Security researcher Kamil Hismatullin revealed a simple method to delete any video from YouTube. Of course, Google immediately fixed the bug that allowed YouTube to be completely deleted, otherwise we wouldn't be able to publish it..The Russian programmer and hacker found that he can delete any YouTube video just by sending the video's ID number in a POST request along with the hacker's user token.
POST https://www.youtube.com/live_events_edit_status_ajax?action_delete_live_event=1
event_id: ANY_VIDEO_ID session_token: YOUR_TOKEN
Google, as usual in such cases, rewarded the researcher with$5000. "I wanted to see if there were any CSRF or XSS vulnerabilities, but unexpectedly I discovered a bug that allowed me to delete any YouTube video with a single request," reports Hismatullin. "... This vulnerability could create absolute havoc in a matter of minutes in the hands of a hacker, since it could delete videos from YouTube very quickly." Hismatullin also reports that Google responded immediately (the company is known for fixing bugs quickly, unlike some others... we won't mention names or show it to Apple and Microsoft) afterthe bug report and proceeded to fix it. The researcher also says that he resisted the urge to "delete Bieber's channel". With you Kamil!
The Russian programmer and hacker found that he can delete any YouTube video just by sending the video's ID number in a POST request along with the hacker's user token.
The Russian programmer and hacker found that he can delete any YouTube video just by sending the video's ID number in a POST request along with the hacker's user token.
