By now, most Sri Lankans on the internet would have had seen the innumerable Facebook postings, tweets and YouTube remarks on the TV Derana hack catastrophe. In case you missed it: the TV Derana YouTube channel was hacked on 29 August, or rather hijacked, to live-stream a bitcoin fraud. Within the period of a few hours, the channel showed the bitcoin feed and nothing else. The channel was even changed to “Crypto News” – at which time duplicate accounts and commentary videos have began sprouting up to take Derana’s place.

The YouTube channel has finally been restored and Derana has recovered control. The channel is a YouTube partner account, which means it has direct access to YouTube’s priority assistance 24x7 – thus the overnight repair. “We would've been able to retrieve it sooner but owing to the date of the issue and the fact that our partner managers are at the Google Singapore office, things were a little bit more arduous,” General Manager of Digital Media at Derana, Janeeth Rodrigo, told Roar Media.

Rodrigo revealed that the attackers exploited a weakness in one of the remote access software and obtained access to a PC with pre-existing access to the TV Derana YouTube channel. This had allowed the hijackers to update the account’s login information as well as recovery emails and phone numbers without activating the Two-Factor Authentication (2FA) (2FA). 


This isn't a one-off occurrence.

There was conjecture that the episode was nothing more than a bad marketing ploy during the hacking, uncertainty, and, eventually, restoration. While the concept is funny, the facts indicate otherwise.

For starters, this wasn't a one-off occurrence. Several additional YouTubers, including singers Hakeem Prime and Alok Official, as well as JKK Entertainment, a channel with more than 30 million followers, have recently complained about their channels being hacked for a bitcoin video broadcast.

It’s also not the first time this has occurred on YouTube. Last year, hackers seized control of numerous prominent YouTube channels in a similar method. Live-streamed video of well-known personalities like Elon Musk and Jack Dorsey were followed up by changing the channels and adding popular keywords to boost the stream’s discoverability. Just like the broadcast on Derana’s channel, the video was surrounded by messages urging viewers to give a certain sort of bitcoin with a special link placed in the description. It was believed that hackers gained as much as USD 10,000 after two hours’ worth of live broadcasting. It’s unknown how much the assailants made off with this time.

The assault is also reminiscent of a similar event that took place on Twitter in the same year when numerous high-profile Twitter accounts such as those belonging to Bill Gates, Jeff Bezos and Elon Musk were exploited to promote a bitcoin hoax using an internal Twitter tool.


A Problem For Tech Giants That Hasn't Been Solved

Following last year’s episodes, both Ripple’s CEO Brad Garlinghouse and Apple Co-founder Steve Wozniak sued YouTube over the bogus material. Garlinghouse said that the company’s inactivity on its platform undermined Ripple’s credibility. Wozniak voiced similar feelings, stating that Google enabled bitcoin giveaway frauds to flourish while utilizing his picture. However, these cases have left several unsolved concerns surrounding the schemes.

Cryptocurrency scams are nothing new. Back in 2017, bitcoin’s price began at USD 1,000 but rocketed up to approximately USD 20,000 in less than a year. This made bitcoin and other cryptocurrencies more mainstream. All of a sudden, everyone was talking about it; however with this came a flood of bitcoin frauds as well.

It is an increasingly troubling trend, one that huge digital platforms appear to be failing to solve. Even with Google’s ad standards in place, scammers continue to occur. One analysis indicated that YouTube viewers lost USD 24 million in bitcoin during only the first six months of 2020 alone.

A portion of the issue is the sheer amount of harmful information that enters via these sites. In 2019, Google eliminated 2.3 billion inappropriate advertisements. Navigating through such a volume offers a task on its own.

But from a larger viewpoint, an argument may be made on whether these corporations are incentivised to actively suppress dangerous information at all. Advertising is the lifeblood of sites like YouTube and Facebook. So, the more regulations that are established, the more advertising would vanish off the site. Such active engagement may also drive users to resist and maybe even migrate away from the site.


The Unanswered Question in Sri Lanka

In reference to the Derana issue, Rodrigo claimed that the firm has now established its own VPN in order to enable internal teams to safely use their work PCs from home. He also claimed that Derana would be performing a full cybersecurity audit to discover any weaknesses.

So what should one do? Not every account will have access to services like TV Derana’s YouTube channel. It begins with preventative steps at the individual level. Enabling 2FA wherever feasible, using unique passwords for every digital account and utilizing a trustworthy password manager are all easy practical actions that might possibly lessen security threats.

At an organisational level, Rodrigo suggests a few more actions such as implementing an in-house VPN when remote work is required, limiting remote access to priority PCs, and keeping your softwares and antivirus defenses updated, among other precautions.

However, this is just a portion of the equation. Incidents like the Derana attack suggest a wider concern with Sri Lanka’s internet presence and the overall attitude towards cybersecurity. The idea that a 3 million+ subscriber YouTube channel belonging to such a high-profile mainstream media institution can be hacked so quickly should be concerning. Then then, Sri Lanka doesn’t have the finest track record when it comes to cybersecurity.

The issue of how much significance Sri Lanka puts on cybersecurity remains unaddressed and the constant lack of attention translates to costly ramifications — especially during a pandemic, and an increasing number of frauds of this sort. They say that prevention is better than cure — and that’s no different when it comes to cybersecurity.