Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

111–120 of 325 posts

Re: Twitch is hacked, and its source code leaked

#111

Post by cheeze »

leros wrote: post #8
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

I feel like once you have it pulled downm, it would be as simple as an upload to s3 (which wouldn't trigger any flags), then making the bucket public whenever you want. Hell, S3 used to (still does?) support being part of a torrent swarm...

Re: Twitch is hacked, and its source code leaked

#112

Post by INTPenis »

frays wrote: post #109

As an avid Twitch streamer, what do I need to do to protect myself?

Change your password obviously, maybe even reset your 2FA if those codes are in the leak.

And if you want to be perfectly safe, don't visit twitch. Because if that source code has any vulnerabilities they might be exploited against twitch visitors as we speak.

Re: Twitch is hacked, and its source code leaked

#113

Post by franga2000 »

twofornone wrote: post #92
tyingq wrote: post #76

Earlier quoted context omitted.

>Then I'm not sure what you can even do with those Assume some end users used the same passwords on other, non-twitch accounts. That's what makes hacked passwords valuable, no matter where they came from.

That's something I've wondered - do password hashes tend to be the same across platforms? Is everyone using the same hashing algorithm? Isn't this also what salting is for? Never implemented auth myself.

If everyone did things the way they're supposed to then no, hashes should never be the same between platforms. Using the same algorithm is likely, but as you said, salting solves that.

But mistakes such as salting with just the username are sometimes made even by very large companies and in that case, hashes could be the same.

Re: Twitch is hacked, and its source code leaked

#114

Post by throw_m239339 »

runawaybottle wrote: post #15

Does it take a genius to figure out how to build twitch? It’s a modern crud app with video streaming.

Like all things web, the problem is scaling the platform and moderation/security. It wouldn't be hard to build a toy Twitch clone no. But it takes tons of people and money to scale it / secure it. And even with all the security, they still got hacked...

Re: Twitch is hacked, and its source code leaked

#115

Post by notsureaboutpg »

frays wrote: post #109

As an avid Twitch streamer, what do I need to do to protect myself?

If the literal source code is leaked, you should:

Change your password (and if you used this password at any other site, change it there too). You might want to put a hold on the credit card you stored info of with Twitch (for any followers).

If the source code is compromised, other attacks are possible. Depending on how the code works, it may be possible for attackers to successfully charge your followers while you stream. It would be very easy to phish your followers with a website that looks like twitch but is in fact twtich.com for example. And then charge them when they think they are donating to you.

It's honestly probably going to hit you hard if you have to move to an alternative service. But you have to weight that against the very real threat of this leak being used to steal from your followers or you.

Re: Twitch is hacked, and its source code leaked

#116

Post by asddubs »

duskwuff wrote: post #46
lapetitejort wrote: post #33

Earlier quoted context omitted.

I found out how to destroy reddit. Just fork their repos! https://github.com/reddit

Sadly, Reddit stopped updating the public repo for their main application in 2017: https://github.com/reddit-archive/reddit

so it won't even have new reddit, even better!

Re: Twitch is hacked, and its source code leaked

#117

Post by cheeze »

xmprt wrote: post #53
bawolff wrote: post #38

Earlier quoted context omitted.

Its still more secure. Rubber hose cryptanalysis applies to both equally, but that doesn't mean there aren't other attacks that apply to totp which don't to yubikeys. More secure != perfectly secure.

With a phone you need my passcode to accept to 2FA request (assuming lock screen notifications are disabled). I think yubikeys can work without a passcode as long you plug it in right?

It's still the same, 2fa.

With a Yubikey, you need to use your password to log in to your computer, and then need to auth using Yubikey.

With OTP app, you need to use your password to log into your computer, passcode for phone, and then auth.

In both cases, it's something you know, and something you have. You could argue that the app based is a bit more secure in that you need two passwords. On the flipside, if your phone gets pwned, someone can access completely remote.

Everything is a tradeoff.

Re: Twitch is hacked, and its source code leaked

#120

Post by rasz »

> including its source code

This will help with ad preroll blockers.

I would love to see someone look deep into Twitch recommendation system - last time I tested the thing they call "Feedback" is a rolling buffer and wont let you exclude more than ~100 things, adding more simply removed oldest entries and started spamming you with things you already excluded in the past. This looked like performance optimization (less things to track per user).

Post reply on HN