1) The payment-data were just artifacts left on some file-server or from a process, which was accessible from dev-space.

2) No real systems were accessed and everything, it's all from a bad backup-server or poorly managed worker-pool.

3) Multiple Persons got hacked.

4) Exit-Scam of one or more Workers who just had broad enough access for some reason.

5) Twitch's security is just that bad.

Some notable thing is, the payment-data are quite limited, there are no real private data it seems, and the git-history seems also be missing. It's not sure whether this is on purpose and whether more data will follow. But this overall hints so far that this at least was not a full deep hack.

The article says otherwise: "The entirety of Twitch’s source code with commit history “going back to its early beginnings”"

With that, there are tons of specific disciplines you can focus on for pentesting. I'd figure out what excites you and then go for it. Web app is diff than physical exploitation of security systems etc. but some of them cross over.

Another option. Work for the government, join a red team or apply. They'll train you and you'll leave with a new perspective and possibly knowledge you can't get elsewhere.

> if you're not ready to write extensive reports.. it's probably 75% of the job

Do you happen to have a system for building these out? As a techie, I imagine you've tried something like text-expander or similar... but I see a lot of people unsatisfied that they end up building their own tools.

So all in, there are different tools needed for each report. Fortunately the way we capture the data and notes through out the "op" makes it much easier for the team to put together each part.

There's ways we could automate more, we've even messed with AI writing some of the suggestions and actions based on input. So far though, we still need the humans in the loop.

Honestly the first few reports are hardest, after that you find a process and it becomes much easier.

I've seen a lot of professions where in depth reporting still requires humans in the loop, and I think that will always be the case.

There's a small hope I have that one day writing will be a bit more like programming -- as in selecting a 'class' for a structure of a section / paragraph / thesis you want to communicate, which then provides typed functions for potential inputs -> outputs, freeing up human brain cycles for more interesting ideas.

[email protected]

Initially job may not pay good but you can build your network and then probably start doing contract works. Most of the pentesters I know make more from freelance/contract work then their jobs. Because mostly those contract/freelance work pays on hourly bases. The initial hour rates usually are somewhere between 40-50 USD but they can go to 120-150 with just after few jobs.

P.S - I might have made it sound a very simple or easy profession but its not :)

For example. In 2012 average consulting hourly rate I charged $350. Stayed booked. 2016 $550. Stayed booked. In 2018 I had a couple really large clients that paid $1500+hr

There's gold in the hills, the trick is to figure out how to sell the pans, water, plots of land, and transportation to them. If you can work in complementary services or referrals for all the above, you just made yourself even more valuable.

"Feet pics when?!?"

There are devops tools, soc tools, and a ton of random things here, I guess we'll have to sit and wait to see if more follows.

I suspect you just haven’t looked at what the BI team has been up to. This seems like exactly the kind of stuff BI folks always leave on git.

A third reason would be finding a security flaw in the source code and exploiting it.

Nobody is putting production databases in to commit history. At the size of twitch, there's also no way any application dev has access to production.

> credentials like a password for a database is (even more common).

??? What cowboy outfit is putting things which grant access to production customer data in to git?

And no, thats not a clever thing to do, neither is there a good reason to do it. But people do things you do not like and theres little you can do about it.

I would like to live in a world where you were right, but I am not. Sadly.

[Edit] dumps though are another thing. Not seen that, yet.

The site you linked to detects if the referrer url is HN and instead displays only an image saying "HACKER NEWS - A DDoS MADE OF FINANCE-OBSESSED MAN-CHILDREN AND BROGRAMMERS" instead of the content you are trying to link too.

wtf

They say hacked

EDIT Found it again: https://sizeof.cat/post/twitch-leaks/#secrets-exposed

The site you linked to detects if the referrer url is HN and instead displays only an image saying "HACKER NEWS - A DDoS MADE OF FINANCE-OBSESSED MAN-CHILDREN AND BROGRAMMERS" instead of the content you are trying to link too.

OK Then...