Hacking YouTube to watch private videos?

This bug was found by David Schütz. Check out his write up on his blog: https://bugs.xdavidhu.me/google/2021/01/11/stealing-your-private-videos-one-frame-at-a-time/

This bug that existed in Google's backend API allowed an attacker to watch a private video on youtube without having the required permissions. The attacker can view the youtube video by stealing it one frame at a time. This bug existed in an embedded YouTube player on Google Ads. The Google Ads feature "Moments" was exploited to steal individual thumbnails (or frames) of any private video, which can be combined to form the video.

Google awarded 5000$ reward for this discovering this bug to the author David Schütz.

Join my Discord Server: https://discord.gg/7h2Eb7y Follow me on Instagram: https://instagram.com/teja.techraj Follow on Twitter: https://twitter.com/techraj156

Website: https://techraj156.com Blog: https://blog.techraj156.com ... https://www.youtube.com/watch?v=hV9CWw0yDA8