Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

301–310 of 325 posts

Re: Twitch is hacked, and its source code leaked

#301

Post by outworlder »

leros wrote: post #8
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

> It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

Remember that Twitch handles streams. Good luck implementing this without having all sorts of false alarms everywhere.

Plus, you don't have to exfiltrate 125GB in one go.

Re: Twitch is hacked, and its source code leaked

#302

Post by bleepblooop »

vineyardmike wrote: post #106
lamontcg wrote: post #73

Earlier quoted context omitted.

Conflating AWS security with twitch security is probably the wrong way to think about it. Within Amazon those are almost going to be two entirely separate companies, with very different security focuses. The idea that Amazon is monolithic and uniform wasn't true when I left there in 2006, and I'm certain it is less so now. And that isn't just that its related to the merger, but that fundamentally its different busine…

But does twitch not share the same Amazon wide git service? Could most of Amzn code be leaked or compromised? Seems like all of amazon internals that shares security measures is at risk...

Remember that Amazon runs one of the biggest multi-tenant service platforms in the industry! A separate business unit like Twitch is likely to be set up a lot like any other random AWS customer, and you wouldn't expect that compromising servers used by one AWS customer to automatically compromise the underlying infrastructure.

(I would also expect that the Amazon retail systems are in most senses "just another tenant" on AWS, albeit with much more liberal quotas!)

Re: Twitch is hacked, and its source code leaked

#304

Post by ghostway-chess »

maccard wrote: post #230
Behemoth66 wrote: post #213

Earlier quoted context omitted.

Couldn’t find it in 1.4 Trillion combinations. Used rockyou.txt with dive.rule. Took me 6 minutes to try all 1.4 trillion passwords. So either you have a strong password or I messed something up. What is it? In theory if your password was weak enough to be on this list it would take on average 3 minutes to break it on a GTX 1080.

Thanks for trying! This somewhat supports what I'm suggesting - because that password hasn't been leaked by being posted in plaintext as a verified password, it's not available as a lookup, therefore it doesn't matter whether they used bcrypt, sha1 or md5, or even just pgp encrypted it, the password is likely "secure".

Well. Sha1 is not _that_ hard to break. It's a solved algorithm

Re: Twitch is hacked, and its source code leaked

#305

Post by ghostway-chess »

theneworc wrote: post #287
maccard wrote: post #246

Earlier quoted context omitted.

> It's not so much "how long does it take" as it is "how much does it cost" So the answer is "It's too expensive to figure out in practice, unless you're being explicitly targetted by someone with nation state level credentials?", i.e. it's pretty much fine? > Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. But by the sounds of it, SHA1 is…

>But by the sounds of it, SHA1 is more than enough (given that nobody here is willing to brute force the hash I shared above?) SHA1 is "more than enough" for this specific interaction in which you chose a complex password and/or your only opponents are unmotivated/non-incentivized HN commenters that don't have a password cracker at their immediate disposal. That doesn't mean anything outside of this context. If your…

But you shared a hash of an uncommon password. We probably have the salt (probably somewhere in the code) and people dont use password managers. So rainbow tables are enough. Oh, I thought the first sentence was you and not quoted. Agreed with the above

Re: Twitch is hacked, and its source code leaked

#306

Post by growt »

thaumasiotes wrote: post #267
growt wrote: post #140

Earlier quoted context omitted.

If they are properly hashed and salted, they can not.

Password salting has nothing to do with password reuse. Imagine two people have accounts on each of two websites: eBay YouTube Alice sunlight bobrules Bob bobrules bobrules A password reuse attack dumps the YouTube database, cracks Bob's password, and then accesses Bob's eBay account. The fix for this is that Bob should use different passwords on his different accounts. Hashing helps by making step 2 ("crack Bob's pa…

"Salting does not affect this attack in any way." Yes it does. If you habe unsalted passwords you can just use a rainbow table to look passwords up.

Re: Twitch is hacked, and its source code leaked

#307

Post by thaumasiotes »

growt wrote: post #306
thaumasiotes wrote: post #267

Earlier quoted context omitted.

Password salting has nothing to do with password reuse. Imagine two people have accounts on each of two websites: eBay YouTube Alice sunlight bobrules Bob bobrules bobrules A password reuse attack dumps the YouTube database, cracks Bob's password, and then accesses Bob's eBay account. The fix for this is that Bob should use different passwords on his different accounts. Hashing helps by making step 2 ("crack Bob's pa…

"Salting does not affect this attack in any way." Yes it does. If you habe unsalted passwords you can just use a rainbow table to look passwords up.

And that is not affected by salting. You can use a rainbow table to look passwords up whether or not those passwords are salted. There is zero conceptual connection between the two ideas.

Now, realistically, you can't use a rainbow table on passwords of any noticeable length, and a salt may push the password over the edge of that threshold. If that's really what you want... enforce a minimum password length.

Re: Twitch is hacked, and its source code leaked

#308

Post by growt »

thaumasiotes wrote: post #307
growt wrote: post #306

Earlier quoted context omitted.

"Salting does not affect this attack in any way." Yes it does. If you habe unsalted passwords you can just use a rainbow table to look passwords up.

And that is not affected by salting. You can use a rainbow table to look passwords up whether or not those passwords are salted. There is zero conceptual connection between the two ideas. Now, realistically, you can't use a rainbow table on passwords of any noticeable length, and a salt may push the password over the edge of that threshold. If that's really what you want... enforce a minimum password length.

"Use of a key derivation that employs a salt makes this attack infeasible." https://en.wikipedia.org/wiki/Rainbow_table

"Salts defend against attacks that use precomputed tables (e.g. rainbow tables)" https://en.wikipedia.org/wiki/Salt_(cryptography)

Re: Twitch is hacked, and its source code leaked

#309

Post by astrange »

ghostway-chess wrote: post #304
maccard wrote: post #230

Earlier quoted context omitted.

Thanks for trying! This somewhat supports what I'm suggesting - because that password hasn't been leaked by being posted in plaintext as a verified password, it's not available as a lookup, therefore it doesn't matter whether they used bcrypt, sha1 or md5, or even just pgp encrypted it, the password is likely "secure".

Well. Sha1 is not _that_ hard to break. It's a solved algorithm

That's for generating collisions, not preimage resistance. It's not particularly easy to reverse.

Re: Twitch is hacked, and its source code leaked

#310

Post by kordlessagain »

heurisko wrote: post #80
kordlessagain wrote: post #66

Earlier quoted context omitted.

From an ethical standpoint, any code that amplifies and profits from radical speech should be fair game for release. If employees or hackers feel the need to release info in that regard, so be it. This is the risk defined in such models and should be mitigated accordingly.

Who decides what speech is radical enough to compromise the privacy of users? And if speech is "radical" meaning to the point of illegality, shouldn't the legal system decide, rather than the court of public opinion?

Radical as in pushed to the extremes, not radical in thought to the general population. See https://www.youtube.com/watch?v=rE3j_RHkqJc&t=1s

That I've been DONT MENTION ARROWS ON HN on this post is a good indication we're not close to solving this by a long shot.

Post reply on HN