7 ms·

Hi ya'll, I have a question. My wife and I can't wrap our brains around the fact that payment info was leaked alongside source code. Any theories how this hap

Hi ya'll, I have a question. My wife and I can't wrap our brains around the fact that payment info was leaked alongside source code. Any theories how this happened? Former pentester btw. I saw a lot of interesting things during my time, but I can't recall seeing a payment database next to a source code repo. Did their s3 bucket get popped or something? Even if their github enterprise got popped, that doesn't explain that streamer payouts down to the dollar were leaked. "Oh yeah, I commit all my stripe data into github. It's for compliance /s" EDIT: If you want to see how much everyone's making: https://www.reddit.com/r/LivestreamFail/comments/q2gooi/twitchtv_got_leaked_like_the_entire_website/hfl2zgu/ https://www.reddit.com/r/LivestreamFail/comments/q2gooi/twit...

raxxorrax 5y ago
I guess if you have access to a build server that you might spy out some access credentials to other venues. Not impossible at least or perhaps some sort of service account was compromised that had access to both. Doesn't mean there was an immediate proximity of these system, although that might also be possible.
beckler 5y ago
My guess is it was an disgruntled employee who took a copy of all this data.
- mkr-hn 5y ago
  Theorypothesis: the pre-Amazon acquisition company had very informal access controls, and Amazon is known for limiting how much change it imposes on acquisitions, so didn't know about this or didn't change to a more corporatey way of controlling access.
  - dgemm 5y ago
    IIRC twitch was always very resistant to Amazon processes like COEs, so I wouldn't be surprised if they pushed back on stricter access controls too.
- shultays 5y ago
  It is even weirder if it is an employee. What kind of employee has access to both code and payment data?
ryanlol 5y ago
> but I can't recall seeing a payment database next to a source code repo. I suspect you just haven’t looked at what the BI team has been up to. This seems like exactly the kind of stuff BI folks always leave on git.
ssklash 5y ago
Also a pentester. My guess is they just had really broad access to Twitch's systems, not that card data and source code were together. Given the amount and range of data, wide-ranging access to their infrastructure is the only thing that makes sense to me here.
- garyfirestorm 5y ago
  Are you guys (other commenter) are professional pentesters? How do you become one? Do you freelance or work full time 8-5?
  - ganoushoreilly 5y ago
    There are a ton of companies hiring pentesters. Most testers fall into the profession after having worked in other network or IT related professions. A few are free lance, most work for a company or in my case start their own and expand out services. It's not really any different than any other tech job at the end of the day, it just seems glamorous. Don't become a pentester if you're not ready to write extensive reports.. it's probably 75% of the job. With that, there are tons of specific disciplines you can focus on for pentesting. I'd figure out what excites you and then go for it. Web app is diff than physical exploitation of security systems etc. but some of them cross over. Another option. Work for the government, join a red team or apply. They'll train you and you'll leave with a new perspective and possibly knowledge you can't get elsewhere.
    - anonymouse008 5y ago
      [potentially off topic] > if you're not ready to write extensive reports.. it's probably 75% of the job Do you happen to have a system for building these out? As a techie, I imagine you've tried something like text-expander or similar... but I see a lot of people unsatisfied that they end up building their own tools.
      - ganoushoreilly 5y ago
        Yes, We have a few tools that fill in based on scan data, with typical points of data, but a lot of what we're doing requires it's presented in a few different perspectives. Generally we provide a couple reports, the Highly Technical (with notes, logs of actions, etc. This can be hundreds of pages, but it's meant to be a reference for the engineering teams fixing what we found. We also sometimes provide full screen captures of the "ops". Second we provide a paired down version of that report with issues and recommendations, usually for the person that's hired us. It includes what we recommend for them to be successful. Finally we provide an Executive report that is designed to be presented by the second report recipient. Usually we've addressed the high level issues, helped with internal requests if possible (IE IT/Security wanted a budget for new firewall, we help boost that with our report as part of future planning etc.) and ultimately this report is designed to give whomever hired us the ability to be the rockstar (we're just the tool). So all in, there are different tools needed for each report. Fortunately the way we capture the data and notes through out the "op" makes it much easier for the team to put together each part. There's ways we could automate more, we've even messed with AI writing some of the suggestions and actions based on input. So far though, we still need the humans in the loop. Honestly the first few reports are hardest, after that you find a process and it becomes much easier.
slightwinder 5y ago
There are several ways why this could have happened. 1) The payment-data were just artifacts left on some file-server or from a process, which was accessible from dev-space. 2) No real systems were accessed and everything, it's all from a bad backup-server or poorly managed worker-pool. 3) Multiple Persons got hacked. 4) Exit-Scam of one or more Workers who just had broad enough access for some reason. 5) Twitch's security is just that bad. Some notable thing is, the payment-data are quite limited, there are no real private data it seems, and the git-history seems also be missing. It's not sure whether this is on purpose and whether more data will follow. But this overall hints so far that this at least was not a full deep hack.
- ric2b 5y ago
  > and the git-history seems also be missing. The article says otherwise: "The entirety of Twitch’s source code with commit history “going back to its early beginnings”"
  - sumtechguy 5y ago
    git commits are a good place to look for passwords/users checked in. unless you specifically prune them. so your current mainline may not have it but the stuff is still there in the commit history chain. so if you have access to that you probably could leverage it into several other systems.
MarkSweep 5y ago
Maybe they backed-up both to the same place and their backups got hacked?
ganoushoreilly 5y ago
Curiously the torrent is labeled part 1 so my guess is there was a wide breach and this was just some of the data they wanted to put together. There are devops tools, soc tools, and a ton of random things here, I guess we'll have to sit and wait to see if more follows.
Seanambers 5y ago
Amouranth made $92,949 licking a microphone - LOL. What a world.
- semi-extrinsic 5y ago
  https://xkcd.com/305/ https://xkcd.com/305/
  - tgsovlerkhgsel 5y ago
    Rule 35, quoted either as "if there is no porn of it, it will be made" or "if there is no porn of it, you are required to make it".
    - hnick 5y ago
      Or simply change your perspective on what porn is, and it's already there. "Feet pics when?!?"
    - brutal_chaos_ 5y ago
      > 34
      - tgsovlerkhgsel 5y ago
        Rule 34 is "There is porn of it", I was explaining Rule 35.
        brutal_chaos_ 5y ago
        My mistake. :)
- colinmhayes 5y ago
  In a month. Plus donations. Plus youtube. Plus only fans. Plus I'm sure she sells merch.
oauea 5y ago
some of the leaked code has embedded credentials in it
- bobmaxup 5y ago
  Yeah, it looks like there are a lot of hard-coded credentials, and one of those is to a twitch_reports database, which might be where these financial reports came from.
notsureaboutpg 5y ago
The source code details how to access the payment data, probably, for dashboards, etc.
iuri1 5y ago
Either database dumps are in commit history (very common) or credentials like a password for a database is (even more common). A third reason would be finding a security flaw in the source code and exploiting it.
- _hilro 5y ago
  < Either database dumps are in commit history (very common Nobody is putting production databases in to commit history. At the size of twitch, there's also no way any application dev has access to production. > credentials like a password for a database is (even more common). ??? What cowboy outfit is putting things which grant access to production customer data in to git?
  - maverwa 5y ago
    I know projects that do or did put their production database credentials, which had full read and write access, in git. And no, thats not a clever thing to do, neither is there a good reason to do it. But people do things you do not like and theres little you can do about it. I would like to live in a world where you were right, but I am not. Sadly. [Edit] dumps though are another thing. Not seen that, yet.
  - epse 5y ago
    Twitch, it seems https://sizeof.cat/post/twitch-leaks/#secrets-exposed https://sizeof.cat/post/twitch-leaks/#secrets-exposed
    - unclekev 5y ago
      You need to open that link incognito. (If clicking through from HN) The site you linked to detects if the referrer url is HN and instead displays only an image saying "HACKER NEWS - A DDoS MADE OF FINANCE-OBSESSED MAN-CHILDREN AND BROGRAMMERS" instead of the content you are trying to link too. wtf
      - rollo 5y ago
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
anonu 5y ago
It's all on AWS and some insider had super user access... (My baseline theory)
pier25 5y ago
I hope these people are paying their taxes...
kevinsundar 5y ago
Hardcoded database creds in code. Saw a post earlier with credentials to an rds instance. It said there were more examples. EDIT Found it again: https://sizeof.cat/post/twitch-leaks/#secrets-exposed https://sizeof.cat/post/twitch-leaks/#secrets-exposed
- unclekev 5y ago
  You need to open that link incognito. (If clicking through from HN) The site you linked to detects if the referrer url is HN and instead displays only an image saying "HACKER NEWS - A DDoS MADE OF FINANCE-OBSESSED MAN-CHILDREN AND BROGRAMMERS" instead of the content you are trying to link too. OK Then...
  - demindiro 5y ago
    If you're using Firefox you can prevent the browser from sending the Referer by going to `about:config` and setting `network.http.sendRefererHeader` to 0.
  - kevinsundar 5y ago
    My bad, didn't do that on Safari. Maybe some sort of tracking protection.
deleted 5y ago
[deleted]
yawaworht1978 5y ago
https://www.theverge.com/platform/amp/2021/10/6/22712365/twitch-data-leak-breach-security-confirmation-comments https://www.theverge.com/platform/amp/2021/10/6/22712365/twi... They say hacked

raxxorrax 5y ago

I guess if you have access to a build server that you might spy out some access credentials to other venues. Not impossible at least or perhaps some sort of service account was compromised that had access to both. Doesn't mean there was an immediate proximity of these system, although that might also be possible.

beckler 5y ago

My guess is it was an disgruntled employee who took a copy of all this data.

mkr-hn 5y ago
Theorypothesis: the pre-Amazon acquisition company had very informal access controls, and Amazon is known for limiting how much change it imposes on acquisitions, so didn't know about this or didn't change to a more corporatey way of controlling access.
- dgemm 5y ago
  IIRC twitch was always very resistant to Amazon processes like COEs, so I wouldn't be surprised if they pushed back on stricter access controls too.
shultays 5y ago
It is even weirder if it is an employee. What kind of employee has access to both code and payment data?

ryanlol 5y ago

> but I can't recall seeing a payment database next to a source code repo. I suspect you just haven’t looked at what the BI team has been up to. This seems like exactly the kind of stuff BI folks always leave on git.

ssklash 5y ago

Also a pentester. My guess is they just had really broad access to Twitch's systems, not that card data and source code were together. Given the amount and range of data, wide-ranging access to their infrastructure is the only thing that makes sense to me here.

garyfirestorm 5y ago
Are you guys (other commenter) are professional pentesters? How do you become one? Do you freelance or work full time 8-5?
- ganoushoreilly 5y ago
  There are a ton of companies hiring pentesters. Most testers fall into the profession after having worked in other network or IT related professions. A few are free lance, most work for a company or in my case start their own and expand out services. It's not really any different than any other tech job at the end of the day, it just seems glamorous. Don't become a pentester if you're not ready to write extensive reports.. it's probably 75% of the job. With that, there are tons of specific disciplines you can focus on for pentesting. I'd figure out what excites you and then go for it. Web app is diff than physical exploitation of security systems etc. but some of them cross over. Another option. Work for the government, join a red team or apply. They'll train you and you'll leave with a new perspective and possibly knowledge you can't get elsewhere.
  - anonymouse008 5y ago
    [potentially off topic] > if you're not ready to write extensive reports.. it's probably 75% of the job Do you happen to have a system for building these out? As a techie, I imagine you've tried something like text-expander or similar... but I see a lot of people unsatisfied that they end up building their own tools.
    - ganoushoreilly 5y ago
      Yes, We have a few tools that fill in based on scan data, with typical points of data, but a lot of what we're doing requires it's presented in a few different perspectives. Generally we provide a couple reports, the Highly Technical (with notes, logs of actions, etc. This can be hundreds of pages, but it's meant to be a reference for the engineering teams fixing what we found. We also sometimes provide full screen captures of the "ops". Second we provide a paired down version of that report with issues and recommendations, usually for the person that's hired us. It includes what we recommend for them to be successful. Finally we provide an Executive report that is designed to be presented by the second report recipient. Usually we've addressed the high level issues, helped with internal requests if possible (IE IT/Security wanted a budget for new firewall, we help boost that with our report as part of future planning etc.) and ultimately this report is designed to give whomever hired us the ability to be the rockstar (we're just the tool). So all in, there are different tools needed for each report. Fortunately the way we capture the data and notes through out the "op" makes it much easier for the team to put together each part. There's ways we could automate more, we've even messed with AI writing some of the suggestions and actions based on input. So far though, we still need the humans in the loop. Honestly the first few reports are hardest, after that you find a process and it becomes much easier.

slightwinder 5y ago

There are several ways why this could have happened. 1) The payment-data were just artifacts left on some file-server or from a process, which was accessible from dev-space. 2) No real systems were accessed and everything, it's all from a bad backup-server or poorly managed worker-pool. 3) Multiple Persons got hacked. 4) Exit-Scam of one or more Workers who just had broad enough access for some reason. 5) Twitch's security is just that bad. Some notable thing is, the payment-data are quite limited, there are no real private data it seems, and the git-history seems also be missing. It's not sure whether this is on purpose and whether more data will follow. But this overall hints so far that this at least was not a full deep hack.

ric2b 5y ago
> and the git-history seems also be missing. The article says otherwise: "The entirety of Twitch’s source code with commit history “going back to its early beginnings”"
- sumtechguy 5y ago
  git commits are a good place to look for passwords/users checked in. unless you specifically prune them. so your current mainline may not have it but the stuff is still there in the commit history chain. so if you have access to that you probably could leverage it into several other systems.

MarkSweep 5y ago

Maybe they backed-up both to the same place and their backups got hacked?

ganoushoreilly 5y ago

Curiously the torrent is labeled part 1 so my guess is there was a wide breach and this was just some of the data they wanted to put together. There are devops tools, soc tools, and a ton of random things here, I guess we'll have to sit and wait to see if more follows.

Seanambers 5y ago

Amouranth made $92,949 licking a microphone - LOL. What a world.

semi-extrinsic 5y ago
https://xkcd.com/305/ https://xkcd.com/305/
- tgsovlerkhgsel 5y ago
  Rule 35, quoted either as "if there is no porn of it, it will be made" or "if there is no porn of it, you are required to make it".
  - hnick 5y ago
    Or simply change your perspective on what porn is, and it's already there. "Feet pics when?!?"
  - brutal_chaos_ 5y ago
    > 34
    - tgsovlerkhgsel 5y ago
      Rule 34 is "There is porn of it", I was explaining Rule 35.
      - brutal_chaos_ 5y ago
        My mistake. :)
colinmhayes 5y ago
In a month. Plus donations. Plus youtube. Plus only fans. Plus I'm sure she sells merch.

oauea 5y ago

some of the leaked code has embedded credentials in it

bobmaxup 5y ago
Yeah, it looks like there are a lot of hard-coded credentials, and one of those is to a twitch_reports database, which might be where these financial reports came from.

notsureaboutpg 5y ago

The source code details how to access the payment data, probably, for dashboards, etc.

iuri1 5y ago

Either database dumps are in commit history (very common) or credentials like a password for a database is (even more common). A third reason would be finding a security flaw in the source code and exploiting it.

_hilro 5y ago
< Either database dumps are in commit history (very common Nobody is putting production databases in to commit history. At the size of twitch, there's also no way any application dev has access to production. > credentials like a password for a database is (even more common). ??? What cowboy outfit is putting things which grant access to production customer data in to git?
- maverwa 5y ago
  I know projects that do or did put their production database credentials, which had full read and write access, in git. And no, thats not a clever thing to do, neither is there a good reason to do it. But people do things you do not like and theres little you can do about it. I would like to live in a world where you were right, but I am not. Sadly. [Edit] dumps though are another thing. Not seen that, yet.
- epse 5y ago
  Twitch, it seems https://sizeof.cat/post/twitch-leaks/#secrets-exposed https://sizeof.cat/post/twitch-leaks/#secrets-exposed
  - unclekev 5y ago
    You need to open that link incognito. (If clicking through from HN) The site you linked to detects if the referrer url is HN and instead displays only an image saying "HACKER NEWS - A DDoS MADE OF FINANCE-OBSESSED MAN-CHILDREN AND BROGRAMMERS" instead of the content you are trying to link too. wtf
    - rollo 5y ago

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

anonu 5y ago

It's all on AWS and some insider had super user access... (My baseline theory)

pier25 5y ago

I hope these people are paying their taxes...

kevinsundar 5y ago

Hardcoded database creds in code. Saw a post earlier with credentials to an rds instance. It said there were more examples. EDIT Found it again: https://sizeof.cat/post/twitch-leaks/#secrets-exposed https://sizeof.cat/post/twitch-leaks/#secrets-exposed

unclekev 5y ago
You need to open that link incognito. (If clicking through from HN) The site you linked to detects if the referrer url is HN and instead displays only an image saying "HACKER NEWS - A DDoS MADE OF FINANCE-OBSESSED MAN-CHILDREN AND BROGRAMMERS" instead of the content you are trying to link too. OK Then...
- demindiro 5y ago
  If you're using Firefox you can prevent the browser from sending the Referer by going to `about:config` and setting `network.http.sendRefererHeader` to 0.
- kevinsundar 5y ago
  My bad, didn't do that on Safari. Maybe some sort of tracking protection.

deleted 5y ago

[deleted]

yawaworht1978 5y ago

https://www.theverge.com/platform/amp/2021/10/6/22712365/twitch-data-leak-breach-security-confirmation-comments https://www.theverge.com/platform/amp/2021/10/6/22712365/twi... They say hacked