News for hackers. Stuff that matters.
Re:Leaking the email of any YouTube user for $10,000 by UncleMeat on Wednesday February 12, 2025 @12:32PM (#43027565)
So then why do they need additional information about emails? They clearly already can email these youtubers.
Re:Leaking the email of any YouTube user for $10,000 by chmod775 on Wednesday February 12, 2025 @12:46PM (#43027712)
This will enable you to get the private e-mail of the google account that owns the channel, which is not necessarily the same one a channel may give away publicly.

So for some channels that provided no contact information, you now can acquire an email address, and for everyone else you may now get an additional one.

It also enables you to link multiple channels back to the same person.

Every bit of information you can get your hands on counts for social engineering attacks.

For very famous individuals this may also open them up to harassment. You can't find Elon Musk's private telephone number on the Tesla homepage for good reason. For that class of people, any time that sort of information leaks, they need to get a new private phone number/e-mail address.

Re:Leaking the email of any YouTube user for $10,000 by UncleMeat on Wednesday February 12, 2025 @12:53PM (#43027795)
I think we can imagine reasons why this would be valuable. It's a vuln. That's worth know about and fixing.

I'm not sure that there are terribly many black market opportunities for "every bit of information" such that this should be a six figure payout or whatever.

Re:Leaking the email of any YouTube user for $10,000 by chmod775 on Wednesday February 12, 2025 @01:08PM (#43027990)
Sure, but here's some examples that may be worth a lot of money to the right person, or can just cause a lot of harm:

- Regime critics with a channel on YT.

- Vulnerable individuals and others trying to keep their identity a secret. Putting yourself on YT means putting yourself in front of every deranged individual out there.

- Trump quite famously runs some of his own social media accounts personally, for better or for worse. And even where he doesn't, he probably retains ultimate control - in the case of YT it might be his personal google account that created the channel. He's probably not the only high value target to do so.

Also if you happen to be in any date leak, being able to figure out your private e-mail address gives attackers another place to check whether you re-used a password.

Re:Leaking the email of any YouTube user for $10,000 by kasey_junk on Wednesday February 12, 2025 @01:23PM (#43028145)
This is the “heist vs exploit sale” dichotomy that tptacek mentions.

For any vuln you can make up a hypothetical one off usage. But to find the right buyer for that is effectively building a team ala The Great Muppet Caper.