Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch source code and customer data has reportedly been leaked

videogameschronicle.com

Post reply on HN
Print view View original

411–420 of 617 posts

Re: Twitch source code and customer data has reportedly been leaked

#411

Post by rvnx »

wizzairflyer wrote: post #396
stevefan1999 wrote: post #309

Here's a link to the data: bWFnbmV0Oj94dD11cm46YnRpaDpONUJMWjZYRUNORUhIQVJISk9WUUFTNFc3VFdSWENTSSZkbj10d2l0Y2gtbGVha3MtcGFydC1vbmUmdHI9dWRwJTNBJTJGJTJGb3Blbi5zdGVhbHRoLnNpJTNBODAlMkZhbm5vdW5jZQ==

I'm very curious to have a peek but isn't downloading stolen material a crime? And wouldn't this be compounded by the fact that with torrent systems you are also helping redistributing it further?

The fact that you are uploader (e.g. distributing the content) while downloading a torrent seems to me to be the biggest risk.

Re: Twitch source code and customer data has reportedly been leaked

#412

Post by bobmaxup »

oauea wrote: post #404
sillysaurusx wrote: post #337

Hi ya'll, I have a question. My wife and I can't wrap our brains around the fact that payment info was leaked alongside source code . Any theories how this happened? Former pentester btw. I saw a lot of interesting things during my time, but I can't recall seeing a payment database next to a source code repo. Did their s3 bucket get popped or something? Even if their github enterprise got popped, that doesn't explain…

some of the leaked code has embedded credentials in it

Yeah, it looks like there are a lot of hard-coded credentials, and one of those is to a twitch_reports database, which might be where these financial reports came from.

Re: Twitch source code and customer data has reportedly been leaked

#413

Post by AnIdiotOnTheNet »

Semaphor wrote: post #290
AnIdiotOnTheNet wrote: post #269

Earlier quoted context omitted.

I don't really get this. My phone number is apparently already known by every scammer and spammer on earth, which is why I never answer calls from people I don't know, so what am I losing? Meanwhile, Twitch has had a significant bot spamming problem.

I’m also subscribed to a few channels. I’m pretty sure that is a far stronger signal that I’m not a bot than getting my phone number. And unlike most people, I only had 2 or 3 spam calls, and maybe 10 spam SMS on the number I’ve had for almost 20 years.

Ok so you don't want them to have your phone number but you're ok with them having your payment details?

Re: Twitch source code and customer data has reportedly been leaked

#414

Post by ganoushoreilly »

garyfirestorm wrote: post #409
ssklash wrote: post #348

Earlier quoted context omitted.

Also a pentester. My guess is they just had really broad access to Twitch's systems, not that card data and source code were together. Given the amount and range of data, wide-ranging access to their infrastructure is the only thing that makes sense to me here.

Are you guys (other commenter) are professional pentesters? How do you become one? Do you freelance or work full time 8-5?

There are a ton of companies hiring pentesters. Most testers fall into the profession after having worked in other network or IT related professions. A few are free lance, most work for a company or in my case start their own and expand out services. It's not really any different than any other tech job at the end of the day, it just seems glamorous. Don't become a pentester if you're not ready to write extensive reports.. it's probably 75% of the job.

With that, there are tons of specific disciplines you can focus on for pentesting. I'd figure out what excites you and then go for it. Web app is diff than physical exploitation of security systems etc. but some of them cross over.

Another option. Work for the government, join a red team or apply. They'll train you and you'll leave with a new perspective and possibly knowledge you can't get elsewhere.

Re: Twitch source code and customer data has reportedly been leaked

#415

Post by mzfr »

garyfirestorm wrote: post #409
ssklash wrote: post #348

Earlier quoted context omitted.

Also a pentester. My guess is they just had really broad access to Twitch's systems, not that card data and source code were together. Given the amount and range of data, wide-ranging access to their infrastructure is the only thing that makes sense to me here.

Are you guys (other commenter) are professional pentesters? How do you become one? Do you freelance or work full time 8-5?

Depends actually, if you just want to do pentesting then probably do some certifications like OSCP, CompTIA, etc. Once you get those its quite easy to land a interview for pentesting.

Initially job may not pay good but you can build your network and then probably start doing contract works. Most of the pentesters I know make more from freelance/contract work then their jobs. Because mostly those contract/freelance work pays on hourly bases. The initial hour rates usually are somewhere between 40-50 USD but they can go to 120-150 with just after few jobs.

P.S - I might have made it sound a very simple or easy profession but its not :)

Re: Twitch source code and customer data has reportedly been leaked

#416

Post by kinghajj »

dilyevsky wrote: post #403
matheusmoreira wrote: post #167

Earlier quoted context omitted.

Yeah, it's so absurd it's hilarious. Seeing people make millions of USD for playing games and mentioning others in a live stream made me seriously rethink the value of my own work.

Now look at them yo-yos, that's the way you do it!

You play Among Us on the Twitch.TV!

Re: Twitch source code and customer data has reportedly been leaked

#417

Post by zalequin »

lordlic wrote: post #202
zalequin wrote: post #139

Earlier quoted context omitted.

Provided that its hashed with salt / diff methods, sure - but how can you be sure?

That's not what salting does, and different hashing methods are irrelevant. The danger of having your hash leaked is that it can be cracked and the plaintext password recovered. The hash itself is entirely useless for logging into other services.

t. infoseclet

Re: Twitch source code and customer data has reportedly been leaked

#418

Post by semi-extrinsic »

Seanambers wrote: post #398
sillysaurusx wrote: post #337

Hi ya'll, I have a question. My wife and I can't wrap our brains around the fact that payment info was leaked alongside source code . Any theories how this happened? Former pentester btw. I saw a lot of interesting things during my time, but I can't recall seeing a payment database next to a source code repo. Did their s3 bucket get popped or something? Even if their github enterprise got popped, that doesn't explain…

Amouranth made $92,949 licking a microphone - LOL. What a world.

https://xkcd.com/305/

Re: Twitch source code and customer data has reportedly been leaked

#419

Post by ganoushoreilly »

k1rcher wrote: post #324
sillysaurusx wrote: post #318

Earlier quoted context omitted.

Here's a base64 decoded version: magnet:?xt=urn:btih:N5BLZ6XECNEHHARHJOVQAS4W7TWRXCSI&dn=twitch-leaks-part-one&tr=udp%3A%2F%2Fopen.stealth.si%3A80%2Fannounce

Got it in my seedbox as of 15-20min ago: Downloaded: 7.84GB Uploaded: 64.64GB sheesh, one popular magnet!

That sounds like it's just the database. The full leak is 125.89gb
Post reply on HN