13 ms·

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I

• skilled 5y ago
  I'm hoping we will get to see a transparent report (from hacker or Twitch) on how this happened. I think anyone would be excited to hack Twitch as the site alone - or any big platform for that matter - but this is quite literally someone just downloading the entire Twitch ecosystem and publishing it online.
  • ergerger 5y ago
    Twitch has not been known to be transparent about anything.
• Hokusai 5y ago
  > this isn't something I'd expect from an Amazon owned property Because you expect Amazon to put security priority over new features and profit? We have very different understandings of what Amazon stands for.
  • adrusi 5y ago
    EC2, Amazon's cash cow, competes with nearly identical offerings from Microsoft and Google, and is not a place where additional features are often all that valuable to customers. Any sort of breach like this on EC2 would seriously hurt Amazon's bottom line and they know it.
  • nemothekid 5y ago
    >Because you expect Amazon to put security priority over new features and profit? I don't know what you think Amazon stands for, but Amazon runs the largest cloud hosting service in the world - AWS, which not only runs a large number of other large companies but governments as well. I know, first hand, that their datacenter security protocols are state of the art. Amazon has a much larger surface attack area so if they were playing fast and loose with security, chances are we would know already.
    • Hokusai 5y ago
      > Amazon has a much larger surface attack area so if they were playing fast and loose with security, chances are we would know already. I get your point and I am no taking about AWS but about Twitch. Each part of the company has its own incentives. Amazon is well know for not caring about quality nor its employees. In my experience with corporations there is little to no technical sharing between different parts of the company. AWS could have the best SecOps in the world and Twitch could have no security at all. Is your experience different?
      • vineyardmike 5y ago
        > In my experience with corporations there is little to no technical sharing between different parts of the company. Amazon is all about sharing efforts with the company. That's the whole point of AWS - its a monetization of this efforts. Most older AWS services started out as internal services that someone realized was generally useful.
      • nemothekid 5y ago
        I'm not sure what point you are trying to make. If you look at most of the high profile hacks and leaks in the past 20 years, very few of them are from web 2.0 tech companies (e.g. Google, Facebook) rather than dinosaurs (ex. Target). Those that have (like Google) have only been successfully breached by nation actors (e.g. China, NSA). As far as I can tell, there's no data to back up the assertion that these large tech companies are disregarding security if favor of profits, except for Twitch now, which is why this leak is interesting to me.
• FormerBandmate 5y ago
  I mean, it did work on Amazon (a division with poorer security probably, but still). 4chan is a truly special place
• leros 5y ago
  It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.
  • com2kid 5y ago
    > Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere. I am trying to recall, but I am pretty sure when I worked in Microsoft Office that a build would pull down many tens of gigabytes of data. 125GB in one day from the build system wouldn't be uncommon!
    • Raidion 5y ago
      That's ingress though. Companies should be monitoring and worrying about egress. Edit: This won't help against a thumbdrive, but that type of thing should be also tracked.
      • AustinDev 5y ago
        I'm working on a project and just had to repull my workspace after some local corruption. I pulled 1.2TB out of the office and never got an email. I think it's pretty common for places not to monitor egress that closely.
  • yawaworht1978 5y ago
    Indeed , how could this happen, really curious. So let's say someone with access to all GitHub repos gave the password to someone else, maybe then it was downloaded from another machine? Or someone stole the credentials and downloaded from another machine? Or someone got access to such a machine? It's it not possible to prevent these cases? How long does such a download take?
  • stefan_ 5y ago
    Cue monorepo discussion
• koolba 5y ago
  How much of this is a holdover of lax security practices from before they were acquired? I can’t imagine AWS being managed in a way where local network access gives you keys to the kingdom. Then again, EC2 instance profiles do let you do quite a bit.
  • lamontcg 5y ago
    Conflating AWS security with twitch security is probably the wrong way to think about it. Within Amazon those are almost going to be two entirely separate companies, with very different security focuses. The idea that Amazon is monolithic and uniform wasn't true when I left there in 2006, and I'm certain it is less so now. And that isn't just that its related to the merger, but that fundamentally its different business orgs with different focus.
    • vineyardmike 5y ago
      But does twitch not share the same Amazon wide git service? Could most of Amzn code be leaked or compromised? Seems like all of amazon internals that shares security measures is at risk...
      • cheeze 5y ago
        I've heard (but don't have any actual evidence more than hearsay) that Twitch generally operates independently of Amazon/AWS. I'm sure that they share some things, but I wouldn't be surprised if their source was separate from the "main repo"
      • bleepblooop 5y ago
        Remember that Amazon runs one of the biggest multi-tenant service platforms in the industry! A separate business unit like Twitch is likely to be set up a lot like any other random AWS customer, and you wouldn't expect that compromising servers used by one AWS customer to automatically compromise the underlying infrastructure. (I would also expect that the Amazon retail systems are in most senses "just another tenant" on AWS, albeit with much more liberal quotas!)
  • 5y ago
• ArlenBales 5y ago
  There are so many indiscreet USB pentesting devices easily purchasable by anyone today, I'm actually surprised this sort of thing doesn't happen more often.
  • SketchySeaBeast 5y ago
    Shouldn't that be discreet devices? Or do they make a really high pitched whine with a big flashing light when they start transferring data?
    • angst_ridden 5y ago
      "Hey, Jeff, what's that weird thumb-drive over there that keeps texting me `I'm in your datacenter downloading your datas'?"
• 63 5y ago
  > It's also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data? Maybe they did try to ransom it, but I'd imagine someone with this kind of access inside Twitch must have had some creative way of making money. Notably, the initial leak didn't actually include the password data which the leaker claims to have, just source code and payment data which has been verified by several affected streamers. It's possible that this first leak was just to establish trust so they can random or auction password hashes later.
  • zinekeller 5y ago
    Maybe that Twitch is competent in the password department so they decided against it? But thinking about it, although it's unclear if two-factor secrets are included in the leak, but maybe the two-factor secrets may be usable to someone who has already the password of a victim. Unless it's the dongle-type one (WebAuthn/FIDO), the secret is common to both the server and the user, so two-factor bypass is almost certain in this case.
  • nemothekid 5y ago
    >It's possible that this first leak was just to establish trust so they can random or auction password hashes later. Password hashes are relatively useless though? Once the leak is announced I imagine most of the big targets will rotate their credentials. Then the next thing you need to do is spend possibly thousands in CPU time bruteforcing bcrypt hashes. Then I'm not sure what you can even do with those. I'm not criminally creative but I imagine you could make more by abusing trust with payment processors or fraudulent invoices.
    • j_walter 5y ago
      Relatively useless...but if even a few percent of people recycle passwords used for banking or crypto platforms it could be a profitable cache of data.
    • tyingq 5y ago
      >Then I'm not sure what you can even do with those Assume some end users used the same passwords on other, non-twitch accounts. That's what makes hacked passwords valuable, no matter where they came from.
• yupper32 5y ago
  Does anyone know if Twitch employees have two factor auth? Having access to an employee's account would be the easiest way to pull this off. It'd be strange if they don't have two factor auth, of course, but it's just as strange to have this large of a hack. I think if it is a simple case of an employee account takeover, then the attack would "work" to some extent at any company. Larger companies typically have strict data access requirements, though. Good luck finding the few employees who have raw access to Google password hashes, for example. And even more luck knowing how to get that data if you do.
  • some_furry 5y ago
    > Does anyone know if Twitch employees have two factor auth? Yes, IIRC everyone at Amazon has a hardware security key (which is more secure than the standard mobile app TOTP most of us use everywhere online).
    • ramesh31 5y ago
      >(which is more secure than the standard mobile app TOTP most of us use everywhere online). Is it though? The "wrench theory" applies here. It's not unthinkable that an employee was stalked on social media and had their key stolen.
      • bawolff 5y ago
        Its still more secure. Rubber hose cryptanalysis applies to both equally, but that doesn't mean there aren't other attacks that apply to totp which don't to yubikeys. More secure != perfectly secure.
        • xmprt 5y ago
          With a phone you need my passcode to accept to 2FA request (assuming lock screen notifications are disabled). I think yubikeys can work without a passcode as long you plug it in right?
• pizzazzaro 5y ago
  Considering who owns it? There's conversations with government agencies asking "are we okay?" To the world's richest man.
• kordlessagain 5y ago
  From an ethical standpoint, any code that amplifies and profits from radical speech should be fair game for release. If employees or hackers feel the need to release info in that regard, so be it. This is the risk defined in such models and should be mitigated accordingly.
  • heurisko 5y ago
    Who decides what speech is radical enough to compromise the privacy of users? And if speech is "radical" meaning to the point of illegality, shouldn't the legal system decide, rather than the court of public opinion?
    • kordlessagain 5y ago
      Radical as in pushed to the extremes, not radical in thought to the general population. See https://www.youtube.com/watch?v=rE3j_RHkqJc&t=1s https://www.youtube.com/watch?v=rE3j_RHkqJc&t=1s That I've been DONT MENTION ARROWS ON HN on this post is a good indication we're not close to solving this by a long shot.
• madrox 5y ago
  There were no encrypted password dumps. No production secrets were leaked (according to the article). What's here is no more than what your average Twitch engineer has access to. Yes, that included payout data. Anyone with "staff" access to the site (which any employee can have) has access to any streamer's dashboard, which includes payout data. I don't think this was an attack. Based on the data so far I think it was a disgruntled engineer. Obviously if more gets leaked later I may revise that opinion.
  • twistedpair 5y ago
    So much for information compartmentalization. Does the typical engineer need access to payment details for their daily work?
    • deleted 5y ago
      [deleted]
    • ABeeSea 5y ago
      Part of the appeal is working at a place like Amazon is having a voice in decision making in the product you’re building. Hard to make informed decisions or opinions without the data. Engineers in Amazon retail definitely have broad access to sales data.
    • oconnor663 5y ago
      The tradeoffs for any individual piece of data are different from the tradeoffs of a company-wide policy. Siloing off one little thing (e.g. credit card info) usually doesn't inconvenience very many people, but at the same time it only provides marginal security. No front page headline has ever read "At Least The Credit Card Info Was Safe". On the other hand, a company-wide policy of siloing everything can have more of a security impact, but it also inconveniences everyone frequently. That's the tradeoff that many tech companies don't want to make.
      • zerkten 5y ago
        I don't see how this precludes just-in-time access. Even if people can re-up on their own, you can still observe the data access patterns and manage the risk. Further, when you see someone is getting blocked a lot you can improve the experience for them so they are unblocked, or have more efficient access to the data. This is just mature data and security management. Quality of life and developer experience are important topics in many ways, but should they really trump security consistently? It's always going to be dependent on people's risk assessment and comfort, but frequently it skews the wrong way because the people making the decisions know that they'll be gone.
• gorgoiler 5y ago
  Facebook [2011] was pretty bad… https://www.theguardian.com/technology/2012/feb/17/facebook-hacker-glenn-mangham-jailed https://www.theguardian.com/technology/2012/feb/17/facebook-... …except Mangham didn’t ever get to release his spoils to The Internet?
• dilyevsky 5y ago
  > I can't think of another, large, corporate web 2.0 startup who's gotten owned in a similar fashion Linkedin, Microsoft, Yahoo, Google
• slightwinder 5y ago
  > It's also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data? From what I heard about Twitch-interns over the years, it seems the company is more a third-rate-s**hole that grew too big too fast and accumulated a huge amount of technical debt and fatal security flaws. Making billions doesn't mean anything if you don't invest them back into the important corners of the company. It's considered a miracle that the platform is still working that well in that state. And what comes from the leaks so far supports this view. Though, said that, it seems they did start to improve one or two years ago, just too late to prevent this critical hit. But considering this was also a strike that avoided the deadly parts (yet), maybe there is a different aim here and the company can grow from this? It will be interesting to see how Amazon will react to this.
  • superfrank 5y ago
    > From what I heard about Twitch-interns over the years, it seems the company is more a third-rate-s*hole that grew too big too fast and accumulated a huge amount of technical debt and fatal security flaws. I mean this as a genuine question, but is there any company that didn't end up like this after an exponential growth phase? I'm not saying it's okay, but this feels par for the course. I've now been at two start ups during that hockey stick growth time and both went through this as well. I'd be curious if anyone here has worked at a large, fast growing tech company where they didn't accumulate a ton of technical debt during growth. If so, what did the company do to prevent that?
    • slightwinder 5y ago
      Generally yes, but Twitch is not your average startup. It's now 10 years old, and 7 of those years it was owned by Amazon, which should have enough competence and manpower for bringing it onto a good course. But from what I heard, Amazon did neglect Twitch for a long time and focused too much on making it a profitable business by all costs. Because of which they had all those scandals and problems in the last years. It's a business-platform, where technology is just an afterthought.
• aahortwwy 5y ago
  ITT: people shocked that something like this could happen at a company the size and profile of Twitch. Running security at scale in a hypergrowth B2C company is very difficult. It's also completely different from running security at a startup, in a B2B company, or a slower-growth situation. _Every_ security executive and manager I've met has given up in frustration after 12-24 months and gone to take a cushy FAANG job instead. I'm not surprised at all. My experience in security at a larger SV unicorn was that changes only happened in the immediate aftermath of a security crisis. Otherwise, there was incredible inertia and you just wouldn't be able to get the institutional support you needed to make progress.
  • xwolfi 5y ago
    It's funny because for me each letter of FAANG is an hypergrowth B2C company...
    • aahortwwy 5y ago
      All of them have very significant B2B products.