A small community of people who search for adult content on YouTube has discovered a bug that allows them to continue hosting porn on YouTube, even if their channels are deleted.
The person who claims to have originally discovered the exploit and explained how it works in a YouTube video has since had that video removed and says that YouTube has fixed the bug, but as I am typing this my second monitor is playing a very explicit hentai that’s been up on YouTube since at least September 21, posted by a YouTube channel that was “terminated” at least five days earlier. YouTube only removed this video after I sent it the link directly.
I first ran into the exploit while reporting on the exclusive club of YouTube porn searchers, who scour Google’s massive video sharing platform for videos that contain nudity that either doesn’t violate YouTube’s guidelines, or go undetected even if they do. At some point, I saw a thumbnail on the Discord featuring Sweetie Fox, currently Pornhub’s #1 performer in its “Pornstars” category. Clicking on the link took me to YouTube, where I saw a hardcore porn video that was clearly taken from her channel, including the Pornhub pre-roll.
Aside from the fact that the video had been up for a couple of weeks, which was rare for hardcore porn even in the YouTube porn searchers community, I was more confused by the fact that YouTube’s user interface didn’t load correctly. The search bar, the video itself, and the sidebar of thumbnails recommending other videos loaded, but nothing else: no channel title, video title, view count, likes, or comments. Everything under the video was just a blank space:
I soon discovered a handful of other porn videos, also lifted from Pornhub, that were live on YouTube for a few weeks, and that similarly made YouTube’s UI disappear. While the videos’ titles and account names failed to load on YouTube itself, the links shared on Discord generated previews that showed the name “Starsito Gang.” Clicking on the account name in the preview Discord generated took me to a YouTube page that said the account was removed, even though the video itself was still available to watch.
Some video titles also contained a link to another Discord channel. In that Discord channel, a couple of Spanish speaking admins were sharing the videos, which they explained were uploaded to YouTube via a bug that would make them impossible to remove. They refused to share exactly how this bug worked, despite other users begging for details.
“This doesn’t actually bypass [YouTube’s] algorithm. In fact, YouTube detects the video almost instantly,” one of the admins said. “However, we use a glitch that makes it so the video cannot be deleted.”
“Decí cómo es ese método compañero,” one user in the Starsito Gang Discord wrote, asking for the admin to tell him how to use the exploit.
“Secreto del estado,” the admin responded, saying it’s a “state secret.”
Back on the YouTube porn searching Discord, eventually someone uploaded a video that claimed to show how the exploit worked, but that video was also deleted by the time I got to it. I was, however, able to contact the person who uploaded it, a user who goes by </Angled> online and who has uploaded many videos about various YouTube exploits.
Subscribe
</Angled> told me that the exploit worked by breaking YouTube’s video tagging system, the field you use to add tags to your video when uploading.
“The way the bug worked was by using something called a newline, which YouTube very rarely counts as an actual character,” </Angled> said. “It’s basically what is written when you type the return key on your keyboard. By spamming millions of these characters in the videos tags, using a proxy, it would prevent visibility changes on the video, such as setting it from public to private, or deleting it all together.”
On the YouTube porn searching Discord, one user also shared a .txt file containing 4 million characters, which they said others could use by inserting it three times into uploads. </Angled> also sent me the video tutorial that was deleted from YouTube, titled “Un-deletable YouTube Video," showing the bug, which I’ve embedded below.
“I initially discovered the bug by just messing around with new lines & video settings,” </Angled> said “It’s been well known inside of the little YouTube community we have—not the porn one in [404 Media’s] article, that type of crap is vile and weird—that new lines could be used for getting certain things over the character limit, such as channel descriptions and sometimes names. I tried video descriptions & titles and it didn’t work. But for video tags, it did.”
</Angled> said that YouTube has fixed the bug, because “enough people spammed them on Twitter and eventually one of their outsourced staff was competent enough to report it. Or perhaps my channel has attracted the attention of a YouTube employee, that went and reported it themselves.”
Many of the videos that used the exploit that I initially found were removed, but not all. </Angled> said that YouTube will probably get around to it eventually.
I personally could not find a technical pattern for why some porn videos that used the exploit were removed and others were not. All I noticed is that the porn videos featuring live performers were gone while the hentai was still live.
I emailed Google spokesperson Jack Malon with a detailed explanation of how the exploit works, and a link to one of the deleted videos, including a screenshot of that video’s thumbnail and title generated in a Discord preview. At first, Malon asked me if I could send him a link to one of the videos that wasn’t removed, and to clarify “the purpose of highlighting it.” I explained that the people who were using the exploit thought that YouTube will not be able to find the porn they uploaded to the platform unless someone pointed YouTube at the videos directly. So, me sharing the video would directly undercut what I was trying to verify—whether YouTube actually had the capability of finding these videos itself.
At 10:45PM ET we got on a call, and Malon again said that Google would not be able to comment on whether or not it fixed an exploit, and whether anyone used this exploit to upload porn to the platform, unless I sent him a link to live video that used the exploit, despite Google already having a link to a video it removed.
After the call I sent Malon a link to a video, which was quickly removed. “We're aware that a small number of videos may have remained on YouTube following a channel termination,” he said. “We're working to fix this and remove the content from the platform.”
Update: This article was updated with comment from YouTube spokesperson Jack Malon.
