A Russian security researcher discovered a flaw in YouTube that allowed anyone to delete any video uploaded to the site, The Register reports.
Kamil Hismatullin was searching for security vulnerabilities in YouTube in order to try and win one of the cash rewards that Google hands out to researchers.
Hismatullin found that it was easy to fool YouTube into deleting any video on its system. He was looking through the code for managing livestreams, and discovered a simple option to wipe any video from YouTube.
This is the code that Hismatullin found in YouTube:
POST https://www.youtube.com/live_events_edit_status_ajax?action_delete_live_event=1
event_id: ANY_VIDEO_ID
session_token: YOUR_TOKEN
The key part there is "delete_live_event." All Hismatullin had to do was fill in the ID of a YouTube video, and YouTube would delete it without checking whether he was actually allowed to.
Here's a video from Hismatullin that explains what he found:
"I've fought the urge to clean up Bieber's channel," Hismatullin said. "Luckily no Bieber videos were harmed." He reported the issue to Google, and the company fixed the problem within several hours. Hismatullin was also given $5,000 for finding the problem.
NOW WATCH: How a YouTuber became one of the internet's most influential teachers
See Also:
