Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

281–290 of 325 posts

Re: Twitch is hacked, and its source code leaked

#281
post #72

Earlier quoted context omitted.

I figure you could "build a Steam" in a couple of years, with the right engineers hitting the main features. There's very little magic at the technology level, and you can make life simpler and forget about minor things like the hardware survey or the pretty graphs. I'm not saying this is trivial, but it's definitely doable. This is a far different statement than "You can build something and compete with Steam in a c…

Sir (Madame?), I ask you one simple question: Was Twitch built in 10 years, or over just a few? Steam was built since I was in FUCKING high school. Im old now, well over 30. Apples, and blueberries. Bluebarry, Drewbarry, tomato, ToMaHtoH. Fuck their stupid ass streaming code, it’s a giant crud app, only their devops team can take credit for scaling, everyone else is not worth a shit, sorry, thats life, I gotta Leetco…

Based on what I read of the ops code… don’t give them too much credit.

The thing I learned most from this leak is that the technology side plays very little part in the business being successful or not.

Re: Twitch is hacked, and its source code leaked

#282
post #225

Earlier quoted context omitted.

It's not so much "how long does it take" as it is "how much does it cost" and the answer to that really depends on what sort of compute infrastructure you have access to. Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. Preventing the re-use of that computational effort on additional users is why unique salts are important.

> It's not so much "how long does it take" as it is "how much does it cost" So the answer is "It's too expensive to figure out in practice, unless you're being explicitly targetted by someone with nation state level credentials?", i.e. it's pretty much fine? > Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. But by the sounds of it, SHA1 is…

[deleted]

Re: Twitch is hacked, and its source code leaked

#284

Earlier quoted context omitted.

Because everyone else doing it still doesn't make it right.

What's wrong with looking at public code? The code is public, regardless of how it became public - this isn't someone's personal life being exposed. If twitch is damaged by streaming this, it's only because their poor code quality is being examined publicly. I can certainly understand why twitch banned this and don't blame them (although I think it's stupid), but I see nothing unethical about openly talking about thi…

> What's wrong with looking at public code? The code is public, regardless of how it became public

Copyright would disagree with you, and I would say that ethically it is basically the same as stealing it yourself. You're profiting off of someone else having done the dirty work for you.

> this isn't someone's personal life being exposed.

Apparently a lot of payment information, telephone numbers, etc. was also in the leak. I don't think we should downloading or encouraging people to download and peruse that stuff.

Re: Twitch is hacked, and its source code leaked

#285
post #265

Earlier quoted context omitted.

I find it extremely ironic that they whine about Twitch being a "disgusting cesspool"... on 4chan. > Calling Twitch a “disgusting toxic cesspool,”

Ironic? Why?

Because as far as cesspools go, 4chan is the most toxic and disgusting

Re: Twitch is hacked, and its source code leaked

#286

Earlier quoted context omitted.

It depends. It doesn’t have to strictly be a leaked password. If it’s similar to a leaked password then the permutation rule-set will catch it. Anything under 9 characters I can brute force in minutes. 9 character passwords would take me 9 hours. Obviously if someone has a nest of the latest GPUs then they could go a lot faster. But yes if your password is uwv&6qu_brusb618_$@618jg then it doesn’t really matter how yo…

The reason I didn't give any more information on the password above is because you don't have any extra information on a dump of hashes from a twitch database either. If a password is only feasibly brute forceable for a specific algorithm by reducing the search space by many orders of magnitude, it kind of shows that there's not really any risk even if the passwords are unsalted for a person who hasn't reused a passw…

> it kind of shows that there's not really any risk even if the passwords are unsalted for a person who hasn't reused a password.

No, it doesn't. You could reuse uwv&6qu_brusb618_$@618jg everywhere and it wouldn't get cracked. If the plaintext password leaked, then you'd be in more trouble.

What matters is whether your password is easy to guess, not whether you've reused it. If you have all unique passwords, they can still all be trivial to crack.

Re: Twitch is hacked, and its source code leaked

#287
post #225

Earlier quoted context omitted.

It's not so much "how long does it take" as it is "how much does it cost" and the answer to that really depends on what sort of compute infrastructure you have access to. Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. Preventing the re-use of that computational effort on additional users is why unique salts are important.

> It's not so much "how long does it take" as it is "how much does it cost" So the answer is "It's too expensive to figure out in practice, unless you're being explicitly targetted by someone with nation state level credentials?", i.e. it's pretty much fine? > Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. But by the sounds of it, SHA1 is…

>But by the sounds of it, SHA1 is more than enough (given that nobody here is willing to brute force the hash I shared above?)

SHA1 is "more than enough" for this specific interaction in which you chose a complex password and/or your only opponents are unmotivated/non-incentivized HN commenters that don't have a password cracker at their immediate disposal. That doesn't mean anything outside of this context.

If your opponent was a motivated hacker with dedicated password cracking machines (which do not require anything even close to a nation-state budget, btw), your SHA1 hash would be much more likely to be cracked. If you were a specific target of a hacker group, such as an employee of a company that is being targeted by an attack or someone known to have a BTC wallet with $10 million in it, your SHA1 hash would be much more likely to be cracked. If your password was a relatively simple phrase like "dog$aregreat2019", like the vast majority of user passwords are, it would almost certainly be cracked.

SHA1 is not even anywhere close to "enough" for general password hashing use. Don't think otherwise just because a couple of random HNers failed your little game.

edit: The premise of your "challenge" is also not equivalent to the goals of most hackers. Unless you are a specifically known and prioritized target (because you're a celeb, VIP, wealthy person or something like that), the goal of a hacker is not to take one specific hash and crack it, because the success of that will depend a lot on the complexity of your password. The goal of most hackers in a breach like this Twitch one is more like "just throw it all at the wall and see what sticks". They take a massive database of thousands of hashes and spend a few hours to see what can be cracked, taking advantage of the fact that while some people may have complex passwords, most do not. After a few hours, maybe they crack 90% of the SHA1 hashes in a leak. Maybe your password was complex enough that it was in the 10% that wasn't cracked; good for you, but just because your password remained uncracked doesn't mean SHA1 is "enough". The hackers still got the other 90%.

Re: Twitch is hacked, and its source code leaked

#288

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

> It's also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data?

From what I heard about Twitch-interns over the years, it seems the company is more a third-rate-s**hole that grew too big too fast and accumulated a huge amount of technical debt and fatal security flaws. Making billions doesn't mean anything if you don't invest them back into the important corners of the company. It's considered a miracle that the platform is still working that well in that state. And what comes from the leaks so far supports this view.

Though, said that, it seems they did start to improve one or two years ago, just too late to prevent this critical hit. But considering this was also a strike that avoided the deadly parts (yet), maybe there is a different aim here and the company can grow from this? It will be interesting to see how Amazon will react to this.

Re: Twitch is hacked, and its source code leaked

#289

I'd be interested if someone could get their own instance of Twitch up and running from this leak. Someone mentioned internal API's, which would have to be reworked to avoid detection, but it'd be interesting to host it on AWS just to see how long it takes to get shut down. How would current AWS policies hold up? Obviously the code would be illegally acquired, but do they have detection mechanisms in place?

100s of services and databases to work out and sort through. Good luck building a global real-time video CDN too. You could build your own faster. Microservice architectures mirror the org that built them. You wouldn’t do it the same way for yourself.
Post reply on HN