Twitch is hacked, and its source code leaked

#1

Post by goldenzun » Wed, Oct 06, 2021, 4:18 PM UTC

Twitch is hacked, and its source code leaked
kotaku.com

Re: Twitch is hacked, and its source code leaked

#2

Post by nemothekid » Wed, Oct 06, 2021, 4:50 PM UTC

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes

* Entire git histories

* Internal/Private AWS SDKs

* Encrypted Password dumps and payout reports

It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate web 2.0 startup who's gotten owned in a similar fashion. Could the same attack work on Amazon? YouTube?

It's also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data? Maybe they did try to ransom it, but I'd imagine someone with this kind of access inside Twitch must have had some creative way of making money.

Re: Twitch is hacked, and its source code leaked

#3

Post by _qbjt » Wed, Oct 06, 2021, 4:51 PM UTC

More discussion here: https://news.ycombinator.com/item?id=28770590

Re: Twitch is hacked, and its source code leaked

#4

Post by skilled » Wed, Oct 06, 2021, 4:59 PM UTC

nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

I'm hoping we will get to see a transparent report (from hacker or Twitch) on how this happened.

I think anyone would be excited to hack Twitch as the site alone - or any big platform for that matter - but this is quite literally someone just downloading the entire Twitch ecosystem and publishing it online.

Re: Twitch is hacked, and its source code leaked

#5

Post by ChrisArchitect » Wed, Oct 06, 2021, 5:03 PM UTC

lots of discussion and speculation from a few hours ago here:

https://news.ycombinator.com/item?id=28770590

Re: Twitch is hacked, and its source code leaked

#6

Post by Hokusai » Wed, Oct 06, 2021, 5:05 PM UTC

nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

> this isn't something I'd expect from an Amazon owned property

Because you expect Amazon to put security priority over new features and profit? We have very different understandings of what Amazon stands for.

Re: Twitch is hacked, and its source code leaked

#7

Post by FormerBandmate » Wed, Oct 06, 2021, 5:05 PM UTC

nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

I mean, it did work on Amazon (a division with poorer security probably, but still). 4chan is a truly special place

Re: Twitch is hacked, and its source code leaked

#8

Post by leros » Wed, Oct 06, 2021, 5:09 PM UTC

nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

Re: Twitch is hacked, and its source code leaked

#9

Post by koolba » Wed, Oct 06, 2021, 5:09 PM UTC

nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

How much of this is a holdover of lax security practices from before they were acquired? I can’t imagine AWS being managed in a way where local network access gives you keys to the kingdom. Then again, EC2 instance profiles do let you do quite a bit.

Re: Twitch is hacked, and its source code leaked

#10

Post by ArlenBales » Wed, Oct 06, 2021, 5:10 PM UTC

nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

There are so many indiscreet USB pentesting devices easily purchasable by anyone today, I'm actually surprised this sort of thing doesn't happen more often.