Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

261–270 of 325 posts

Re: Twitch is hacked, and its source code leaked

#261

Post by filleokus »

maccard wrote: post #240
filleokus wrote: post #224

Earlier quoted context omitted.

I don't really follow your argument. You've never heard of a hash being brute forced? I've done it myself multiple times, both for pen testing purposes and for password recovery on systems I control myself. The LinkedIn password leak contained hashed (but not salted) passwords, and some of those where cracked and exploited in the wild. My old gaming PC with a 1060 can apparently do ≈ 6300 * 10^6 hashes per second. As…

> The LinkedIn password leak contained hashed (but not salted) passwords, and some of those where cracked and exploited in the wild. The hashes of previously unused passwords were brute forced, or passwords were reused across sites from a previous plain text dump and exploited? Because there's a big difference between those two things. If your password is reused and originally compromised , you're screwed regardless,…

> The hashes of previously unused passwords were brute forced, or passwords were reused across sites from a previous plain text dump and exploited?

I believe there are documented instances where previously not leaked passwords were cracked. Of course not 128 bit random strings, but still passwords more "complex" than what you previously posted. If you have 100 million hashes to try, you will crack some. People are generally have bad passwords, especially in 2012, even if the plaintext weren't available anywhere...

> So practically infeasible to exploit? It depends on how strong the password is and how much money you have to spend. For 32 USD I get an hour with p4d.24xlarge that has 8 graphics card, that in total can do about 175 * 10^9 hashes per second. 20 hours (and 640 USD) machine time (not wall clock time) on that machine can do what 30 days on my old PC does.

> If it's "just a simple brute force problem" […] If you can give me a bound on the number of combinations, and an AWS account to bill, I and many others would gladly attempt to crack your hash :-). But if your second hash is >9 alphanumerical characters we will probably just burn electricity to no avail.

I don't even know what you are arguing?

EDIT: Now that you have some numbers of hashing rates and cost, you can figure out how expensive different passwords are to crack with different approaches. Two common dictionary words with two numbers appended? 6 random alphanumeric characters? Then think about how expensive the cheapest non-leaked password is in a database of 100 million users are...

Is it bad to store plaintext passwords? Yes, obviously. Is some hashing better than none. Yes, obviously. Is salting your hashes much better than not. Yes, because with a salt, your first password wouldn't have turned up on Google / in rainbow tables. Is it even better to use a proper PBKDF. Yes, with a pretty aggressive PBKDF, brute forcing even low-complexity passwords become expensive very quickly, and we get the benefits of salting "built in".

Can SHA1 / MD5 hashes be cracked even if not the _exact_ password-hash pair have been leaked previously? Yes, very much so.

Re: Twitch is hacked, and its source code leaked

#262

Post by bengale »

ergerger wrote: post #187
madrox wrote: post #144

Earlier quoted context omitted.

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

I also worked for Twitch and can confirm what you're saying is true. These repo's any staff member had access to - including non-engineering staff. Revenue for the longest time was as simple as navigating to a streamers dashboard as staff, but they did finally gate that away from staff who don't need to see that info, however I am sure there are other ways to obtain revenue reporting info. I am assuming all data - in…

Why did non engineers have access to repos?

Re: Twitch is hacked, and its source code leaked

#263

Post by unethical_ban »

hamburglar wrote: post #216
unethical_ban wrote: post #196

Earlier quoted context omitted.

No one in IT should have access to business data. That's simply best practice. Worst case would be a database engineer who has access to backups or some prod data for troubleshooting, and even that should be under tight control with good access accounting.

Welcome to devops. Ask Mike down the hall to add you to the “admin” group. Tell him you’re a new dev so you need everything. (This is a joke but also, at many companies, it’s not. Twitch was once small and grew. Who knows what ancient all-access switches are still critical to running the systems, marked “tech debt” in someone’s backlog)

The whole point of devops is to automate everything according to best practices, so fuckups are a thing of the past! The only fuckups, of course, will be Terraform state issues.

Re: Twitch is hacked, and its source code leaked

#264

Post by vkou »

bengale wrote: post #262
ergerger wrote: post #187

Earlier quoted context omitted.

I also worked for Twitch and can confirm what you're saying is true. These repo's any staff member had access to - including non-engineering staff. Revenue for the longest time was as simple as navigating to a streamers dashboard as staff, but they did finally gate that away from staff who don't need to see that info, however I am sure there are other ways to obtain revenue reporting info. I am assuming all data - in…

Why did non engineers have access to repos?

The better question is, why did random engineers have access to the financials of the streamers on the platform, without having to go through a break-glass, audited, emergency access escalation.

Re: Twitch is hacked, and its source code leaked

#265

Post by snvzz »

wchar_t wrote: post #239
mastermojo wrote: post #89

There's something about this sentence that I find hilarious: The download was posted to 4chan today, described by its unidentified source as “part one” of “an extremely poggers leak,”

I find it extremely ironic that they whine about Twitch being a "disgusting cesspool"... on 4chan. > Calling Twitch a “disgusting toxic cesspool,”

Ironic? Why?

Re: Twitch is hacked, and its source code leaked

#266

Post by AmericanChopper »

unethical_ban wrote: post #203
tptacek wrote: post #96

Earlier quoted context omitted.

There was a fad for tools that accomplished this in enterprise networks, with much clearer rules for who needs to access what (it was called "data loss prevention", or DLP) and those tools for the most part don't work. This is a harder problem than it looks like.

DLP products tend to be more about scanning the contents of data for sensitive patterns, at least in my observation of the market. There are other products (typically built into SIEM) that do correlation on login events, network traffic and whatnot to detect anomalous behavior.

I’ve worked on a lot of DLP projects in big enterprise, and I have a very dim view of the entire category of product. A lot of their functionality is just magic black boxes, that unsurprisingly achieve very little. The primary motive for deploying them is not that they’re particularly effective, it’s so that you can tell auditors and other scrutineers that you’ve got a “DLP solution”. The idea that you can grant people access to huge quantities information, but then very strictly control what they do with it is fundamentally flawed. Especially on networks that require large amounts of in and outflow for BAU. Even the most tightly controlled data in the world cannot be protected from an inside leaker (or adversary who has taken control of an insiders access), because it runs into the same “analog hole” issue that DRM products have.

Re: Twitch is hacked, and its source code leaked

#267

Post by thaumasiotes »

growt wrote: post #140
axpy906 wrote: post #87

Earlier quoted context omitted.

Pretty much this. If they gain one email/username password combination - they can use it elsewhere.

If they are properly hashed and salted, they can not.

Password salting has nothing to do with password reuse.

Imagine two people have accounts on each of two websites:

             eBay           YouTube
   
   Alice     sunlight       bobrules
   
   Bob       bobrules       bobrules
A password reuse attack dumps the YouTube database, cracks Bob's password, and then accesses Bob's eBay account. The fix for this is that Bob should use different passwords on his different accounts. Hashing helps by making step 2 ("crack Bob's password") more difficult. Salting does not affect this attack in any way. Note that the attacker didn't bother to dump the eBay database.

The attack that salting protects against dumps the YouTube database, cracks Bob's password, and then accesses Alice's YouTube account.

Re: Twitch is hacked, and its source code leaked

#268

Post by thaumasiotes »

mindwok wrote: post #165
evandwight wrote: post #131

Earlier quoted context omitted.

Why does it matter if hashes are the same? That only tells you the passwords are the same.

If they are the same everywhere, you can precompute a huge database of hashes (called a rainbow table) and simply lookup the hash in the table when breaches occur to find the password. By salting, every provider who stores credentials has different hashes for the same inputs which makes the approach far less attractive at a large scale.

> If they are the same everywhere, you can precompute a huge database of hashes (called a rainbow table) and simply lookup the hash in the table when breaches occur to find the password.

You can do this anyway. But the space requirements of a rainbow table are so large that including an account's username in the password would make a rainbow table completely unfeasible.

Re: Twitch is hacked, and its source code leaked

#269

Post by lm28469 »

runawaybottle wrote: post #244
holler wrote: post #125

Earlier quoted context omitted.

You're missing the _hard work_ part. Sure there's always an element of "luck" in any story of success, but that mostly has to do with timing, and is much less weighted than the perseverance and hard work of the people building it. Twitch is a full-featured, very mature application with many moving parts outside of just the video streaming, and building all those parts took an incredible amount of time and effort.

It’s just luck. I mean, if I was a storyteller, what story would I have to tell if there was no story. They hit. It’s sort of like we all hold Golden dice, so we marveled, by our own eyes, at the gold. Dealer: You rolling those? Us: no, it’s gold. They fucking risked it. It’s not a engineering feat, we’re all a bunch of pussies. Twitch is easiest site to build, you might as well show me a todo app (which will be sieg…

You'll be rolling dices for a long time of that's all you need to build a twitch clone ;)

Re: Twitch is hacked, and its source code leaked

#270

Post by lm28469 »

nullifidian wrote: post #204
lm28469 wrote: post #67

Earlier quoted context omitted.

Everything is just a crud app with a few extra steps.... yet you're not Zuckerberg or Dorsey

One shouldn't aspire to be a Zuckerberg/Dorsey.

I personally don't, many people do though. I used them because Facebook and Twitter could be easily summed up as "crud app"
Post reply on HN