Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

211–220 of 325 posts

Re: Twitch is hacked, and its source code leaked

#211

Post by whack »

AustinDev wrote: post #172
yupper32 wrote: post #63

Earlier quoted context omitted.

> I've never worked at "web scale" so I'd probably learn a lot. As someone who has worked at both large and small companies, you'd probably be disappointed.

It's likely lots of bubble gum and chicken wire. I'm sure in the video ingest and transcode side of things there are some really interesting bits though. When you're owned by Amazon you don't need to optimize too much to achieve web scale... just leverage AWS services. It's not like you're going to get a bill.

> When you're owned by Amazon you don't need to optimize too much to achieve web scale... just leverage AWS services. It's not like you're going to get a bill.

Oh you're be surprised. Divisions get billed constantly for the AWS resources they consume, and this bill gets taken out of their annual budget. From what I hear, this is a common practice in most large organizations.

Also, the AWS services you can access from within Amazon are almost identical to the AWS services you can access as an external customer. It's equally easy/hard for a random company to achieve web scale, compared to Twitch.

Re: Twitch is hacked, and its source code leaked

#212

Post by weaksauce »

madrox wrote: post #144
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

Could have been a hack of a twitch engineer's laptop or something like that.

Re: Twitch is hacked, and its source code leaked

#213

Post by Behemoth66 »

maccard wrote: post #183
jaredsohn wrote: post #170

Earlier quoted context omitted.

Is the password ncc1701e? I just googled it and found https://hashtoolkit.com/decrypt-sha1-hash/b85ffa7dae2cbed04e... along with other results.

It is! I guess using a password from Google isn't the best idea, and kind of defeated the point of what I wanted to ask (if your password isn't already hashed online how long does it actually take to break a sha1 hash), but definitely proves the point. Can I try again? Sha1 e7b7cdf949007abe7e8a190ba8eae56c60018c1f

Couldn’t find it in 1.4 Trillion combinations. Used rockyou.txt with dive.rule.

Took me 6 minutes to try all 1.4 trillion passwords. So either you have a strong password or I messed something up. What is it?

In theory if your password was weak enough to be on this list it would take on average 3 minutes to break it on a GTX 1080.

Re: Twitch is hacked, and its source code leaked

#214

Post by this_user »

koolba wrote: post #9
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

How much of this is a holdover of lax security practices from before they were acquired? I can’t imagine AWS being managed in a way where local network access gives you keys to the kingdom. Then again, EC2 instance profiles do let you do quite a bit.

I always had the impression that Twitch were operating in a largely independent fashion. For instance, it had been an open secret for years that one of their executives had been sexually harassing female streamers. Only a year ago he was finally fired. If Amazon had a firmer grip on Twitch, I'm sure they would have stepped in much earlier.

Re: Twitch is hacked, and its source code leaked

#215

Post by tptacek »

realitylabs wrote: post #185
tptacek wrote: post #96

Earlier quoted context omitted.

There was a fad for tools that accomplished this in enterprise networks, with much clearer rules for who needs to access what (it was called "data loss prevention", or DLP) and those tools for the most part don't work. This is a harder problem than it looks like.

These tools (DLP) have gotten better with app migration to K8s, since traffic can be watched prior to encryption in a standardized way. Just an FYI….

The enterprise DLP tools were deployed fleetwide as agents and at network choke points; getting access to the raw data wasn't the problem.

Re: Twitch is hacked, and its source code leaked

#216

Post by hamburglar »

unethical_ban wrote: post #196
madrox wrote: post #144

Earlier quoted context omitted.

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

No one in IT should have access to business data. That's simply best practice. Worst case would be a database engineer who has access to backups or some prod data for troubleshooting, and even that should be under tight control with good access accounting.

Welcome to devops. Ask Mike down the hall to add you to the “admin” group. Tell him you’re a new dev so you need everything.

(This is a joke but also, at many companies, it’s not. Twitch was once small and grew. Who knows what ancient all-access switches are still critical to running the systems, marked “tech debt” in someone’s backlog)

Re: Twitch is hacked, and its source code leaked

#217

Post by lrae »

AustinDev wrote: post #168
yupper32 wrote: post #16

Earlier quoted context omitted.

Does anyone know if Twitch employees have two factor auth? Having access to an employee's account would be the easiest way to pull this off. It'd be strange if they don't have two factor auth, of course, but it's just as strange to have this large of a hack. I think if it is a simple case of an employee account takeover, then the attack would "work" to some extent at any company. Larger companies typically have stric…

Every Twitch Developer has 2FA even 3rd party developers are required to have 2FA I also think, but don't know, that this applies to Twitch Broadcaster Partners as well in order to have their tax information in the system. Luckily iirc from a conversation with a senior Twitch engineer the Tax information backend has been migrated to Amazon. So hopefully that did not leak... Because that would be full legal name and a…

Twitch partners also have forced 2FA for quite some time now, should be a couple of years now - at least more than a year though. Covid killed my sense of time.

Re: Twitch is hacked, and its source code leaked

#218

Post by zerkten »

manquer wrote: post #181
ljm wrote: post #173

Earlier quoted context omitted.

Why is getting access to prod, or prod data, considered a perk, exactly?

The perk is the wrench UX denoting you are an employee to the community . Reddit/twitch allow employees to communicate with the users . It is a social media platform , being able to indicate that you are special is street cred. The other access rights that come from staff access is either incedential or miss /debt in architecture.

It's understandable why this is a neat perk, but it also seems absurd when you look at Twitch as an entity owned by a global corporation.

Re: Twitch is hacked, and its source code leaked

#219

Post by OnlineGladiator »

AnIdiotOnTheNet wrote: post #186
kuroguro wrote: post #126

Earlier quoted context omitted.

On one hand I understand why you'd ban that kind of content, on the other it's essentially public information now... what's the point.

Because everyone else doing it still doesn't make it right.

What's wrong with looking at public code? The code is public, regardless of how it became public - this isn't someone's personal life being exposed. If twitch is damaged by streaming this, it's only because their poor code quality is being examined publicly.

I can certainly understand why twitch banned this and don't blame them (although I think it's stupid), but I see nothing unethical about openly talking about this code in the public now that it's already there.

Re: Twitch is hacked, and its source code leaked

#220

Post by mariusor »

rasz wrote: post #120

> including its source code This will help with ad preroll blockers. I would love to see someone look deep into Twitch recommendation system - last time I tested the thing they call "Feedback" is a rolling buffer and wont let you exclude more than ~100 things, adding more simply removed oldest entries and started spamming you with things you already excluded in the past. This looked like performance optimization (les…

This won't help with preroll ads because the video segments themselves are replaced in the stream data. They're not ads, but it's not the stream either.

You get a "twitch commercial break in progress" video for the time the ads are playing.

You can check this by loading a stream with MPV.

Post reply on HN