEs🤞🏾

@guilherme5094 18 күн бұрын

👍Nice.

@Axodus 12 күн бұрын

Good, they banned my account for no reason.

@legendarycuber9205 18 күн бұрын

I got a SYNK ad with John right before the video and was confused why there was a skip button 😂

@aaronguerrero2003 17 күн бұрын

There is always a way in😉

@impostorsyndrome1350 18 күн бұрын

I have Python installed on Windows computer... It helps with learning Python programming, idk why people are so against it.

@zombi1034 18 күн бұрын

Yea, not sure why he made it seem like something extremely unusual. I think most people that do any kind of programming and use Windows will have python installed.

@Slada1 16 күн бұрын

Why would you learn python if you could not use it? :D

@impostorsyndrome1350 15 күн бұрын

@@Slada1 wdym not use it? You can use it to create various programs.

@KLR-3 18 күн бұрын

Why do they blacklist file types they believe are unsafe. They should be whitelisting filetypes that are safe. If some new software comes along that belongs in the unsafe catagory they have to know about the related filetype and then add it to the blacklist...

@wafinashwan8242 18 күн бұрын

whitelist would take too long.

@erroroliver 18 күн бұрын

@@wafinashwan8242got any quote from a developer?

@johnsmith34 18 күн бұрын

"Reimplemeent file open confirmations" has a noWarning list, so I think that's done now.

@KLR-3 18 күн бұрын

@@wafinashwan8242how so?

@johndoublew3060 18 күн бұрын

@@wafinashwan8242 how come

@Mat2095 16 күн бұрын

But, isn't pyzw supposed to be a zip-archive? That contains a __main__.py? I'm actually surprised this runs at all.

@lunaxquinn 18 күн бұрын

Linux users are way more likely to have python installed out of the box so i wouldn't call this a "very specific" exploit.

@robotron1236 18 күн бұрын

You should watch Telegrams owners interview with Tucker Carlson. They have like 30 employees and have never spent a dime on advertising. 😂

@entertain8648 13 күн бұрын

Why are you laughing though?

@BreadGuy0 18 күн бұрын

Everybody be acting gangsta until calculator auto launches

@IlIlIIlIlIlIlIlIl 18 күн бұрын

Good thing I run it in a vm on a vps

@Luzum 15 күн бұрын

vm escape + pyzw = your vps gets owned

@StealthSec-BugBounty 18 күн бұрын

Ohh no

@FRITTY12348546 15 күн бұрын

But was it a typo :D

@eljayleyble1789 18 күн бұрын

A lot of noodles will be leaked for sure.

@user-fe5mz9mq5o 14 күн бұрын

i found this exploit 2 years ago... never posted anything about it

@maktiki 15 күн бұрын

I think the problem is Windows. It runs everything too fast without permission.

@BU5TER288 18 күн бұрын

oh no.. now i feel so dirty i cant wash it off

@user-mc8xt1iq7c 18 күн бұрын

bro, youtube just showed me your ad, on your own video. theyre wasting your ad money

@furrygem5176 17 күн бұрын

"Certified rce moment" 💀

@LibraryOFSounds 18 күн бұрын

Yeah uae does not like private messaging.

@rafayahmed6259 10 күн бұрын

😅😅

@LibraryOFSounds 10 күн бұрын

@@rafayahmed6259 Do you know uae connection with then twitter ? Or the documentary about state hackers of usa training uae agents. That documentary is so interesting

@rigsshiver823 18 күн бұрын

tf is going on .. rce 💀

@SimplyGamer605 15 күн бұрын

Hey, nice video, but just one thing. Your audio and video dosent seem to be perfectly in sync and its getting on my nerves

@DavidFrankland 15 күн бұрын

echo y | format c:

@cleetus1715 18 күн бұрын

This is super sensationalised, I hate this form of clickbait content

@dill6827 18 күн бұрын

gets attention, wasn't even searching for any exploiting related content but got this recommended

@Bromon655 18 күн бұрын

Meh, this channel isn't nearly as guilty of sensationalized clickbait as other channels. I felt the discussion in this video was pretty straightforward and no-nonsense.

@00killerix 15 күн бұрын

Propose a title for this video.

@Reelix 18 күн бұрын

"Windows that has python installed" you claim is extremely odd. That... Is an extremely odd statement.

@Aghnanster 18 күн бұрын

Ive heard this is on discord also

@Luzum 15 күн бұрын

it is not

@luizzeroxis 18 күн бұрын

How is this RCE? It's just running the code that someone sent to you. There's no difference between that and opening an exe.

@jamesciastko8861 18 күн бұрын

What is happening lately? 💀💀

@dkizilkaya6839 16 күн бұрын

This was surely done by purpose. Believe me not.

@ourdazakaria4182 18 күн бұрын

Please sir all my devices is hacked my phone my laptop what can i do for this problem there is someone above me every step i make on my laptop or my phone knock the roof like if there know everything im doing . THANK YOU FOR HELP 🚨🆘

@TheAwillz 17 күн бұрын

Sometimes you guys are very clever with tech but not so clever with people…

@JNET_Reloaded 18 күн бұрын

ironic how you mention x as x has same fkin vulns as t look into clicking vid links on x on some accounts it will open up links and do stuff etc!

@Sinstyson 18 күн бұрын

Can you provide examples of that?

@Difluoroacetamide 18 күн бұрын

Some bots post links that have a picture that looks like a video as the thumbnail of the preview card. It's very hard to explain

@Sinstyson 18 күн бұрын

@@Difluoroacetamide i mean like, i want a link

@Difluoroacetamide 18 күн бұрын

@@Sinstyson There's really no documentation for it; you just have to see it for yourself. It's a link preview that tricks you into thinking it's a playable video with a thumbnail designed to deceive. With closer inspection, it displays the site title, link, and description below the thumbnail. It's easy to be fooled by this if you're not tech-savvy or have poor vision. Mainly this is used by adult content bots to lure people to their websites. It's not a security vulnerability, but rather a case of OP being oblivious no offense

@shareb1t 18 күн бұрын

this RCE was shared last year in TG channels and been there for whole year, its not 0day at all. Stop talking trash just because someone tweet it and say is 0day lmao

@Z3rgatul 18 күн бұрын

zero day means "it is not fixed yet", and not "not shared yet"

@schwingedeshaehers 18 күн бұрын

it means, not know/just known by the seveloper @@Z3rgatul

@ibrahimdevx 18 күн бұрын

Less then 0.01%.... yeah idk why im having a hard time believing that 😂 its not that uncommon to have Python installed on ur system

@christoferrian 18 күн бұрын

hello world

@adenosinetp10 17 күн бұрын

can you stop using the word "stupid" so frequently and often?

@rodricbr 17 күн бұрын

this is such an interesting rce tho... lol

@ZaberfangX 18 күн бұрын

Is it safer just makes a user that is not admin user? So if code ran its needs admin user right as default user windows always user are admin?

@oracuda 18 күн бұрын

how do RCEs still exist in 2024 bro 😭😭😭😭😭

@crlfff 18 күн бұрын

They are found in everything

@velo1337 18 күн бұрын

isnt that note more like a trojan horse than a RCE

@YouTubeName-hw1uk 15 күн бұрын

Anf i thought wiiu wansthe only thing that has rce 😂

@Network_Cyber 16 күн бұрын

Code please

@christianhabermann6527 15 күн бұрын

Quite sure the work of a bad actor. These "typos" that cause super serious RCEs are happening in very interesting places in really well used mainstream projects.