{"id":39532,"date":"2015-04-03T18:21:34","date_gmt":"2015-04-04T01:21:34","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=39532"},"modified":"2015-04-03T20:32:34","modified_gmt":"2015-04-04T03:32:34","slug":"doomsday-flaw-gave-power-to-delete-everything-on-youtube","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/doomsday-flaw-gave-power-to-delete-everything-on-youtube\/","title":{"rendered":"‘Doomsday Flaw’ Gave Power to Delete Everything on YouTube"},"content":{"rendered":"

\"YouTube<\/a><\/p>\n

You can file this one<\/a> under tech doomsday near misses.<\/p>\n

A Russian software developer and security researcher, Kamil Hismatullin, discovered a security flaw in YouTube<\/a> that gave him\u2014or anyone for that matter\u2014the power to delete everything<\/em> on YouTube. Between the time Hismatullin found the flaw and reported the issue to Google, in jest, he said he “fought the urge to clean up Bieber’s channel.”<\/p>\n

What stood between Hismatullin and Justin Bieber’s YouTube channel? Google’s new experimental program, called Vulnerability Research Grants<\/a>, which offers monetary grants to “top performing, frequent vulnerability researchers” in exchange for their time and attention looking into potential vulnerabilities in specific applications.<\/p>\n

If not for the reward, well, who knows\u2026<\/p>\n

But here’s what we do know.<\/p>\n

In February, Kamil Hismatullin was awarded a $1,337 grant for sensitive product security research. If he found vulnerabilities\u00a0during\u00a0his research, then he would receive both the grant money and an additional reward to detecting issues.<\/p>\n

He chose to target YouTube Creator Studio in search of exploitable bugs. After investigating for several hours, he “unexpectedly discovered a logical bug that let me to [sic] delete any video on YouTube\u2026” Here’s a video he posted (ironically, to YouTube), which shows how the exploit works:<\/p>\n