Fake OBS Studio Hack Targeting YouTubers
Вставка
- Опубліковано 30 гру 2022
- j-h.io/snyk || Seriously huge THANK YOU to Snyk for sponsoring this video and their continued support of our channel all throughout 2022, and into the new year for 2023! Get started with Snyk FOR FREE ➡ j-h.io/snyk
🔥 UA-cam ALGORITHM ➡ Like, Comment, & Subscribe!
🙏 SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎 FOLLOW ME EVERYWHERE ➡ jh.live/discord ↔ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware
A few minor points:
1. The S in OBS stands for Software.
2. Always ignore all "ad" results on Google.
3. Always scroll down to actual search results.
4. Report ads that are sketchy.
Skip the 2, 3 and 4 by using an ad block extension or a browser which comes with an ad block.
i always do this to be safe
5. Notify OBS about this
@@Hardcore_Remixer To be more specific, use Ublock Origin.
@AwesomeAnikin3279 They're doing it wrong :)
Actually it’s a big issue. Yesterday I was helping my family member install OBS, and as they googled OBS, the fake advertisements have occupied the whole view. We had scroll through at least 3 fake ads before we got the actual obsproject website.
Google should definitely make a human ad verification, or improve their algorithms so they’d first scan the website before promoting it.
But they get paid by the malware! So why would they care?
@@moth.monster right that's why mobile game ads on youtube are always clickbait
Actually it's a big issue. Yesterday I was helping my family member install OBS, and as they googled OBS, the fake advertisements have occupied the whole view. We had scroll through at least 3 fake ads before we got the actual obsproject website.
Google should definitely make a human ad verification, or improve their algorithms so they'd first scan the website before promoting it.
@@Theunicorn2012 shut up
@@Carahato Mafia City mobile ads be like:
this is why people should have adblock. not just to not see ads but also for security. so many ads are scams or malware or that kinda stuff
this is why people should have adblock. not just to not see ada but also for security. so many ads are scams or malware or that kinda stuff
@@Theunicorn2012 cant even type properly
Until adblock is hacked itself
@@Theunicorn2012 this is why people should have adblock. not just to not see ada but also for security. so many ads are scams or malware or that kinda stuff
Guess what guys.. this is why people should have adblock. not just to not see ads but also for security. so many ads are scams or malware or that kinda stuff
If Google is pushing these kinds of ads, I feel like that should be ground for a class action lawsuit.
I don't think they can vet every single ad.
@@TuberoseKisser The largest search engine company. With literal billions of dollars at its disposal. With some of the most tech savvy employees in the world. Can't find a way to vet ads that THEY approve for their search engine.
Yeah. And I'm the king of England.
@@TuberoseKisser they could if they wanted to, but it would be expensive so they will never do it. there's no "can" about it, only "won't".
@@OneCSeven they already have human verification, just they aren't paid anything so they don't really care
I'm sure there's something in their end user agreement that they are not responsible for this sort of thing.
I remember one time Forbes ran an article about how ads were spreading malware, but insisted you turn off your adblocker to read the page/article only for their ads to also infect your computer with malware xD And some people wonder why adblock is required to viewing the web.
ı use to not use itbut after using it hard to turn off cause stuff just euns better
@@lorekeeper685 Even though I'm on Opera GX I still use Adbloock, the browsers free VPN and the browsers adblock built in.
@@NoodlyPanda I don't use opera not sure if it's good
@@lorekeeper685 It's actually really good. It's chromium based, but it's got all these extra built in features like a free VPN, RGX which does wonders on video and images, can control how much processor power and RAM the browser uses and integrates with different social media in a sidebar. Loads of other stuff. I highly recommend it.
@@NoodlyPanda okay can you dumb it down for me
What's RGX
And how would the otter options effect me not much tech savvy and from turkey where info of such are either very limited or dubious
Man we're going to need verified checkmarks on websites now 💀
LMFAOO
Yes please
You can by using McAfee plugin in browser
just check the url, it’s that easy
its not like this EXISTS
Thank you for the PSA! Everyone should report fake ads every time they see them. Click the 3 dots next to the result to report.
UA-cam has gotten worse in vetting their advertisers. I've reported the same ad (an ad claiming that a fruit will 'kill' diabetes) numerous times and I still see it AND it's the same advertiser.
Or the straight up virus links they host
This is why Google should investigate each ad and not let ads be visible to the public but visible to the advertiser as if it is while they check it. Also making sure they have tge actual purchaser by having a video chat with them holding up their picture ID and the registered business license in the country it is registered. It would stop a lot of this crap with that done. Also their ID address and the location of their ip address being at least same city and country.
This sounds insanely useful to put in place
@@delayedplayer Thing is anything really useful for the public seems beyond the capabilities ofvGoogke since I even told them the same thing about the scam video bads we fet in UA-cam. Having told them the exact idea over 10myears ago and several times a year is like talking to a wall built of dung. Yes I said a wall of dung since Google is a pike of crap at protecting the public against hackers abd scampers with their ads. In the end it proves Goigle is a profit Whore onky.
Agreed.
I am still surprised how Discord always chose to stay with profit after so many warnings from the industry saying they should block their CDN access from unauthorized connections to prevent payload hosting.
sounds like there partaking in Dark Patterns to me, no way there not aware of the issue
true. should require a discord authorization token to download files from cdn
@@balllord3546
Exactly. I made a post on the Discord subreddit pitching the same suggestion. Turned out they probably couldn't care less.
Says a lot about Discord as a company
I am still surprised how Discord always chose to stay with profit after so many warnings from the industry saying they should block their CDN access from unauthorized connections to prevent payload hosting.
It's worth noting malware authors will absolutely take steps to ensure the common AVs don't detect their stuff (they can run scans all day and tweak their malware until it's not detected) so it's not surprising Windows Defender didn't detect it. (You did go into it a bit with the mention of file padding,)
All the extra files in the ZIP could be part of this attempt, though I'm not sure how it would affect things. Or it could be an attempt to randomize the hash of the file for whatever reason .
It's worth nothing malware authors will absolutely take steps to ensure the common AVs don't detect their stuff (they can run scans all day and tweak their malware until it's not detected) so it's not surprising Windows Defender didn't detect it. (You did go into it a bit witn the mention of flie padding,)
All the extra flies in the ZIP could be a part of this attempt, though l'm not surw how it would affect things. Or it could be an attempt to randomize the hash of the file for whatever reason .
It should also be noted that AVs cannot scan passworded ZIPs or RARs - if you come across a passworded rar or zip with person who posted it publicly telling what the password is (or telling you in email with passworded zip attachment), the password is there for the virus to avoid detection. Don't open it under any circumstances.
@@Theunicorn2012 Actual bot
We needed this video… Beginners who wants to start streaming on Twitch needs to be aware.
good thing i got the steam ver
@@coolchannel9286 same here
This problem is as old as internet its self, never search for the word "download". This always was a major problem with getting drivers. Search for the brand you need, then search for support/download once you are sure you're on the official page.
Google has been doing things like this for years. Not just OBS, but anything you type in with an AD slap next to it. Sometimes comes out as a scam, so don't be surprised that you're dealing with a scammer problem.
This isnt the only thing. This happened wth MSI a few weeks ago. Google ad was promoting a fake MSI afterburner that I actually ended up falling for- and it was promoting THREE of them. The top 3 links were all slightly different websites but absolute 1:1 clone with the actual one.
I thinks its scary that it is that easy to just tell windows not to scan a certain file
if winget became remotely more common then this would be a complete nonissue.
The fact that windows has a (sort of?) functional package manager built in is nuts and I'm shocked that nobody ever talks about it.
@@meat2648 right lol not even going to lie doing research on it now
oh, ok i got it just so used to file explorer lol
But sometimes it's a real pain writing AuthorName.PackageName
Like, why can't you be like apt, rpm, npm ... 😒
@@notyoursurya Right
I have to say I have loved this channel for a while and their is always something new to explore, keep up the great work. And please do more malware analysis
Ive also noticed an uptick in malicious ads being promoted by Google/UA-cam.
I fell for the fake installer with help of google ads. No windows defender warnings before or after the installation what so ever. I was even more shocked how unsuspicious the program seemed. After I installed it, I already recognised that something was odd. But no suspicious tasks were found in the task manager. I decided to reinstall windows but I wanted to do it a day later because I had something to finish.
A few hours later after I abandoned my PC without me sitting infront of it I suddenly became the message on my phone that my facebook account was locked because of violation of community standards. I immediately reinstalled windows and tried to get my fb account back. After it was unlocked two days later facebook showed me what happened.
The malware magically posted ISIS photos and people with guns on my profile. But locally on my own PC. Immediately changed all passwords...
The dots are represented as null bytes which means it is already utf16-le encoded since it is for Windows. Decoding to utf8 will remove the null bytes
@@zfutox7224 the comment got removed but you replied so it shows the number
@@brighthades5968 I removed it
The dots are represented as null bytes which means it is already utf16-le encoded since it is for Windows. Decoding to utf8 will remove the null bytes
@John Hammond, why there are so many fake comments replying on your UA-cam videos with weird telephone numbers ? Have you been pwned yourself ?
@@boogieman97 bots. I called it cirno bots because they're using same number sets with cirno
Those random files in the about folder are used to change the hash of the zip folder. Since those files can be anything, the web server can dynamically change the hash of the zip folder every time by editing the binary data of the zip file.
Seems like a half baked attempt to bypass AV signatures, even though most modern products are going to unpack the zip and signature the contents as well.
Thanks for this elaborate evaluation! Very informative and this is a big issue indeed. I immediately informed (warned) my stepson since he and his high school friend use OBS for different projects as well as their bands' YT channel.
This happened with the AMD Radeon optimisation pack. Whenever someone downloaded it, it would download the SearchEsmia virus on your PC which is an aggressive browser hijacking malware. This happened to my other friend a few weeks ago. Virus type : Trojan
Don't know how anyone can use the Internet without an adblocker these days
Seeing you utilise anyrun sandbox to manually download and install the malware was mind blowing! I'd never thought of this for the 100mb issue! Thanks for sharing
I recon when selecting the file to run in the sandbox, you could just give it a powershell script to grab and extract the file automatically from the known malicious URL (or a self-hosted ftp server if the download is no longer available).
Anyrun does have the possibility to create a task with an URL file too - instead of uploading a file
you can see it at 11:26
I think I should just say, I first saw this video when I was first using my brand new computer. The first day. I was installing all my essential apps and saw this video RIGHT before I downloaded the fake OBS. Thank you so much bro ♥️
Thank you very much for notifying us, we will take this into account to avoid piracy in this matter since it affects many viruses that aggressively steal information
This is another thing that's happening with Blender. I don't actually use Google myself, but I saw on the subreddit, people were talking about how there was a fake website promoted via ads
the transmission mechanism of the malware kind of reminds me of the Gootloader malware which used some SEO poisoning to gets itself to as many users as possible
I wonder what was that .exe that installer dropped into Roaming folder and set as autorun in registry.
Also want to see, if that link on desktop lead to that C://strange_folder for proxy .exe that runs stealer and then opens up C://ProgramFiles/OBS Studio/obs_x64.exe
Or how is original executable called...
@@DimkaTsv all above are great leads
@@DimkaTsv I have looked into it a bit. They must have been swapping this file out often, as the hash I got for the zip was different than the ones Muta and John got. They must have really been swapping these binaries out quickly, as I downloaded mine a few hours before John did. It's a few layers of packed malware, eventually had to unpack it with a unpac.me. I think the `C:\Users\admin\AppData\Roaming\Hpyjpn\Ogtnuzcwp.exe ` file in Johns download is probably my `Bllfgyszs.exe`, and that exe is loads another binary into memory, and I know that one has the string to call to set the exception for the `C:/` drive. There is also a Test.exe, which I suspect has the main payload (I have confirmed it is the binary that calls out to eth0), but I am not sure where the persistence is, yet.
@@nordgaren2358 chain calling from somewhere based on registry entry?
@@DimkaTsv like chain calling each stage?
The packing program they used is what's calling each exe, afaict.
Absolutely fascinating. Thank you for that.
Yeah, ads on google are a massive problem because it puts it as the first link most of the time, so it really sucks because I remember when I was 12, I went to watch youtube, and I was bombarded with "beautiful ads" and got in trouble for a while until I explained what happened.
Never thought I'd hear muta mentioned in John's videos 😄 Nice surprise as an enjoyer of both your channels
Both are Awsome Content Creators !
Just a comment for the algorithm ;)
Great video like always :)
And I found my first exploit (persistent XSS) in a probably really unknown (but important) software today and was able to report it (it should be fixed soon). Thanks for helping me achieve this with your interesting and informational videos, you are a big part of my journey in Cyber Security. Even though I am only a learnt electric engineer currently working in IT with Scada Systems. I would love to hear some of your thoughts about OT and especially Scada security. Sadly there is not a lot of information available about this topic currently but with more and more merging of OT and IT I think it is getting more and more important to have skilled people in this field for example to protect our critical infrastructure. That is why I want to go that route. Thank you for the inspiration.
Jeezos, the bots be botting in these comments, damn!
Great video, John. Keep up the great work
I'm so glad I always have adblockers on so I don't see any ads like these malicious stuff
Google needs to face justice for scams
This hit near home. I installed OBS on the 29th and I know I googled for it first.. After some panic I viewed my site history, and I see it appears I went to the correct site. I tend to naturally avoid Ads for reasons like this but but I was not sure. I also downloaded the file again from the legit site and compared it's hash to my previously downloaded version then threw my original file in virus total too for good measure. Looks like I dodged a bullet this time.
Yeah ima check it myself. Do you know what to do if you download the wrong one (just in case)?
@@thenickstrikebetter Uninstall the old one, and reinstall but with the official version. Always get it from the source.
@@CarlosXPhone thanks. I think I did it right the first time tho.
@@thenickstrikebetter i assume you downloaded from the official obsproject website. If so, you're good. This video assumes you clicked on a Google search, thinking its the official obs link. There are official programs (projects) that has "mirrors" of their official downloads, in that case... as LONG as you WERE on the official website, you downloaded the source file.
@@CarlosXPhone Before I checked, I was more worried that by trying to avoid the scam ads, I had accidentally skipped the real OBS and downloaded the fake one.
Shortly after I made my original comment, I checked as best as I could. I think I'm fine.
Thanks a lot for bringing this up! Who would have thought... Damn scammers - and social engineering done pretty right, to be honest.
GNU/Linux users are at an advantage here, unless the version in the repository is bugged.
We're at even more of an advantage if we install a package that specifically builds it on our system, though flatpak solves most security issues at the cost of easy one-click theming.
That happened with Blender this year, too - right when I was in a rush and sleep deprived. Learned how to remove some malware from that experience. Anti-virus and other things didn't pick up on it - I even stopped it part way because it tried to mount a drive instead of just install. It was enough to still make it hard to remove everything, even after a full restore. It ended up being malware that tries to find crypto wallet info.
Can I ask you how do I know if I downloaded the righ thing instead of the fake one, I need some help😅
@@wilvemoon the malware I downloaded required a drive to be mounted as part of an install - the real version does not need that.
@@wilvemoon Go on your history and make sure its the right link, make sure everything is spelt correctly, you didnt click on an ad and run it through an antivirus and smn like virustotal.
@@SnowMexicann thank you!
Hey I didn't even know there is thing such as online malware analysis services. Thanks for video =)
Very good information, thanks for sharing.
nice, this is one of the reasons I never use the ad links
admx files are group policy templates. Mainly used by enterprise/corp system admins, to configure a pc to meet the company requirements, but can be applied to any computer through GPEdit. Im wondering if the install is doing something with those
This is why I never press the top picks, usually they are ads for scams
I've seen this with other websites / software too. There was one for Microsoft Office 365 not too long ago. I am extremely careful now when using search engine to avoid all advertisement links.
not a fan of some ordinary gamers because he posted my command on twitter just to make a fool of me and i use to support him and even watch his videos so he does that to his viewers, his viewers then goes on to my personal business to say awful stuff about me all because of ordinary gamers
simply put twitter is a foolish social media
@@DaxyGamer not the point ordinary gamers is a two face.... as someone who been supporting the goof and then he tries to make me look like a fool in front of all his viewers and supporters is not cool, one day it will come out about him. karma will get him one day :)
The ability for bad actors to use google ads for neffarious things is rediculous.
First streamlabs using it to redirct traffic for commercial gains
and now literally malware.
fantastic work thanks !
Great subject, thanks...
I had been hacked by my UA-cam channel and I managed to recover it but it was because of obs studio that I was hacked on January 3.
we must be careful or software that or uses on our google account.
the fact that john plays scarlet instead of violet is the reason i'm subscribed to him
koraidon gang rise up
Thanks for catching this guys
Thanks, John you keep me and thousands of people safe.
so you see an "about" folder with a bunch of .admx files (group policies) and brushed over them as "junk". nice work
youtube "professional" content creators 😆
Those ADMX files look like windows policy files. The fact they are in the about folder screams get this crap off your machine. I'm guessing they are run by the installer so they can set the windows policies to aid the person wanting access to your rig. If you don't run as admin and have windows UAC enabled on any settings changes this installer won't be able to work.
Ive always had a gut feeling when it came to not clicking the ads, i always made sure to click the proper link, and this is the reason why
I nearly downloaded this... So glad I noticed just on time.
Tip: always download OBS on the official OBS site to avoid malware like this
That's not a tip
not useful tips 101
I don’t download software through an ad
No shit, dude lol
I'm slightly worried for myself, recently I downloaded OBS and I'm hoping I did go to the correct website. I'm not so intelligent with computers yet and I had no idea this was going around when I installed it. I just really hope my past self used his intuition and not destroy my PC only a month after I got it.
same i did the same thing i almost downloaded it from the same sight you can know if your obs was in a zip then its the virus one but if its the exe without the zip then your good
check your browsing history (and your download history)
All you have to do is check the website name, if it has bad spelling thats a big red flag, also check that it isnt an ad. If it clears those two then youll be fine. Also dont install shady shit.
@@_Underscore_ Sadly can't, at one point I cleared cache (and I guess indirectly cleared search history) because of a streaming service website broke and I had to do that.
@@SnowMexicann Yeah, now I'm more aware. Back then (like 2 or more weeks ago) I was unaware and unsure if I downloaded the correct one, I feel like I did but have slight doubts.
...I just downloaded OBS this weekend to try and start my dream of becoming a content creator. Thank you for justifying my ironic paranoia of all things online.
(Thankfully I found the OBSproject URL first, but even then I was hesitant without even knowing about this fiasco.)
I love your content!
Ohh.. I saw this when trying to reinstall OBS, I thought it was a real website! I almost downloaded it but I looked closely.
If you noticed, there's a difference between the actual OBS website and the scam one-- it uses a different font. The normal OBS website uses Open Sans in all parts, whereas the scam website (that I saw) used Verdana. I was lucky to spot this, or I would have downloaded the malware probably...😢
Hi John! What OS/distro do you run on whatever your personal laptop/pc is? Like just your everyday system you use at home or w/e.
Amazing channel and content!
windows, something around 10
This is exactly what happened to me, I hope this does not affect anyone else that badly.
Thank you brother
Glad I installed OBS from the Steam store instead from the Internet otherwise my pc would be in danger.
I work in IT and I enjoy these videos. Great work!
The ADMX files are group policy templates for Active Directory. Interesting they randomly included those.
This happened to me when I tried to download and reinstall VLC media player as well. A popular open source video/media player. The top result was a google ads result that directed me to a spoof website that wasn't the original VLC website. I recognised the URL quickly enough and didn't enter it, but I could see how unsuspecting, first time users could be duped into downloading and installing malware.
When you realize that all the software hoarding your friends make fun of you for is actually based.
I always do that too. Not just for security in knowing it's a good exe without any funny business, but also what if the original link is shut down and the software is no longer accessible? I've had that happen in a few cases, and having the setup file backed up has saved my bacon.
@@DarkReaper1053 Same, I've hoarded a bunch of old Minecraft mods that would've become lost (or hard to find) otherwise.
Data hoarding is very based indeed. Also seeding torrents
i get deep down and suspect how they hosted it and i found it..... its Ubuntu server apache server look at the 404 page it tells u its apache server but the real one have its own 404 page ... so its server running linod or home server check it and try it to brute fore the server(ssh)
Good to be up to date
I recently switched from Xsplit to OBS and i also had this issue where I came across a fake OBS website. I never even clicked on it, i just immediately found it suspicious that so many websites allowed you to download OBS. So I went straight to their official twitter page to find the official website lol
I just reported about 30 crypto scam/spam comments under this video and I encourage everyone else watching to do the same. You might wanna add the name of the scam to a comment blacklist.
Oh, just great. Any tips on quickly determining if the OBS studio I downloaded and installed is the malicious variant? Does the malware version function as expected?
The malicious one just installs regular OBS. It embeds the regular installer into the fale exe, and launches it.
I'll look a bit deeper and see if there's something to look for. Idk if John went that deep in the video yet, as I haven't watched it (I was looking at this malware with him last night, so I know what it is)
Do you have your original exe or your browser history to look at?
The malware version comes as a zip, but OBS is just an exe download.
yeah just compare file sizes from your installed binay and the one from the original source, thats the fastest way
@@nordgaren2358 might suggest to look for .dll swapping or process hollowing,
@@DataLux-iq5fl well, the installed OBS is just OBS. The installer, however, is a much bigger file and comes in a zip with an About folder.
So if you have that, it's something to look at.
Can also look for some of the filepaths in this video, incase the loader didn't delete them!
Also check if your antivirus has an exclusion for the C drive.
Any Run allows you to create a new task with an external link to a program that it will automatically grab from the web and place into the VM before you are presented with the GUI.
Thank you for the video!
I will be more carefuel after this, because when I want to download something I always check if the site has been certificated, and the malicious website has been as well.
I'm actually angry that they were able to certificate the site, but I'm also curious about how were they able to do that..
-Take care everybody!
Anyone can get an SSL certificate. It doesn't mean the website is trusted, it only means that data sent and recieved from it is encrypted in transit.
certified websites just means the browser could verify and make sure the data is going only to the owner of that website, however it does nothing to make sure the data of that website is not malicious.
Maybe John's next video should be on this crypto clown who's spamming the comments? It would be a nice clapback.
@John Hammond This is a great idea when you have your next spare time
ADMX files are XML-based files that provide registry-based settings to the Group Policy Editor.
aka its directly attacking the system registry
A name like that has my mal-site senses tingling!
I love that John knows about Mutahar ❤
Thanks !
I found actually a decent method to not get caught in these situations. If possible, go to any of the OFFICIAL project/business etc. social media and, most likely but probably not appliable to every single one of them, they will have the original website linked on their profile.
Now that anyone can buy a checkmark on Twitter, even that is somewhat risky
@@skore9975 but there's a way to see if it's bought or not, isn't there? Like, click on the checkmark and It shows If it's bought or If It was actually achieved or granted bcs It's an official organization.
John, this almost happened to me recently but with a financial app (TradingView). I was on another PC and wanted to quickly check a price chart - googling Tradingview and clicking on the 1st result gave a copy of the official page. A download started immediately but fortunately I got suspicious before opening anything
The thumbnail scared the hell out of me
Nice video!
ADMX / ADML are group policy setting files, so it is likely if you install this, it will change a bunch of your system settings based on the templates that are there.
same happened to me, but with GIMP. Be careful with that one too
This happened to me once. I clicked on the first Walmart and it lead me to a scam website saying my computer was hacked. It wasn’t actually hacked, but still annoying.
please do this with TLauncher as well
Good example why Linux has far better software management. You download from a centralised (verified) repository rather than downloading random links off the web.
that same thing happened to rufus (a tool for making a bootable usb drive for any iso file)
I recently fell into this kind of ads by notepad++, the website is completely identical but I found out after I install so I'm good!
1:19
that's a pretty cool way to say virtual machine
I tried searching "obs download" myself on my signed in browser session and an InPrivate window tab but it seems the ad was reported enough that it got taken off the search.
I was hit with a fake obs on top of google results weeks ago, so they have been active a while. I noticed after clicking the installer that cmd window and weird stuff popped up and background processes that was not normal. I then proceeded to reinstall Windows...
me and my friend actually saw that there was a fake obs and we reported it, and it disapeared afterwards almost instantly.
omg this happened to me in October 2022 :( the hackers went on both of my youtube accounts and posted photoshop videos to phish my subscribers.. and also during the weeks i’ve been seeing how they been trying to login to my paypal and venmo and stuff so i had to change all of my passwords and emails :(
That’s why package managers are so great