Is this the first time actual Amazon infrastructure has been hacked?
Anyone has Amazon been hacked pervious to this?
(Not talking about insecure AWS accounts)
Twitch is hacked, and its source code leaked
221–230 of 325 posts
Re: Twitch is hacked, and its source code leaked
#222The top streamers' earnings were also leaked: https://www.twitchearnings.com/
Re: Twitch is hacked, and its source code leaked
#223Earlier quoted context omitted.
In many companies source code for all products is available to each and single developer.
In what world does all this data in the leak would be stored together in a unified ecosystem? It makes absolutely no sense. If you're saying that Twitch runs their developer environment in a lousy manner (and you have proof of this), then please go ahead. But to imply that an intern/average developer would be given access to all this branching information is ignorant.
I have first hand info, and this is how it’s done.
Don’t call somebody ignorant if you don’t have first hand info. Leave that for somebody who does.
Re: Twitch is hacked, and its source code leaked
#224Earlier quoted context omitted.
Many hashes are trivial to target, until you start getting to password hashers that force you to use lots of RAM or CPU (or ideally both) to check a single password. As long as you know what hashing algorithm was used (often inferred by the hash length or other details), you can shove it into hashcat or some alternatives and wait, either using a good dictionary or bruteforce. If you've configured hashcat to work well…
As I said, I've heard the claim, but still question it. Here's a sha1 e7b7cdf949007abe7e8a190ba8eae56c60018c1f, how long does it take hashcat to break it?
I don't really follow your argument. You've never heard of a hash being brute forced? I've done it myself multiple times, both for pen testing purposes and for password recovery on systems I control myself.
The LinkedIn password leak contained hashed (but not salted) passwords, and some of those where cracked and exploited in the wild.
My old gaming PC with a 1060 can apparently do ≈ 6300 * 10^6 hashes per second. Assuming your password above is az-AZ, 0-9 = 62 possibilities (with no salt) it would take me 10 seconds to test all combinations for 6 characters and 30 days for 9 characters. And it's a trivially parallel problem, making it easy to throw money on to make it wall-clock quicker.
It's just a simple brute force problem, I don't see what there is to question (beside the choice of SHA1 for password hashing...).
Re: Twitch is hacked, and its source code leaked
#225Earlier quoted context omitted.
The point of the salt isn't that it makes it take longer to break any one password. What it does is prevent you from re-using the rainbow table you generate breaking one password when you break the next one. Sha1 is not a very secure/expensive hashing algorithm and thus does make it significantly cheaper to break even with a unique salt.
> Sha1 is not a very secure/expensive hashing algorithm and thus does make it significantly cheaper to break even with a unique salt. Ok, so how long does it take to break the hash I've provided if it's not very secure?
It's not so much "how long does it take" as it is "how much does it cost" and the answer to that really depends on what sort of compute infrastructure you have access to. Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. Preventing the re-use of that computational effort on additional users is why unique salts are important.
Re: Twitch is hacked, and its source code leaked
#226> including its source code This will help with ad preroll blockers. I would love to see someone look deep into Twitch recommendation system - last time I tested the thing they call "Feedback" is a rolling buffer and wont let you exclude more than ~100 things, adding more simply removed oldest entries and started spamming you with things you already excluded in the past. This looked like performance optimization (les…
This won't help with preroll ads because the video segments themselves are replaced in the stream data. They're not ads, but it's not the stream either. You get a "twitch commercial break in progress" video for the time the ads are playing. You can check this by loading a stream with MPV.
aaand new ad bypass dropped 4 hours ago :)
>You can check this by loading a stream with MPV
I watch all of my twitch using mplayer. "magic incantations" when generating access token is what produces ad free .m3u8. For example early methods involved setting origin and/or referrer headers to internal Amazon systems.
Re: Twitch is hacked, and its source code leaked
#227Someone actually started streaming going through the code ... on twitch. https://www.twitch.tv/deepfrieddev
It is really fun to go through the source code. You'll find interesting architecture diagrams, documentation etc. It's like joining a new job and being amazed how a service you actually use was build.
Everyone interested, just download the code :)
Re: Twitch is hacked, and its source code leaked
#228Re: Twitch is hacked, and its source code leaked
#229Earlier quoted context omitted.
"Sorry. Unless you’ve got a time machine, that content is unavailable." Too bad, it would be nice to see someone go through and document how Twitch works. I've never worked at "web scale" so I'd probably learn a lot.
A lot of it is probably hacked together -- like, embarrassingly hacked together lol
Yep, there are lots of small services that don't seem production ready in the source code. Though admittedly we don't know which of those are deprecated.
Re: Twitch is hacked, and its source code leaked
#230Earlier quoted context omitted.
It is! I guess using a password from Google isn't the best idea, and kind of defeated the point of what I wanted to ask (if your password isn't already hashed online how long does it actually take to break a sha1 hash), but definitely proves the point. Can I try again? Sha1 e7b7cdf949007abe7e8a190ba8eae56c60018c1f
Couldn’t find it in 1.4 Trillion combinations. Used rockyou.txt with dive.rule. Took me 6 minutes to try all 1.4 trillion passwords. So either you have a strong password or I messed something up. What is it? In theory if your password was weak enough to be on this list it would take on average 3 minutes to break it on a GTX 1080.
Thanks for trying! This somewhat supports what I'm suggesting - because that password hasn't been leaked by being posted in plaintext as a verified password, it's not available as a lookup, therefore it doesn't matter whether they used bcrypt, sha1 or md5, or even just pgp encrypted it, the password is likely "secure".