Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

201–210 of 325 posts

Re: Twitch is hacked, and its source code leaked

#201

Post by skilled »

isbvhodnvemrwvn wrote: post #179
skilled wrote: post #163

Earlier quoted context omitted.

This statement makes no sense. The leak includes source code of multiple active websites and applications that are operated under the umbrella of Twitch/Amazon. Why would an intern have access to this data?

In many companies source code for all products is available to each and single developer.

In what world does all this data in the leak would be stored together in a unified ecosystem? It makes absolutely no sense.

If you're saying that Twitch runs their developer environment in a lousy manner (and you have proof of this), then please go ahead.

But to imply that an intern/average developer would be given access to all this branching information is ignorant.

Re: Twitch is hacked, and its source code leaked

#202

Post by dilyevsky »

nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

> I can't think of another, large, corporate web 2.0 startup who's gotten owned in a similar fashion

Linkedin, Microsoft, Yahoo, Google

Re: Twitch is hacked, and its source code leaked

#203

Post by unethical_ban »

tptacek wrote: post #96
leros wrote: post #8

Earlier quoted context omitted.

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

There was a fad for tools that accomplished this in enterprise networks, with much clearer rules for who needs to access what (it was called "data loss prevention", or DLP) and those tools for the most part don't work. This is a harder problem than it looks like.

DLP products tend to be more about scanning the contents of data for sensitive patterns, at least in my observation of the market. There are other products (typically built into SIEM) that do correlation on login events, network traffic and whatnot to detect anomalous behavior.

Re: Twitch is hacked, and its source code leaked

#204

Post by nullifidian »

lm28469 wrote: post #67
runawaybottle wrote: post #15

Does it take a genius to figure out how to build twitch? It’s a modern crud app with video streaming.

Everything is just a crud app with a few extra steps.... yet you're not Zuckerberg or Dorsey

One shouldn't aspire to be a Zuckerberg/Dorsey.

Re: Twitch is hacked, and its source code leaked

#205

Post by maccard »

shkkmo wrote: post #199
maccard wrote: post #183

Earlier quoted context omitted.

It is! I guess using a password from Google isn't the best idea, and kind of defeated the point of what I wanted to ask (if your password isn't already hashed online how long does it actually take to break a sha1 hash), but definitely proves the point. Can I try again? Sha1 e7b7cdf949007abe7e8a190ba8eae56c60018c1f

The point of the salt isn't that it makes it take longer to break any one password. What it does is prevent you from re-using the rainbow table you generate breaking one password when you break the next one. Sha1 is not a very secure/expensive hashing algorithm and thus does make it significantly cheaper to break even with a unique salt.

> Sha1 is not a very secure/expensive hashing algorithm and thus does make it significantly cheaper to break even with a unique salt.

Ok, so how long does it take to break the hash I've provided if it's not very secure?

Re: Twitch is hacked, and its source code leaked

#206

Post by zerkten »

oconnor663 wrote: post #169
twistedpair wrote: post #148

Earlier quoted context omitted.

So much for information compartmentalization. Does the typical engineer need access to payment details for their daily work?

The tradeoffs for any individual piece of data are different from the tradeoffs of a company-wide policy. Siloing off one little thing (e.g. credit card info) usually doesn't inconvenience very many people, but at the same time it only provides marginal security. No front page headline has ever read "At Least The Credit Card Info Was Safe". On the other hand, a company-wide policy of siloing everything can have more…

I don't see how this precludes just-in-time access. Even if people can re-up on their own, you can still observe the data access patterns and manage the risk. Further, when you see someone is getting blocked a lot you can improve the experience for them so they are unblocked, or have more efficient access to the data. This is just mature data and security management.

Quality of life and developer experience are important topics in many ways, but should they really trump security consistently? It's always going to be dependent on people's risk assessment and comfort, but frequently it skews the wrong way because the people making the decisions know that they'll be gone.

Re: Twitch is hacked, and its source code leaked

#208

Post by popotamonga »

madrox wrote: post #144
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

I worked for a multi billion company and even 6 month contractors had access to basically everything with little effort.

Re: Twitch is hacked, and its source code leaked

#209

Post by rcfaj7obqrkayhn »

kreitje wrote: post #141
whimsicalism wrote: post #130

Earlier quoted context omitted.

?

They check the referrer, see it's from HN and redirect to an image instead. So by copy + paste into a new tab, it will lose the HN referrer.

on firefox, disabling referrer means you won't see the image

    network.http.sendRefererHeader = 0

Re: Twitch is hacked, and its source code leaked

#210

Post by manquer »

DavidPeiffer wrote: post #44

I'd be interested if someone could get their own instance of Twitch up and running from this leak. Someone mentioned internal API's, which would have to be reworked to avoid detection, but it'd be interesting to host it on AWS just to see how long it takes to get shut down. How would current AWS policies hold up? Obviously the code would be illegally acquired, but do they have detection mechanisms in place?

Even with source code it is hard to run a service if not impossible. You would need well written documentation that explains various options and error codes you could potentially get.

Many times there is some magic command only one guy knows and he will share with you on slack.

Rubbing a service of any complexity takes years of institutional knowledge.

Post reply on HN