"OurMine Are Back!" YouTube Hack Explained

On April 01, 2017 at approximately 4pm pacific time / 7pm eastern time a major YouTube hack happened – possibly the largest hack in YouTube history.

Also see April 13, 2017 – Studio 71 network getting hacked by OurMine.

April 01, 2017 – Omnia Media YouTube Network hacked by OurMine

Roughly 300 of the biggest channels partnered with YouTube network “Omnia Media” are affected. The hacker group “OurMine” seems to be behind it. The hackers changed the video titles of all affected channels to:

“OurMine Are Back!… ( Read the description )”.

Then the video description reads:

Hey, it’s OurMine don’t worry we are just testing your security, please contact us for more information

https://ourmine.org
contactourmineteam@gmail.com

Omnia Media specializes in partnering with gaming channels. As such it’s mostly gaming YouTubers (including my own PowerPyx channel) that are affected. Either all their videos, or a large portion of them, were renamed and the descriptions replaced. However, no channels or videos were deleted entirely.

I myself am a managed partner at Omnia and have been affected by this. It’s a significant problem for channels that depend on search results – because if all videos have the same name it’s challenging for viewers to find what they are looking for and videos no longer show up in Google’s (or YouTube’s) search results under the correct terms. This really messes with YouTube’s algorithms and could potentially cripple a channel if not properly fixed by YouTube’s engineers.

Here’s what went down:

When a YouTuber wants to work with Omnia Media they must connect their channel to them and give certain privileges (that includes editing video details). Please note that this is the same process for any other YouTube network and not specific to Omnia Media. This could potentially happen with any other network and some of them have hundreds of thousands of partners.
The attackers supposedly hacked into Omnia Media’s systems. From there they had access to videos of all managed partners and could bulk edit them. Explanation: there are “managed” partners and “affiliates”. Out of Omnia Media’s roughly 1400 partners only 300 have the “managed” status. None of the 1100 partners with “affiliate” status were affected.
It seems like a security exploit with the YouTube API and neither Omnia Media nor YouTube adequately secured their systems against such attacks. Again, the API allows a third party, Omnia Media, to alter video details and this hack demonstrates how dangerous this is.
According to the video description that the hackers left behind, the goal may have been to showcase a security flaw with the current system.
None of the channels were compromised or hacked directly. The hackers did not obtain the passwords of these channels. An employee of Omnia Media confirmed to me that no personal data of us YouTubers was leaked during the attack.
All creators (including myself) still have access to their YouTube channels and social media. Everything should be fine once it gets fixed and the channels can keep posting videos.
Playlist names, channel names and video tags are not affected.
According to a tweet by Omnia Media, YouTube is actively working on restoring the video titles and descriptions. So at least they have backups and can roll back the metadata. Given that so many videos were hit at once it remains to be seen how swiftly YouTube will handle this. Most of these channels are well established and have been around for several years – so they have produced a large number of videos (many thousands on some). 6 hours after the hack none of my videos have been fixed yet. A handful of videos on other channels are fixed but it’s unclear if the creators changed them on their own or if YouTube did.

All of this begs the question why YouTube networks can change video details in the first place. They do not need and should not possess this power. Imagine a bigger network like BroadbandTV (230.000+ partners) or Fullscreen (54.000+ partners) getting hacked like this. Given that a very large amount of content creators is partnered through a network and not with YouTube directly this could cripple a huge part of the website.

UPDATE #1 – 9:30 PM (Pacific Time) April 01, 2017:

At approximately 9:30 PM pacific time (April 01, 2017) the hackers sent an email to people on Omnia Media’s email list, so it is possible they obtained email addresses of many YouTubers.

UPDATE #2 – 4:00 PM (Pacific Time) April 03, 2017:

YouTube has now fully reverted all titles and descriptions of my videos. A few single videos of other channels haven’t reverted yet, but they should soon. After the hack it took YouTube 48 hours to fix the affected channels (keep in mind the OurMine hack happened on a weekend). Thanks to the people at YouTube and Omnia Media for their quick help in this matter!

Updates are still coming in from Omnia Media’s twitter feed.

Aware of the issue – working to fix and will update everyone asap ^ AL

— Omnia Media (@OmniaMediaCo) 1. April 2017

For reference, no partner accounts have been compromised – updates shortly ^ AL

— Omnia Media (@OmniaMediaCo) 1. April 2017

The access point has been secured and YT is in the process of restoring meta data. More updates to follow ^ AL

— Omnia Media (@OmniaMediaCo) 2. April 2017

Update: YouTube, as of hours ago, is in the process of restoring meta data. No ETA given from their end – but it should be reverted soon.

— Omnia Media (@OmniaMediaCo) 2. April 2017

Meta data is being restored on all channels – it may take time to show fully. YouTube is and has been processing it overnight.

— Omnia Media (@OmniaMediaCo) April 2, 2017

Titles and descriptions should be nearly updated this morning – tags have been restored for February / March and continue to be resolved ^AL

— Omnia Media (@OmniaMediaCo) April 3, 2017

Omnia Media’s network reaches 1.8 Billion views each month. Below is a list of some of the channels affected.

This story will be updated when new details emerge. ~~It will be interesting to see how long YouTube needs to get things sorted.~~ (Update: It took YouTube 48 hours to revert the changes made by the hackers). If anything is to be learned from this, it’s that there are some very serious security flaws with YouTube’s current system and the privileges they allow YouTube networks to have.

By the way, this is NOT an April Fools’ Joke. I am now waiting for YouTube to fix my channel. It should all be fine in the end and Omnia Media confirmed that they locked out the hackers. For me only videos from the past few months are affected (all the way back to Battlefield 1). If you have trouble finding a video why not head over to my Trophy Guide pages. There you can find all videos embedded with their corresponding trophies. After all this is cleared up video uploads will resume as usual. Thanks for your understanding and ongoing support!

April 13, 2017 – Studio71 YouTube Network hacked by OurMine

On April 13, 2017 a new OurMine hack happened, but this time it’s partners of popular YouTube network Studio71 (aka “The Collective” or “CDS”) that had their titles and descriptions changed. Again, the hackers exploited the same weakness in YouTube’s API to change video titles and descriptions of many channels partnered with the network. Be sure to read what went down during Omnia Media hack for the full explanation. Not all channels signed under Studio71 are affected, presumably managed partners only. Studio71’s network includes over 12,000 channels that reach a combined 5 billion video views per month. The network is particularly popular among entertainment and vlogging channels.

The titles of affected channels were changed to:

#OurMine – https://youtu.be/IdJuVgR_-7M (Read the Description)

Some channels had their titles changed to unique names.
For example SuperwomanVlogs videos were renamed to:

DOPEST VLOG EVER

Wassabi Productions video titles were changed to:

YOU’RE AWESOME 🙂

The descriptions show the same text as with the Omnia Media hack:

Hey, it’s OurMine, don’t worry we are just testing your security, please contact us for more information

contactourmineteam@gmail.com
https://ourmine.org

Aside from targeting a different YouTube network, OurMine are also linking to a video URL in the titles they changed. Going to the video at https://youtu.be/IdJuVgR_-7M brings up an error:

Before the video was taken down it showed a short 14 second clip called “OurMine Security – Trailer – SOON!”. Sounds like this is not the last time we heard from them.

What are your thoughts on all this? Leave a comment below.

Share46

Shares 46

Comments

iVideo6S says

April 2, 2017 at 11:36 am

Yeah, I was watching a video, and I saw in the “Recommended for you” place, OurMine Are Back!… ( Read the description ). The YouTuber was a computer person, so I clicked it and looked in the description. There is said all that. I was so confused. I pressed the link and worked out they were hackers. I have another YouTuber for the list, they are:

EverythingApplePro (3.4M) Some of his videos have been hacked.

I think Google should make sure nobody can hack this, and block OurMine if they really hate this.

That is what I think.

- PowerPyx says
  
  April 2, 2017 at 4:20 pm
  
  I’ve added EverythingApplePro to the list. I’ll take a look at the affected channels again and add some more.
  I wish all this was an April Fools’ Joke – but it isn’t 🙁
  
  YouTube has now restored a dozen of my videos. Still many to go.
- Aliyah Bello says
  
  April 14, 2017 at 3:15 am
  
  Oh, hi. I’ve got here after I noticed Alex Wassabi’s video named changer from “they don’t like my new hair”, or something like that to ourmine… But then a lot of his videos were changed to “you’re awesome :)”. After that, I went to go check Lilly Song’s channel, and then I saw her video’s named are now “dopest video ever” and her vlogs are now “dopest vlog ever”. I really think that Youtube shouldn’t have any right to change so in the 1st place. I’m PRETTY sure that Lilly will be pissed about this though. PLZ FIX!!!????
- Aliyah Bello says
  
  April 14, 2017 at 3:17 am
  
  Oh, hi. I’ve got here after I noticed Alex Wassabi’s video named changer from “they don’t like my new hair”, or something like that to ourmine… But then a lot of his videos were changed to “you’re awesome :)”. After that, I went to go check Lilly Singh’s channel, and then I saw her video’s named are now “dopest video ever” and her vlogs are now “dopest vlog ever”. I really think that Youtube shouldn’t have any right to change so in the 1st place. I’m PRETTY sure that Lilly will be pissed about this though. PLZ FIX!!!????
- MaxBack says
  
  April 14, 2017 at 8:21 am
  
  Also GTlive has been hacked.
theredones says

April 2, 2017 at 12:43 pm

I reckon its just a April Fools thingy, funny how they hacked accounts on April 1st.
Hope it gets fixed soon…

BloxxerCreeperDTC says

April 2, 2017 at 1:53 pm

You forgot EverythingApplePro in the list

lol says

April 2, 2017 at 5:30 pm

dont forget idubbbz was hacked

Lol says

April 2, 2017 at 5:46 pm

Don’t forget Idubbz, ChrispyConcords, BlackScreenHDTV

KnobGoblin says

April 2, 2017 at 7:02 pm

What kind of “hackers” use gmail?

- j says
  
  June 29, 2020 at 3:10 am
  
  they probs only use that gmail adress in the description so people will think its really just a security thing
Holly says

April 3, 2017 at 1:14 am

Pyrocynical also got hit by this too

Wildeerie says

April 3, 2017 at 4:44 am

Thank god I thought I was not danger of being hacked thanks for clearing 5his up.looking forward to this being fixed ?

Nathan Molitor says

April 3, 2017 at 3:19 pm

i know it’s not an April fools joke because its like that for prestonplayz and ibxtoycat and ibxtoycat made a video about it

Hannah says

April 14, 2017 at 6:53 am

And Roman Atwood ana been hacked by all of his videos from 7 months ago hope you add him and Alex Wassibi to the list also reaction time got hacked PLZ ADD THEM and hope everything gets fixed again????……

- PowerPyx says
  
  April 14, 2017 at 7:22 am
  
  That’s crazy! There we go again… I just updated the article to reflect on the most recent hack from earlier today. Still expanding the list of affected channels.
- Kayla says
  
  April 14, 2017 at 4:49 pm
  
  Kalynxo13 got hacked.
Rayna Celloman says

April 14, 2017 at 8:47 pm

WHYYYYYY .Im just a fan wanting to watch guava juice and this is REALLY ANNOYING!!! SOMEONE FIX YOUTUBE!!At first I thought it was google testing security but then I saw it was a hack.???????????????????????????????????

Jasmine says

April 14, 2017 at 11:07 pm

I was watching reaction time and I noticed the titles were changed to “#our mine are back (read the description)” with a website and I was wondering what it was?! This needs to get fixed!!