Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

161–170 of 325 posts

Re: Twitch is hacked, and its source code leaked

#161

Post by ljm »

leros wrote: post #8
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

Why would that help? They just have to accumulate work over a period of time and then 'lose' their laptop.

Re: Twitch is hacked, and its source code leaked

#163

Post by skilled »

madrox wrote: post #156
ljm wrote: post #153

Earlier quoted context omitted.

Why would an intern at Twitch have access to data in production? Saying that no 'secrets' were leaked is effectively burying the lede.

By secrets, I mean salts, password hashes, etc.

This statement makes no sense.

The leak includes source code of multiple active websites and applications that are operated under the umbrella of Twitch/Amazon.

Why would an intern have access to this data?

Re: Twitch is hacked, and its source code leaked

#165

Post by mindwok »

evandwight wrote: post #131
franga2000 wrote: post #113

Earlier quoted context omitted.

If everyone did things the way they're supposed to then no, hashes should never be the same between platforms. Using the same algorithm is likely, but as you said, salting solves that. But mistakes such as salting with just the username are sometimes made even by very large companies and in that case, hashes could be the same.

Why does it matter if hashes are the same? That only tells you the passwords are the same.

If they are the same everywhere, you can precompute a huge database of hashes (called a rainbow table) and simply lookup the hash in the table when breaches occur to find the password. By salting, every provider who stores credentials has different hashes for the same inputs which makes the approach far less attractive at a large scale.

Re: Twitch is hacked, and its source code leaked

#166

Post by maccard »

errantspark wrote: post #128
nemothekid wrote: post #28

Earlier quoted context omitted.

> It's possible that this first leak was just to establish trust so they can random or auction password hashes later. Password hashes are relatively useless though? Once the leak is announced I imagine most of the big targets will rotate their credentials. Then the next thing you need to do is spend possibly thousands in CPU time bruteforcing bcrypt hashes. Then I'm not sure what you can even do with those. I'm not c…

A few things here. If you're the sort of person who runs a crypto mine, which I assume many of the people interested in breaking hashes are you have enough firepower at your disposal to at least perform a targeted attack on a few hashes with relative ease. Ideally that would be useless because things are properly salted and you don't know the salt, however with access to all of the source code as we have here I think…

I've heard this before, and queried how feasible an attack would be, as people always talk about just how bad this is but yet I've _never_ heard of someone having an account compromised through this vector, and I'd like to know how feasible it really is. Here's the sha1 of an unsalted password b85ffa7dae2cbed04e7d3335f6ebc43c8a5764dd

How long does it actually take in practice to break something like this? I would love it if someone could prove it to me.

Re: Twitch is hacked, and its source code leaked

#167

Post by AustinDev »

Raidion wrote: post #86
com2kid wrote: post #32

Earlier quoted context omitted.

> Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere. I am trying to recall, but I am pretty sure when I worked in Microsoft Office that a build would pull down many tens of gigabytes of data. 125GB in one day from the build system wouldn't be uncommon!

That's ingress though. Companies should be monitoring and worrying about egress. Edit: This won't help against a thumbdrive, but that type of thing should be also tracked.

I'm working on a project and just had to repull my workspace after some local corruption. I pulled 1.2TB out of the office and never got an email. I think it's pretty common for places not to monitor egress that closely.

Re: Twitch is hacked, and its source code leaked

#168

Post by AustinDev »

yupper32 wrote: post #16
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

Does anyone know if Twitch employees have two factor auth? Having access to an employee's account would be the easiest way to pull this off. It'd be strange if they don't have two factor auth, of course, but it's just as strange to have this large of a hack. I think if it is a simple case of an employee account takeover, then the attack would "work" to some extent at any company. Larger companies typically have stric…

Every Twitch Developer has 2FA even 3rd party developers are required to have 2FA I also think, but don't know, that this applies to Twitch Broadcaster Partners as well in order to have their tax information in the system.

Luckily iirc from a conversation with a senior Twitch engineer the Tax information backend has been migrated to Amazon. So hopefully that did not leak... Because that would be full legal name and addresses of a ton of streamers that likely have stalkers.

Re: Twitch is hacked, and its source code leaked

#169

Post by oconnor663 »

twistedpair wrote: post #148
madrox wrote: post #144

Earlier quoted context omitted.

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

So much for information compartmentalization. Does the typical engineer need access to payment details for their daily work?

The tradeoffs for any individual piece of data are different from the tradeoffs of a company-wide policy. Siloing off one little thing (e.g. credit card info) usually doesn't inconvenience very many people, but at the same time it only provides marginal security. No front page headline has ever read "At Least The Credit Card Info Was Safe". On the other hand, a company-wide policy of siloing everything can have more of a security impact, but it also inconveniences everyone frequently. That's the tradeoff that many tech companies don't want to make.

Re: Twitch is hacked, and its source code leaked

#170

Post by jaredsohn »

maccard wrote: post #166
errantspark wrote: post #128

Earlier quoted context omitted.

A few things here. If you're the sort of person who runs a crypto mine, which I assume many of the people interested in breaking hashes are you have enough firepower at your disposal to at least perform a targeted attack on a few hashes with relative ease. Ideally that would be useless because things are properly salted and you don't know the salt, however with access to all of the source code as we have here I think…

I've heard this before, and queried how feasible an attack would be, as people always talk about just how bad this is but yet I've _never_ heard of someone having an account compromised through this vector, and I'd like to know how feasible it really is. Here's the sha1 of an unsalted password b85ffa7dae2cbed04e7d3335f6ebc43c8a5764dd How long does it actually take in practice to break something like this? I would lov…

Is the password ncc1701e?

I just googled it and found https://hashtoolkit.com/decrypt-sha1-hash/b85ffa7dae2cbed04e... along with other results.

Post reply on HN