Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

171–180 of 325 posts

Re: Twitch is hacked, and its source code leaked

#171

Post by exitheone »

errantspark wrote: post #128
nemothekid wrote: post #28

Earlier quoted context omitted.

> It's possible that this first leak was just to establish trust so they can random or auction password hashes later. Password hashes are relatively useless though? Once the leak is announced I imagine most of the big targets will rotate their credentials. Then the next thing you need to do is spend possibly thousands in CPU time bruteforcing bcrypt hashes. Then I'm not sure what you can even do with those. I'm not c…

A few things here. If you're the sort of person who runs a crypto mine, which I assume many of the people interested in breaking hashes are you have enough firepower at your disposal to at least perform a targeted attack on a few hashes with relative ease. Ideally that would be useless because things are properly salted and you don't know the salt, however with access to all of the source code as we have here I think…

The salt is usually stored next to the password. The point of a salt is just to make the hash unique to prevent the use of rainbow tables, it's not a separate secret.

Re: Twitch is hacked, and its source code leaked

#172

Post by AustinDev »

yupper32 wrote: post #63
CoolGuySteve wrote: post #55

Earlier quoted context omitted.

"Sorry. Unless you’ve got a time machine, that content is unavailable." Too bad, it would be nice to see someone go through and document how Twitch works. I've never worked at "web scale" so I'd probably learn a lot.

> I've never worked at "web scale" so I'd probably learn a lot. As someone who has worked at both large and small companies, you'd probably be disappointed.

It's likely lots of bubble gum and chicken wire. I'm sure in the video ingest and transcode side of things there are some really interesting bits though. When you're owned by Amazon you don't need to optimize too much to achieve web scale... just leverage AWS services. It's not like you're going to get a bill.

Re: Twitch is hacked, and its source code leaked

#173

Post by ljm »

madrox wrote: post #156
ljm wrote: post #153

Earlier quoted context omitted.

Why would an intern at Twitch have access to data in production? Saying that no 'secrets' were leaked is effectively burying the lede.

By secrets, I mean salts, password hashes, etc.

Why is getting access to prod, or prod data, considered a perk, exactly?

Re: Twitch is hacked, and its source code leaked

#174

Post by AustinDev »

iuri1 wrote: post #129

Since the main leaked files are from github, I'm assuming they got it from one of the many reported github auth flaws which don't get fixed and allows access to private repositories. Or more unlikely, via someone getting sloppy with their laptop. Now I wonder if the commit history has database dumps or sensitive information, which is a common practice, or if any twitch servers have been accessed through a breach or p…

I'm pretty sure a company of Twitch's size uses on-premise GitHub.

Re: Twitch is hacked, and its source code leaked

#176

Post by isbvhodnvemrwvn »

skeeks wrote: post #147
axpy906 wrote: post #87

Earlier quoted context omitted.

Pretty much this. If they gain one email/username password combination - they can use it elsewhere.

I would be very deeply concerned if Twitch, a multi-billion dollar company owned by Amazon, does not properly hash and salt the passwords of its users.

You don't brute force it, you find the password for accounts with the same e-mail in leaks from other sites and try only those.

Re: Twitch is hacked, and its source code leaked

#177

Post by [deleted] »

madrox wrote: post #144
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

[deleted]

Re: Twitch is hacked, and its source code leaked

#179

Post by isbvhodnvemrwvn »

skilled wrote: post #163
madrox wrote: post #156

Earlier quoted context omitted.

By secrets, I mean salts, password hashes, etc.

This statement makes no sense. The leak includes source code of multiple active websites and applications that are operated under the umbrella of Twitch/Amazon. Why would an intern have access to this data?

In many companies source code for all products is available to each and single developer.
Post reply on HN