Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

151–160 of 325 posts

Re: Twitch is hacked, and its source code leaked

#151

Post by cpach »

tptacek wrote: post #96
leros wrote: post #8

Earlier quoted context omitted.

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

There was a fad for tools that accomplished this in enterprise networks, with much clearer rules for who needs to access what (it was called "data loss prevention", or DLP) and those tools for the most part don't work. This is a harder problem than it looks like.

Thank you for mentioning this. I always had a gut feeling that it seems like an extremely hard problem to solve in a sensible way.

Re: Twitch is hacked, and its source code leaked

#152

Post by nemothekid »

Hokusai wrote: post #90
nemothekid wrote: post #19

Earlier quoted context omitted.

> Because you expect Amazon to put security priority over new features and profit? I don't know what you think Amazon stands for, but Amazon runs the largest cloud hosting service in the world - AWS, which not only runs a large number of other large companies but governments as well. I know, first hand, that their datacenter security protocols are state of the art. Amazon has a much larger surface attack area so if t…

> Amazon has a much larger surface attack area so if they were playing fast and loose with security, chances are we would know already. I get your point and I am no taking about AWS but about Twitch. Each part of the company has its own incentives. Amazon is well know for not caring about quality nor its employees. In my experience with corporations there is little to no technical sharing between different parts of t…

I'm not sure what point you are trying to make. If you look at most of the high profile hacks and leaks in the past 20 years, very few of them are from web 2.0 tech companies (e.g. Google, Facebook) rather than dinosaurs (ex. Target). Those that have (like Google) have only been successfully breached by nation actors (e.g. China, NSA).

As far as I can tell, there's no data to back up the assertion that these large tech companies are disregarding security if favor of profits, except for Twitch now, which is why this leak is interesting to me.

Re: Twitch is hacked, and its source code leaked

#153

Post by ljm »

madrox wrote: post #144
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

Why would an intern at Twitch have access to data in production?

Saying that no 'secrets' were leaked is effectively burying the lede.

Re: Twitch is hacked, and its source code leaked

#154

Post by [deleted] »

twistedpair wrote: post #148
madrox wrote: post #144

Earlier quoted context omitted.

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

So much for information compartmentalization. Does the typical engineer need access to payment details for their daily work?

[deleted]

Re: Twitch is hacked, and its source code leaked

#155

Post by ABeeSea »

twistedpair wrote: post #148
madrox wrote: post #144

Earlier quoted context omitted.

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

So much for information compartmentalization. Does the typical engineer need access to payment details for their daily work?

Part of the appeal is working at a place like Amazon is having a voice in decision making in the product you’re building. Hard to make informed decisions or opinions without the data. Engineers in Amazon retail definitely have broad access to sales data.

Re: Twitch is hacked, and its source code leaked

#156

Post by madrox »

ljm wrote: post #153
madrox wrote: post #144

Earlier quoted context omitted.

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

Why would an intern at Twitch have access to data in production? Saying that no 'secrets' were leaked is effectively burying the lede.

By secrets, I mean salts, password hashes, etc.

Re: Twitch is hacked, and its source code leaked

#157

Post by tfigment »

tptacek wrote: post #96
leros wrote: post #8

Earlier quoted context omitted.

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

There was a fad for tools that accomplished this in enterprise networks, with much clearer rules for who needs to access what (it was called "data loss prevention", or DLP) and those tools for the most part don't work. This is a harder problem than it looks like.

My company has this. It encrypts any file touched on USB. And other software logs every app run. Prevents casual copying but easily circumvented. But somewhere logs may have enough info to trace the source of leak I guess.

Re: Twitch is hacked, and its source code leaked

#158

Post by ABeeSea »

leros wrote: post #8
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

ML engineers / data scientists are regularly moving terabytes of data around at Amazon.

Re: Twitch is hacked, and its source code leaked

#159

Post by xorcist »

growt wrote: post #140
axpy906 wrote: post #87

Earlier quoted context omitted.

Pretty much this. If they gain one email/username password combination - they can use it elsewhere.

If they are properly hashed and salted, they can not.

The point here is that once you brute force the plaintext password, the same password might be used elsewhere.

Re: Twitch is hacked, and its source code leaked

#160

Post by ihattendorf »

madrox wrote: post #156
ljm wrote: post #153

Earlier quoted context omitted.

Why would an intern at Twitch have access to data in production? Saying that no 'secrets' were leaked is effectively burying the lede.

By secrets, I mean salts, password hashes, etc.

> You also get access to every streamer's dashboard and their analytics

I would classify that as access to production systems.

Post reply on HN