7 ms·

> It's also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data? Maybe they did

by 63 5y ago

> It's also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data? Maybe they did try to ransom it, but I'd imagine someone with this kind of access inside Twitch must have had some creative way of making money. Notably, the initial leak didn't actually include the password data which the leaker claims to have, just source code and payment data which has been verified by several affected streamers. It's possible that this first leak was just to establish trust so they can random or auction password hashes later.

zinekeller 5y ago
Maybe that Twitch is competent in the password department so they decided against it? But thinking about it, although it's unclear if two-factor secrets are included in the leak, but maybe the two-factor secrets may be usable to someone who has already the password of a victim. Unless it's the dongle-type one (WebAuthn/FIDO), the secret is common to both the server and the user, so two-factor bypass is almost certain in this case.
nemothekid 5y ago
>It's possible that this first leak was just to establish trust so they can random or auction password hashes later. Password hashes are relatively useless though? Once the leak is announced I imagine most of the big targets will rotate their credentials. Then the next thing you need to do is spend possibly thousands in CPU time bruteforcing bcrypt hashes. Then I'm not sure what you can even do with those. I'm not criminally creative but I imagine you could make more by abusing trust with payment processors or fraudulent invoices.
- j_walter 5y ago
  Relatively useless...but if even a few percent of people recycle passwords used for banking or crypto platforms it could be a profitable cache of data.
- tyingq 5y ago
  >Then I'm not sure what you can even do with those Assume some end users used the same passwords on other, non-twitch accounts. That's what makes hacked passwords valuable, no matter where they came from.
  - axpy906 5y ago
    Pretty much this. If they gain one email/username password combination - they can use it elsewhere.
    - skeeks 5y ago
      I would be very deeply concerned if Twitch, a multi-billion dollar company owned by Amazon, does not properly hash and salt the passwords of its users.
      - isbvhodnvemrwvn 5y ago
        You don't brute force it, you find the password for accounts with the same e-mail in leaks from other sites and try only those.
      - tyingq 5y ago
        You can still run those "top billion popular password" lists against properly salted/hashed passwords.
    - growt 5y ago
      If they are properly hashed and salted, they can not.
      - xorcist 5y ago
        The point here is that once you brute force the plaintext password, the same password might be used elsewhere.
        mercurywells 5y ago
- errantspark 5y ago
  A few things here. If you're the sort of person who runs a crypto mine, which I assume many of the people interested in breaking hashes are you have enough firepower at your disposal to at least perform a targeted attack on a few hashes with relative ease. Ideally that would be useless because things are properly salted and you don't know the salt, however with access to all of the source code as we have here I think it isn't as clear cut, as it may be possible to reverse out the salts as well. I'm not a cybersec guy so please take my speculation with a grain of salt.
  - maccard 5y ago
    I've heard this before, and queried how feasible an attack would be, as people always talk about just how bad this is but yet I've _never_ heard of someone having an account compromised through this vector, and I'd like to know how feasible it really is. Here's the sha1 of an unsalted password b85ffa7dae2cbed04e7d3335f6ebc43c8a5764dd How long does it actually take in practice to break something like this? I would love it if someone could prove it to me.
    - jaredsohn 5y ago
      Is the password ncc1701e? I just googled it and found https://hashtoolkit.com/decrypt-sha1-hash/b85ffa7dae2cbed04e7d3335f6ebc43c8a5764dd https://hashtoolkit.com/decrypt-sha1-hash/b85ffa7dae2cbed04e... along with other results.
      - maccard 5y ago
        It is! I guess using a password from Google isn't the best idea, and kind of defeated the point of what I wanted to ask (if your password isn't already hashed online how long does it actually take to break a sha1 hash), but definitely proves the point. Can I try again? Sha1 e7b7cdf949007abe7e8a190ba8eae56c60018c1f
        Behemoth66 5y ago
        Couldn’t find it in 1.4 Trillion combinations. Used rockyou.txt with dive.rule. Took me 6 minutes to try all 1.4 trillion passwords. So either you have a strong password or I messed something up. What is it? In theory if your password was weak enough to be on this list it would take on average 3 minutes to break it on a GTX 1080.
mdoms 5y ago
Doesn't seem likely to me. If the attacker has password hashes then they would want to keep this attack quiet so that the buyer of the hashes would have time to compute the passwords. If Twitch gets wind of this happening then a simple password reset would foil any efforts.
ganoushoreilly 5y ago
Given the torrent is labeled "twitch-leaks-part-one" I'm curious too as to what they have. The torrent breaks out into a lot of compressed volumes, so it's clear this wasn't just a backup file, but a curated collection of files. I'm very curious if we will see any other amazon related leaks come from it. Either way, I can only imagine the chaos inside as they try to figure out what has transpired here.

by 63 5y ago

zinekeller 5y ago

Maybe that Twitch is competent in the password department so they decided against it? But thinking about it, although it's unclear if two-factor secrets are included in the leak, but maybe the two-factor secrets may be usable to someone who has already the password of a victim. Unless it's the dongle-type one (WebAuthn/FIDO), the secret is common to both the server and the user, so two-factor bypass is almost certain in this case.

nemothekid 5y ago

>It's possible that this first leak was just to establish trust so they can random or auction password hashes later. Password hashes are relatively useless though? Once the leak is announced I imagine most of the big targets will rotate their credentials. Then the next thing you need to do is spend possibly thousands in CPU time bruteforcing bcrypt hashes. Then I'm not sure what you can even do with those. I'm not criminally creative but I imagine you could make more by abusing trust with payment processors or fraudulent invoices.

j_walter 5y ago
Relatively useless...but if even a few percent of people recycle passwords used for banking or crypto platforms it could be a profitable cache of data.
tyingq 5y ago
>Then I'm not sure what you can even do with those Assume some end users used the same passwords on other, non-twitch accounts. That's what makes hacked passwords valuable, no matter where they came from.
- axpy906 5y ago
  Pretty much this. If they gain one email/username password combination - they can use it elsewhere.
  - skeeks 5y ago
    I would be very deeply concerned if Twitch, a multi-billion dollar company owned by Amazon, does not properly hash and salt the passwords of its users.
    - isbvhodnvemrwvn 5y ago
      You don't brute force it, you find the password for accounts with the same e-mail in leaks from other sites and try only those.
    - tyingq 5y ago
      You can still run those "top billion popular password" lists against properly salted/hashed passwords.
  - growt 5y ago
    If they are properly hashed and salted, they can not.
    - xorcist 5y ago
      The point here is that once you brute force the plaintext password, the same password might be used elsewhere.
      - mercurywells 5y ago
errantspark 5y ago
A few things here. If you're the sort of person who runs a crypto mine, which I assume many of the people interested in breaking hashes are you have enough firepower at your disposal to at least perform a targeted attack on a few hashes with relative ease. Ideally that would be useless because things are properly salted and you don't know the salt, however with access to all of the source code as we have here I think it isn't as clear cut, as it may be possible to reverse out the salts as well. I'm not a cybersec guy so please take my speculation with a grain of salt.
- maccard 5y ago
  I've heard this before, and queried how feasible an attack would be, as people always talk about just how bad this is but yet I've _never_ heard of someone having an account compromised through this vector, and I'd like to know how feasible it really is. Here's the sha1 of an unsalted password b85ffa7dae2cbed04e7d3335f6ebc43c8a5764dd How long does it actually take in practice to break something like this? I would love it if someone could prove it to me.
  - jaredsohn 5y ago
    Is the password ncc1701e? I just googled it and found https://hashtoolkit.com/decrypt-sha1-hash/b85ffa7dae2cbed04e7d3335f6ebc43c8a5764dd https://hashtoolkit.com/decrypt-sha1-hash/b85ffa7dae2cbed04e... along with other results.
    - maccard 5y ago
      It is! I guess using a password from Google isn't the best idea, and kind of defeated the point of what I wanted to ask (if your password isn't already hashed online how long does it actually take to break a sha1 hash), but definitely proves the point. Can I try again? Sha1 e7b7cdf949007abe7e8a190ba8eae56c60018c1f
      - Behemoth66 5y ago
        Couldn’t find it in 1.4 Trillion combinations. Used rockyou.txt with dive.rule. Took me 6 minutes to try all 1.4 trillion passwords. So either you have a strong password or I messed something up. What is it? In theory if your password was weak enough to be on this list it would take on average 3 minutes to break it on a GTX 1080.

mdoms 5y ago

Doesn't seem likely to me. If the attacker has password hashes then they would want to keep this attack quiet so that the buyer of the hashes would have time to compute the passwords. If Twitch gets wind of this happening then a simple password reset would foil any efforts.

ganoushoreilly 5y ago

Given the torrent is labeled "twitch-leaks-part-one" I'm curious too as to what they have. The torrent breaks out into a lot of compressed volumes, so it's clear this wasn't just a backup file, but a curated collection of files. I'm very curious if we will see any other amazon related leaks come from it. Either way, I can only imagine the chaos inside as they try to figure out what has transpired here.