Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

91–100 of 325 posts

Re: Twitch is hacked, and its source code leaked

#91

Post by ganoushoreilly »

koolba wrote: post #9
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

How much of this is a holdover of lax security practices from before they were acquired? I can’t imagine AWS being managed in a way where local network access gives you keys to the kingdom. Then again, EC2 instance profiles do let you do quite a bit.

If you go back to the Adobe software breach circa 2013, a large part of their issues were the bolt on connections between acquisitions. It's honestly the most common thing I see in the startup world.

Re: Twitch is hacked, and its source code leaked

#92

Post by twofornone »

tyingq wrote: post #76
nemothekid wrote: post #28

Earlier quoted context omitted.

> It's possible that this first leak was just to establish trust so they can random or auction password hashes later. Password hashes are relatively useless though? Once the leak is announced I imagine most of the big targets will rotate their credentials. Then the next thing you need to do is spend possibly thousands in CPU time bruteforcing bcrypt hashes. Then I'm not sure what you can even do with those. I'm not c…

>Then I'm not sure what you can even do with those Assume some end users used the same passwords on other, non-twitch accounts. That's what makes hacked passwords valuable, no matter where they came from.

That's something I've wondered - do password hashes tend to be the same across platforms? Is everyone using the same hashing algorithm? Isn't this also what salting is for?

Never implemented auth myself.

Re: Twitch is hacked, and its source code leaked

#93

Post by BitwiseFool »

duskwuff wrote: post #46
lapetitejort wrote: post #33

Earlier quoted context omitted.

I found out how to destroy reddit. Just fork their repos! https://github.com/reddit

Sadly, Reddit stopped updating the public repo for their main application in 2017: https://github.com/reddit-archive/reddit

It's for the best. New reddit is awful.

Re: Twitch is hacked, and its source code leaked

#94

Post by vineyardmike »

crdrost wrote: post #65
manojlds wrote: post #42

Earlier quoted context omitted.

Case against monorepos?

There are much better cases than this; in this case a monorepo makes it slightly more likely to be caught rather than less. (A monorepo can get to Google size and then you can't check it all out at once and it needs bespoke tooling, which can make it harder to pull this off.) On the flip side while many smaller repos _can_ have independent ACLs, you are very unlikely to set those up until you reach a certain scale --…

> So your engineers probably all have access to all your repos until you reach a very large size anyway.

Happens at my company. We have rudimentary ACL but not sure how its implemented because you can find things via explicit searching, or via "organic finding" via links from repo->repo but it won't be surfaced if you just search for code.

Re: Twitch is hacked, and its source code leaked

#96

Post by tptacek »

leros wrote: post #8
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

There was a fad for tools that accomplished this in enterprise networks, with much clearer rules for who needs to access what (it was called "data loss prevention", or DLP) and those tools for the most part don't work. This is a harder problem than it looks like.

Re: Twitch is hacked, and its source code leaked

#97

Post by vineyardmike »

javajosh wrote: post #51
CobrastanJorji wrote: post #40

Earlier quoted context omitted.

If the bulk of it is a git repo, it's probably expected that every engineer will download it regularly.

How often do devs delete and re-clone?

I suspect lots of junior devs will clone fresh, push changes, nuke repo and repeat. I did when i was young instead of syncing state and rebasing.

Re: Twitch is hacked, and its source code leaked

#98

Post by bduerst »

twofornone wrote: post #92
tyingq wrote: post #76

Earlier quoted context omitted.

>Then I'm not sure what you can even do with those Assume some end users used the same passwords on other, non-twitch accounts. That's what makes hacked passwords valuable, no matter where they came from.

That's something I've wondered - do password hashes tend to be the same across platforms? Is everyone using the same hashing algorithm? Isn't this also what salting is for? Never implemented auth myself.

In a perfect world, no, but lazily someone could skip salting and/or use common hashing functions. IIRC this was a problem at Sony not too long ago.

Re: Twitch is hacked, and its source code leaked

#99

Post by tyingq »

twofornone wrote: post #92
tyingq wrote: post #76

Earlier quoted context omitted.

>Then I'm not sure what you can even do with those Assume some end users used the same passwords on other, non-twitch accounts. That's what makes hacked passwords valuable, no matter where they came from.

That's something I've wondered - do password hashes tend to be the same across platforms? Is everyone using the same hashing algorithm? Isn't this also what salting is for? Never implemented auth myself.

Yes, the hashes are (usually) different due to different algorithms and/or salts. But, if you've brute forced one by using good guesses, and know the email/userid for other sites, and the user used the same or a similar password...that doesn't matter.

Re: Twitch is hacked, and its source code leaked

#100

Post by peterkos »

CoolGuySteve wrote: post #55
dolores_ab wrote: post #11

Someone actually started streaming going through the code ... on twitch. https://www.twitch.tv/deepfrieddev

"Sorry. Unless you’ve got a time machine, that content is unavailable." Too bad, it would be nice to see someone go through and document how Twitch works. I've never worked at "web scale" so I'd probably learn a lot.

A lot of it is probably hacked together -- like, embarrassingly hacked together lol
Post reply on HN