Things that are not PogChamp: Twitch has its source code, streamer payout data leaked
(2021/10/06)
- Reference: 1633530433
- News link: https://www.theregister.co.uk/2021/10/06/twitch_data_leak/
- Source link:
Updated Links to torrents that contain 128GB of data seemingly pulled from the Amazon-owned Twitch streaming service have been posted to 4chan.
Without a trace of irony, the anonymous poster described Twitch as "a disgusting toxic cesspool" and linked to the data, which they alleged contains the source code for the Twitch site, other bits of released and unreleased software, and data on payouts made to Twitch creators.
Twitter user @Sinoc229 [1]posted a lengthy thread detailing the content of the files. [2]Elliot Padfield of creator "incubator" Padfield Ventures, who's also had a browse through the files, told The Register : "I believe the leak is legitimate... the codebase appears to be real."
[3]
Padfield was less sure about the earnings, which he reckoned would cause a lot of drama. However, a leak of the source could cost Twitch far more in terms of competitive advantage.
[4]
[5]
Comedian and writer [6]Richard Herring , who has been a creator on Twitch thanks in part to the pandemic-induced closure of live venues, features in the earnings list. He noted that his figure "seems high" before pondering what chunks might be extracted before an actual payment is made. There is also likely the best part of two years' worth of earnings in many of the totals being shared on social media.
[7]Telegraph newspaper bares 10TB of subscriber data and server logs to world+dog
[8]Anonymous: We've leaked disk images stolen from far-right-friendly web host Epik
[9]Emails, chat logs, more leaked online from far-right militia linked to US Capitol riot
[10]Story of the creds-leaking Exchange Autodiscover flaw – the one Microsoft wouldn't fix even after 5 years
A breakdown of the data shared with The Register by Troy Hunt, Microsoft regional director and developer security MVP, showed the payouts that were seemingly leaked went from August 2019 until this month. Hunt pointed out that the torrent was compressed data and so very sizeable. He also warned that it "will take a while to sift through and verify."
For now, it doesn't seem that user passwords, addresses or banking information were spilled, although the posted data does include multiple zip files supposedly detailing "payouts\all-revenues", with others titled "devtools", "chat" and, intriguingly, "kevinbacon".
Herring didn't think the leak, while potentially annoying, would stop him from using Twitch, and he told The Register : "For me it's just a convenient place to try out off-the-wall ideas (and in lockdown to give extra content to people) and the money goes back into making more content via our podcast company."
[11]
Neither Twitch nor parent firm Amazon responded to our multiple requests for comment and neither had made any public statement on any platform about the issue at the time of publication.
It's fair to say its social media orifice, at least, was quick to comment earlier this week.
Facebook down.
Obligatory meme here.
Like button below 👇 — Twitch (@Twitch) [12]October 4, 2021
You can contact the author of this article directly [13]here . ®
Updated to add at 15:32 UTC
Twitch has made a [14]statement : "We can confirm a breach has taken place. Our teams are working with urgency to understand the extent of this. We will update the community as soon as additional information is available. Thank you for bearing with us."
Get our [15]Tech Resources
[1] https://mobile.twitter.com/Sinoc229/status/1445639261974261766
[2] https://twitter.com/ElliotPadfield/status/1445643508409245697
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YV3IUJLfwaBi3zlu4FTjZAAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YV3IUJLfwaBi3zlu4FTjZAAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YV3IUJLfwaBi3zlu4FTjZAAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.justgiving.com/fundraising/Monoball
[7] https://www.theregister.com/2021/10/05/telegraph_newspaper_10tb_data_breach/
[8] https://www.theregister.com/2021/09/30/anonymous_second_epik_dump/
[9] https://www.theregister.com/2021/09/28/in_brief_security/
[10] https://www.theregister.com/2021/09/27/microsoft_exchange_autodiscover/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YV3IUJLfwaBi3zlu4FTjZAAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://twitter.com/Twitch/status/1445097197545029657?ref_src=twsrc%5Etfw
[13] mailto:richard.speed@theregister.com?subject=Twitch
[14] https://twitter.com/Twitch/status/1445770441176469512
[15] https://whitepapers.theregister.com/
Without a trace of irony, the anonymous poster described Twitch as "a disgusting toxic cesspool" and linked to the data, which they alleged contains the source code for the Twitch site, other bits of released and unreleased software, and data on payouts made to Twitch creators.
Twitter user @Sinoc229 [1]posted a lengthy thread detailing the content of the files. [2]Elliot Padfield of creator "incubator" Padfield Ventures, who's also had a browse through the files, told The Register : "I believe the leak is legitimate... the codebase appears to be real."
[3]
Padfield was less sure about the earnings, which he reckoned would cause a lot of drama. However, a leak of the source could cost Twitch far more in terms of competitive advantage.
[4]
[5]
Comedian and writer [6]Richard Herring , who has been a creator on Twitch thanks in part to the pandemic-induced closure of live venues, features in the earnings list. He noted that his figure "seems high" before pondering what chunks might be extracted before an actual payment is made. There is also likely the best part of two years' worth of earnings in many of the totals being shared on social media.
[7]Telegraph newspaper bares 10TB of subscriber data and server logs to world+dog
[8]Anonymous: We've leaked disk images stolen from far-right-friendly web host Epik
[9]Emails, chat logs, more leaked online from far-right militia linked to US Capitol riot
[10]Story of the creds-leaking Exchange Autodiscover flaw – the one Microsoft wouldn't fix even after 5 years
A breakdown of the data shared with The Register by Troy Hunt, Microsoft regional director and developer security MVP, showed the payouts that were seemingly leaked went from August 2019 until this month. Hunt pointed out that the torrent was compressed data and so very sizeable. He also warned that it "will take a while to sift through and verify."
For now, it doesn't seem that user passwords, addresses or banking information were spilled, although the posted data does include multiple zip files supposedly detailing "payouts\all-revenues", with others titled "devtools", "chat" and, intriguingly, "kevinbacon".
Herring didn't think the leak, while potentially annoying, would stop him from using Twitch, and he told The Register : "For me it's just a convenient place to try out off-the-wall ideas (and in lockdown to give extra content to people) and the money goes back into making more content via our podcast company."
[11]
Neither Twitch nor parent firm Amazon responded to our multiple requests for comment and neither had made any public statement on any platform about the issue at the time of publication.
It's fair to say its social media orifice, at least, was quick to comment earlier this week.
Facebook down.
Obligatory meme here.
Like button below 👇 — Twitch (@Twitch) [12]October 4, 2021
You can contact the author of this article directly [13]here . ®
Updated to add at 15:32 UTC
Twitch has made a [14]statement : "We can confirm a breach has taken place. Our teams are working with urgency to understand the extent of this. We will update the community as soon as additional information is available. Thank you for bearing with us."
Get our [15]Tech Resources
[1] https://mobile.twitter.com/Sinoc229/status/1445639261974261766
[2] https://twitter.com/ElliotPadfield/status/1445643508409245697
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YV3IUJLfwaBi3zlu4FTjZAAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YV3IUJLfwaBi3zlu4FTjZAAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YV3IUJLfwaBi3zlu4FTjZAAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.justgiving.com/fundraising/Monoball
[7] https://www.theregister.com/2021/10/05/telegraph_newspaper_10tb_data_breach/
[8] https://www.theregister.com/2021/09/30/anonymous_second_epik_dump/
[9] https://www.theregister.com/2021/09/28/in_brief_security/
[10] https://www.theregister.com/2021/09/27/microsoft_exchange_autodiscover/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YV3IUJLfwaBi3zlu4FTjZAAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://twitter.com/Twitch/status/1445097197545029657?ref_src=twsrc%5Etfw
[13] mailto:richard.speed@theregister.com?subject=Twitch
[14] https://twitter.com/Twitch/status/1445770441176469512
[15] https://whitepapers.theregister.com/
House of cards...
Barry Rueger
Facebook. Twitch. The entire internet is a house of cards. Sooner or later. Someone will tug out the Jack of diamonds at the bottom and the entire thing will come crashing down.
Waiting...
I await the inevitable statement with the line "Security is our number one priority" which will be a lie. No-one who gets hacked for 128GB of data takes security as their number one priority, no-one does. Their priority is always profit. Security, customer service etc are all secondary requirements to be trusted enough for people to give you their money.