Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

271–280 of 325 posts

Re: Twitch is hacked, and its source code leaked

#271

Post by thaumasiotes »

evandwight wrote: post #131
franga2000 wrote: post #113

Earlier quoted context omitted.

If everyone did things the way they're supposed to then no, hashes should never be the same between platforms. Using the same algorithm is likely, but as you said, salting solves that. But mistakes such as salting with just the username are sometimes made even by very large companies and in that case, hashes could be the same.

Why does it matter if hashes are the same? That only tells you the passwords are the same.

It doesn't matter at all if one person's hashed password is identical across two of that person's accounts on two different websites. The identical hash will instantly let an attacker (with access to both hashes) know that this person shares the same password across two accounts. But that is of no value; the attacker is going to start by assuming that it's true anyway.

Salts are there to ensure that two accounts on the same website which have identical passwords nevertheless have different password hashes.

Re: Twitch is hacked, and its source code leaked

#272

Post by vel0city »

maccard wrote: post #240
filleokus wrote: post #224

Earlier quoted context omitted.

I don't really follow your argument. You've never heard of a hash being brute forced? I've done it myself multiple times, both for pen testing purposes and for password recovery on systems I control myself. The LinkedIn password leak contained hashed (but not salted) passwords, and some of those where cracked and exploited in the wild. My old gaming PC with a 1060 can apparently do ≈ 6300 * 10^6 hashes per second. As…

> The LinkedIn password leak contained hashed (but not salted) passwords, and some of those where cracked and exploited in the wild. The hashes of previously unused passwords were brute forced, or passwords were reused across sites from a previous plain text dump and exploited? Because there's a big difference between those two things. If your password is reused and originally compromised , you're screwed regardless,…

Right? "Its just a simple brute force problem", but sometimes that still takes a lot of force. Sometimes far more force than breaking a single account password.

I managed to lock myself out of a dogecoin wallet. I have the hash of the passphrase, so I figured I'd give it a go cracking it. After a few weeks (and a larger than usual power bill) I sent it to some friends with good mining rigs to try and take a stab at it, willing to split the amount 50/50. Its only the passphrase, not the full wallet, so I'm not worried about someone stealing the doge.

The passphrase is probably 15-25 characters, mostly not dictionary words or simple letter/number/symbol substitution, only symbols easy to type on a US keyboard. I'm now about 6 months trying to crack that password with probably a few hundred dollars of electricity used overall between myself and friends (I don't know their power bill), excluding hardware cost as it was already owned, and I'm not even halfway through the search space.

Can it be done? Sure. Will I be able to crack that password with a cost that's less than the value of the DOGE in the wallet? Probably not. Right now its really more of a gamble that I'll get lucky with the rigs running. I had to tone down some of my rigs as it was getting quite hot over the summer, but over the winter I'll be chugging away as the waste heat is just additional home heat. I'll probably need to rent a considerable amount of GPU power on a cloud provider to crack it, at which point maybe it'll take me days to crack it but ultimately cost me many, many thousands of dollars in GPU-time.

Re: Twitch is hacked, and its source code leaked

#273

Post by syshum »

madrox wrote: post #144
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

Sounds like someone in Twitch Security needs to take a course on Least Privileged Access then

Re: Twitch is hacked, and its source code leaked

#275

Post by cube00 »

unethical_ban wrote: post #196
madrox wrote: post #144

Earlier quoted context omitted.

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

No one in IT should have access to business data. That's simply best practice. Worst case would be a database engineer who has access to backups or some prod data for troubleshooting, and even that should be under tight control with good access accounting.

Until the business raises a priority one incident that their monthly reports are not looking right and you need to dive into the data to find out why some other API back end decided to present its numbers this month divided by 1000 for ease of display to their own users.

I know, I know, service contacts but my point is sometimes engineers need at least temporary access to provide support at times.

Re: Twitch is hacked, and its source code leaked

#276

Post by ogn3rd »

madrox wrote: post #190
ergerger wrote: post #187

Earlier quoted context omitted.

I also worked for Twitch and can confirm what you're saying is true. These repo's any staff member had access to - including non-engineering staff. Revenue for the longest time was as simple as navigating to a streamers dashboard as staff, but they did finally gate that away from staff who don't need to see that info, however I am sure there are other ways to obtain revenue reporting info. I am assuming all data - in…

I'm actually very happy to hear they finally added a flag for payout access. It's been years since I was there and my eyes bugged out when I saw what I had access to without needing it.

Parent company was no different.

Re: Twitch is hacked, and its source code leaked

#277

Post by dijit »

peterkos wrote: post #100
CoolGuySteve wrote: post #55

Earlier quoted context omitted.

"Sorry. Unless you’ve got a time machine, that content is unavailable." Too bad, it would be nice to see someone go through and document how Twitch works. I've never worked at "web scale" so I'd probably learn a lot.

A lot of it is probably hacked together -- like, embarrassingly hacked together lol

You’re being downvoted for being overly negative, but the ops code is of (literally) shockingly poor quality.

This leak has made me understand clearly that code quality is not what makes a product great.

I guess that’s something.

The jenkinsfiles are mostly nice and clean though. I’ve definitely seen worse of those.

Re: Twitch is hacked, and its source code leaked

#278

Post by bdreadz »

weaksauce wrote: post #212
madrox wrote: post #144

Earlier quoted context omitted.

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

Could have been a hack of a twitch engineer's laptop or something like that.

This is what I thought of as well. Maybe just an engineer was hacked.

Re: Twitch is hacked, and its source code leaked

#279

Post by ijcd »

ljm wrote: post #153
madrox wrote: post #144

Earlier quoted context omitted.

There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it wa…

Why would an intern at Twitch have access to data in production? Saying that no 'secrets' were leaked is effectively burying the lede.

In general the broad access was to code repos early on. Some were gated. There’s lots of collaboration and the need to study other code bases for learning and collaboration, read only. It’s micro services galore there so one didn’t tend to have access to production databases for services or systems you didn’t work on. You were opted in there. Teams did their own devops for the most part.

The payout data likely wasn’t ripped from a DB but rather dashboards which customer service or partnerships likely had access to. Tier1 or Tier2 support kinda stuff.

This smells like a stolen backup or maybe network access and http scanning, finding the internal GitHub and maybe a support admin cred that allowed dashboard view.

Re: Twitch is hacked, and its source code leaked

#280

Post by thaumasiotes »

errantspark wrote: post #128
nemothekid wrote: post #28

Earlier quoted context omitted.

> It's possible that this first leak was just to establish trust so they can random or auction password hashes later. Password hashes are relatively useless though? Once the leak is announced I imagine most of the big targets will rotate their credentials. Then the next thing you need to do is spend possibly thousands in CPU time bruteforcing bcrypt hashes. Then I'm not sure what you can even do with those. I'm not c…

A few things here. If you're the sort of person who runs a crypto mine, which I assume many of the people interested in breaking hashes are you have enough firepower at your disposal to at least perform a targeted attack on a few hashes with relative ease. Ideally that would be useless because things are properly salted and you don't know the salt, however with access to all of the source code as we have here I think…

> Ideally that would be useless because things are properly salted and you don't know the salt

I'm really curious where people get their ideas about salting. It's not just a word. It doesn't make one password any more difficult to crack. It makes cracking every password in a given database more difficult to do. A password's salt is public information.

Post reply on HN