Twitch is hacked, and its source code leaked • Hacker News Board

Re: Twitch is hacked, and its source code leaked

#231

Post by realyashnag » Wed, Oct 06, 2021, 8:47 PM UTC

ergerger wrote: post #187

madrox wrote: post #144

Earlier quoted context omitted.

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

I also worked for Twitch and can confirm what you're saying is true. These repo's any staff member had access to - including non-engineering staff. Revenue for the longest time was as simple as navigating to a streamers dashboard as staff, but they did finally gate that away from staff who don't need to see that info, however I am sure there are other ways to obtain revenue reporting info. I am assuming all data - in…

Allegedly it also contains AWS access keys. I feel bad for the engineers who will have to answer for this.

Re: Twitch is hacked, and its source code leaked

#232

Post by enneff » Wed, Oct 06, 2021, 8:48 PM UTC

nemothekid wrote: post #197

skilled wrote: post #163

Earlier quoted context omitted.

This statement makes no sense. The leak includes source code of multiple active websites and applications that are operated under the umbrella of Twitch/Amazon. Why would an intern have access to this data?

> Why would an intern have access to this data? monorepos are a thing at several companies (e.g. Google).

Monorepos can and often do have ACLs per directory.

Re: Twitch is hacked, and its source code leaked

#233

Post by mercurywells » Wed, Oct 06, 2021, 8:54 PM UTC

xorcist wrote: post #159

growt wrote: post #140

Earlier quoted context omitted.

If they are properly hashed and salted, they can not.

The point here is that once you brute force the plaintext password, the same password might be used elsewhere.

What if you did something like hash(plaintext_pw+"twitchsalt") ---> hash(browser_hash + db_salt)

Re: Twitch is hacked, and its source code leaked

#234

Post by VRay » Wed, Oct 06, 2021, 8:57 PM UTC

zerkten wrote: post #218

manquer wrote: post #181

Earlier quoted context omitted.

The perk is the wrench UX denoting you are an employee to the community . Reddit/twitch allow employees to communicate with the users . It is a social media platform , being able to indicate that you are special is street cred. The other access rights that come from staff access is either incedential or miss /debt in architecture.

It's understandable why this is a neat perk, but it also seems absurd when you look at Twitch as an entity owned by a global corporation.

Man oh man, big "No thanks" to a perk like that from me

"Hey, pick through everything I say with a fine-toothed comb and treat it as the official company stance!"

Re: Twitch is hacked, and its source code leaked

#235

Post by andrewstuart » Wed, Oct 06, 2021, 9:00 PM UTC

What language is the main website written in?

Re: Twitch is hacked, and its source code leaked

#236

Post by jallen_dot_dev » Wed, Oct 06, 2021, 9:00 PM UTC

mastermojo wrote: post #89

There's something about this sentence that I find hilarious: The download was posted to 4chan today, described by its unidentified source as “part one” of “an extremely poggers leak,”

This hack was not very xqcL of them.

Re: Twitch is hacked, and its source code leaked

#237

Post by Behemoth66 » Wed, Oct 06, 2021, 9:04 PM UTC

maccard wrote: post #230

Behemoth66 wrote: post #213

Earlier quoted context omitted.

Couldn’t find it in 1.4 Trillion combinations. Used rockyou.txt with dive.rule. Took me 6 minutes to try all 1.4 trillion passwords. So either you have a strong password or I messed something up. What is it? In theory if your password was weak enough to be on this list it would take on average 3 minutes to break it on a GTX 1080.

Thanks for trying! This somewhat supports what I'm suggesting - because that password hasn't been leaked by being posted in plaintext as a verified password, it's not available as a lookup, therefore it doesn't matter whether they used bcrypt, sha1 or md5, or even just pgp encrypted it, the password is likely "secure".

It depends. It doesn’t have to strictly be a leaked password. If it’s similar to a leaked password then the permutation rule-set will catch it.

Anything under 9 characters I can brute force in minutes. 9 character passwords would take me 9 hours.

Obviously if someone has a nest of the latest GPUs then they could go a lot faster.

But yes if your password is uwv&6qu_brusb618_$@618jg then it doesn’t really matter how you hash it.

Re: Twitch is hacked, and its source code leaked

#238

Post by runawaybottle » Wed, Oct 06, 2021, 9:08 PM UTC

notyourwork wrote: post #142

runawaybottle wrote: post #75

Earlier quoted context omitted.

I’m so misread, Twitch is a lot of luck, so is all of these companies. Show me the the source code for luck. I don’t give a fuck if you leaked a video streaming crud app code lol.

This perspective is immature at best, but genuinely ignorant of how tech works at twitch scale.

I’ll grant you immature, nothing else.

Re: Twitch is hacked, and its source code leaked

#239

Post by wchar_t » Wed, Oct 06, 2021, 9:11 PM UTC

mastermojo wrote: post #89

There's something about this sentence that I find hilarious: The download was posted to 4chan today, described by its unidentified source as “part one” of “an extremely poggers leak,”

I find it extremely ironic that they whine about Twitch being a "disgusting cesspool"... on 4chan.

> Calling Twitch a “disgusting toxic cesspool,”

Re: Twitch is hacked, and its source code leaked

#240

Post by maccard » Wed, Oct 06, 2021, 9:11 PM UTC

filleokus wrote: post #224

maccard wrote: post #194

Earlier quoted context omitted.

As I said, I've heard the claim, but still question it. Here's a sha1 e7b7cdf949007abe7e8a190ba8eae56c60018c1f, how long does it take hashcat to break it?

I don't really follow your argument. You've never heard of a hash being brute forced? I've done it myself multiple times, both for pen testing purposes and for password recovery on systems I control myself. The LinkedIn password leak contained hashed (but not salted) passwords, and some of those where cracked and exploited in the wild. My old gaming PC with a 1060 can apparently do ≈ 6300 * 10^6 hashes per second. As…

> The LinkedIn password leak contained hashed (but not salted) passwords, and some of those where cracked and exploited in the wild.

The hashes of previously unused passwords were brute forced, or passwords were reused across sites from a previous plain text dump and exploited? Because there's a big difference between those two things. If your password is reused and originally compromised , you're screwed regardless, and having the leaked hashed passwords doesn't leave you in any worse a situation than before.

> My old gaming PC with a 1060 can apparently do ≈ 6300 * 10^6 hashes per second. Assuming your password above is az-AZ, 0-9 = 62 possibilities (with no salt) it would take me 10 seconds to test all combinations for 6 characters and 30 days for 9 characters. And it's a trivially parallel problem, making it easy to throw money on to make it wall-clock quicker.

So practically infeasible to exploit? The claims that are being made (even in this thread) are that having a mining rig would let you brute force a SHA1 hash, but based on the numbers

> It's just a simple brute force problem, I don't see what there is to question

If it's "just a simple brute force problem", and SHA1 is the only issue, then my question is what's the password in the hash above? You (and others here, on reddit, online) are telling us that this is a trivial problem.