Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

31–40 of 325 posts

Re: Twitch is hacked, and its source code leaked

#31

Post by SketchySeaBeast »

ArlenBales wrote: post #10
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

There are so many indiscreet USB pentesting devices easily purchasable by anyone today, I'm actually surprised this sort of thing doesn't happen more often.

Shouldn't that be discreet devices? Or do they make a really high pitched whine with a big flashing light when they start transferring data?

Re: Twitch is hacked, and its source code leaked

#32

Post by com2kid »

leros wrote: post #8
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

> Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

I am trying to recall, but I am pretty sure when I worked in Microsoft Office that a build would pull down many tens of gigabytes of data.

125GB in one day from the build system wouldn't be uncommon!

Re: Twitch is hacked, and its source code leaked

#34

Post by namrog84 »

runawaybottle wrote: post #15

Does it take a genius to figure out how to build twitch? It’s a modern crud app with video streaming.

A lot of the secret sauce of such things are not that secret but just take a lot of work.

Building and maintaining infrastructure simply takes a lot of people, time, relationships and whatnot.

They get good at it over time which I guess could consider some secret sauce but there isn't like some secret code that makes the whole thing way better that now you'll see tons of competitors.

Re: Twitch is hacked, and its source code leaked

#35

Post by jandrese »

toomuchtodo wrote: post #14
leros wrote: post #8

Earlier quoted context omitted.

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

That's 6.25GB/day over a 20 day working month. More time, less data per work day, harder to detect.

And it might be disguised as a video stream coming out of the video streaming servers.

But it could also be a 128GB thumb drive plugged into the system somewhere.

Re: Twitch is hacked, and its source code leaked

#36

Post by pizzazzaro »

nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

Considering who owns it? There's conversations with government agencies asking "are we okay?" To the world's richest man.

Re: Twitch is hacked, and its source code leaked

#38

Post by bawolff »

ramesh31 wrote: post #26
some_furry wrote: post #24

Earlier quoted context omitted.

> Does anyone know if Twitch employees have two factor auth? Yes, IIRC everyone at Amazon has a hardware security key (which is more secure than the standard mobile app TOTP most of us use everywhere online).

>(which is more secure than the standard mobile app TOTP most of us use everywhere online). Is it though? The "wrench theory" applies here. It's not unthinkable that an employee was stalked on social media and had their key stolen.

Its still more secure. Rubber hose cryptanalysis applies to both equally, but that doesn't mean there aren't other attacks that apply to totp which don't to yubikeys.

More secure != perfectly secure.

Re: Twitch is hacked, and its source code leaked

#39

Post by angst_ridden »

SketchySeaBeast wrote: post #31
ArlenBales wrote: post #10

Earlier quoted context omitted.

There are so many indiscreet USB pentesting devices easily purchasable by anyone today, I'm actually surprised this sort of thing doesn't happen more often.

Shouldn't that be discreet devices? Or do they make a really high pitched whine with a big flashing light when they start transferring data?

"Hey, Jeff, what's that weird thumb-drive over there that keeps texting me `I'm in your datacenter downloading your datas'?"

Re: Twitch is hacked, and its source code leaked

#40

Post by CobrastanJorji »

leros wrote: post #8
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

If the bulk of it is a git repo, it's probably expected that every engineer will download it regularly.
Post reply on HN