Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

OK, I use youtube just for listening music and watching videos. I don't upload, and I don't comment. Sometimes I do like some videos/comments.

But today I accessed my channel and I saw like 20 comments from my account.

They looked like this:

"Yes i mean it. this is really fantastic. and i can tell u , really lucky that i registered and got my dream fresh products from maybelline for nothing :). its worth a try here => "

Any ides on how to prevent this in future, or report. Any idea is appreciated :)

share|improve this question

2 Answers 2

up vote 5 down vote accepted

Most probably, your account is compromised. Change your password and use Google's second factor authentication if possible.

There is also the possibility that you have malware on your system that will use your active sessions to post this kind of spam. Use a free AV and consider buying one.

Update:

I looked for your spam message, followed the link and landed on a site that enticed me to download malware detected by very few antivirus products. This adds to the probability that there is malware on your system. Antivirus should be your first action but re-installing is the safest way.

share|improve this answer
    
Ty. I already changed password, and turned that via sms code logging. –  ttwis Jan 17 '13 at 18:41
3  
You may also want to revoke any Apps you don't recognise accounts.google.com/b/0/IssuedAuthSubTokens –  Lewis Goddard Jan 17 '13 at 20:54
    
I have it a lot. StackExchange is reliable. I will check others. Ty –  ttwis Jan 17 '13 at 22:18

This question was marked as answered wehen I was notified about it. But after pondering for a few days, I decided to add my $.02

It is very convenient to subscribe to other sites with common authentication services accounts, using Faceboook, twitter, etc. account.

But how many ever read what they are permitting to those sites?

Here is very common warning, you cannot refuse from it without cancelling your subscription altogether, I've plagiarized from Gail Gardner. Woah! Read Those Twitter Authorizations Carefully posted 2 years ago:

enter image description here

The users themselves authorize to post from their accounts.
Well, and if this warning was not shown at all?

And if scammers have placed on web an attractive external service for antispam protection?
The sites install plugins to free 3d-party services and voilà, the site is protected and its visitor computers exposed to external services interactions while the latter does not even pass through "protected" site. No need for vulgar phishing or malware.

Just to note that most free plugins give access not specifically to protected site but to browsers and computers of its visitors, and they are mostly based on trusting to upload executable scripts into them. In other words, to stealthily control visitors computers without the risk of exposing this activity (through phishing or malware/viruses patterns detection). Just to stress again that malware detection is being and can only be done by checking the communication between user's computer and a visited site while the sites, by installing plugins, give access to 3d-party servers from IP-addresses different both from those of protected site, of visitor and even of website on which webmaster subscribed for free external service (which plugin s/he installed).
This makes impossible to detect any wrongdoings.

According to FTC (US Federal trade Commission) Report from March 2005:

adware aptly illustrates the challenges associated with developing a workable definition of spyware. Adware is often bundled with other software programs, which are frequently provided to consumers for free

And again according to FTC,

"Spyware" is mostly classified into four types: system monitors, trojans, adware, and tracking cookies

A little bit off-topic of compromising user's accounts but it still important to note that in order to webscrape visitor's sensitive information (his eMail, name, etc.) from his computer, there is no need for a visitor to interact with the site but just to visit it (and interaction mostly lead to even compromising its computer and accounts).
Another thing is that those who do it are not interested to expose and be detected by vulgar malicious activities.

And obviously nobody is interested to honestly describe you these common secrets. Especially because just advertising, or even spamming, is less lucrative than webscraping, datamining, webharvesting and selling personal data and webtracking internet users. Webmasters are happy that they do not need to clean their websites from spam, the providers of antispam protections have peaks of demand when spam or SEO blackhat tools make new releases, etc.

share|improve this answer
    
Very useful post :) ty –  ttwis Jan 20 '13 at 13:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.