165: Tanya

Tanya Janca is a globally recognized AppSec (application security) expert and founder of We Hack Purple. In this episode, she shares wild stories from the front lines of cybersecurity. She shares stories of when she was a penetration tester to an incident responder. You can sign up for her newsletter at https://newsletter.shehackspurple.ca/ SponsorsSupport for this show comes from ThreatLocker® https://www.threatlocker.com/. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com https://www.threatlocker.com/. This episode is sponsored by Hims https://hims.com/darknet. Hims offers access to ED treatment options ranging from trusted generics that cost up to 95% less than brand names to Hard Mints, if prescribed. To get simple, online access to personalized, affordable care for ED, Hair Loss, Weight Loss, and more, visit https://hims.com/darknet. Support for this show comes from Drata https://drata.com/darknetdiaries. Drata is the trust management platform that uses AI-driven automation to modernize governance, risk, and compliance, helping thousands of businesses stay audit-ready and scale securely. Learn more at drata.com/darknetdiaries https://drata.com/darknetdiaries. View all active sponsors. https://darknetdiaries.com/sponsors/ Books Alice and Bob Learn Secure Coding by Tanya Janca https://amzn.to/4qFzZqc Alice and Bob Learn Application Security by Tanya Janca https://amzn.to/4qC3M30

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Jack Rhysider?

  Hey, this is Jack, host of the show. For a while, I worked at a big company doing security engineering. And every year, someone would come in and do an audit on us. And they would ask us the same question. Do you have a security policy? Yes, of course we do. Is it available for all of your employees to find? Yep, it's right there on SharePoint. But this got me thinking. Yeah, sure, it was right there in SharePoint. But it was called something ridiculous, like ISP underscore overview, or something like that. And ISP stood for Information Security Policy. And it made me wonder, if this document was so important that we would be audited to check to see if we had it and make sure all our employees had access to it,

• 0:43Jack Rhysider?

  could any of them actually find it if they needed it? Like, this policy said stuff like, what are our security objectives? Who are the people that we escalate things to? What's acceptable in our network and not? Who should be able to access what? As well as what we should do when there's an incident? How often are security training should be? And what are security standards are? So one day, when I was feeling feisty, I decided to do something to make a point. I asked everyone on shift in our network operations center, "Hey, you have 15 minutes to find the company's security policy. Winner gets a free item in the vending machine. Go." And everyone started looking. First, they typed "security policy" in our department's portal. And that actually brought up security policies for some of our customers, which I thought was really cool

• 1:27Jack Rhysider?

  that our customers were taking their security policy so seriously that they wanted to make sure that their partners had the copies of it. But that wasn't our policy. Then people started looking through their emails. Nope, nothing in our email about security policy. Then they looked at shared drives. They couldn't find anything there. And eventually, a few of them thought to look through SharePoint. And of course, not a single one of them could find it because it had the worst name and it was in the worst place. I don't know if you've ever used SharePoint, but it's a place to store documentation and files. And it's an awful mess to navigate and find stuff. None of their searches came close to finding it. And so I just said, "All right, everyone, time's up. Thanks for trying." And then I sent an email to our CISO, our Chief Information Security Officer.

• 2:11Jack Rhysider?

  "Security policy test, Q1. 10 out of 10 of our NOC technicians could not find our company's security policy after spending 15 minutes trying." And he responded, um, "Sounds like your NOC technicians have a hard time finding things." I waited another four months. We got a whole new batch of technicians and I tried again. One guy actually found it. I was really impressed. I also retested all the people that I tested four months ago. One in five remember where I told them it was. So I sent another email. "Nine out of 10 of our new hires could not find our security policy. Four out of five of our senior technicians could not find it." He was like, "Why do you keep telling me this? Just show them where it is." I wanted him to understand, the problem wasn't my technicians.

• 2:55Jack Rhysider?

  It was that the security policy was buried way too deep. It was named poorly and nobody knew where it was. Nobody could find it if they tried, which meant nobody knew what was in it. In my opinion, when there's a document that's so important that auditors ask if you have it and if it's available for employees to find, then it should be way more front and center. Heck, I even suggested that we should print out a summary of it and tape it above the urinals and sinks in the bathroom. So that everyone sees it every time they go to the bathroom. That way, the whole company would be familiar with our security policy and know exactly what to do when there's an incident and what's allowed and not allowed. But of course, our security leadership didn't see it that way.

• 3:35Jack Rhysider?

  And never did change the name of it or the location. And we kept passing our audits somehow. Yet, nobody in the company ever read it or knew where it was. Ah, the politics of office life and compliance.

• 3:56Jack Rhysider?

  These are true stories from the dark side of the internet.

• 4:03Jack Rhysider?

  I'm Jack Reisider. This is Darknet Diaries.

• 4:24Jack Rhysider?

  This episode is sponsored by ShipStation. During Black Friday and Cyber Monday, things can get a bit hectic. Millions of people scrambling to find the lowest price online and then all clicking "Buy" multiple times within a 72-hour period. Now, retailers all over have to somehow ship those orders out on time, and that seems like a whole new level of hectic, one that ShipStation is built to help businesses manage. ShipStation is an end-to-end order fulfillment platform, built to handle the order surge of peak season and bring all your orders into one place so your team isn't scrambling when volume swipes. Over 1 million businesses have learned on ShipStation to get through peak season, scaling fulfillment up to 40x while cutting costs up to 30%. If I needed to ship a lot of stuff, I would definitely be using ShipStation.

• 5:09Jack Rhysider?

  Peak season doesn't wait, and neither should you. Get ahead of it today with ShipStation. Get 60 days free at shipstation.com and use code DARKNET. That's shipstation.com code DARKNET. Taxes and fees apply.

• 5:29Jack Rhysider?

  This episode is sponsored by DeleteMe. Have you ever thought, "I should really be doing something to protect myself from stalkers, scammers, and hackers"? But you're not sure what? Here's what you do. Go to joindelete.me/darknetdiaries and enter code DD20 and you'll get 20% off DeleteMe. A few years ago, I signed up, and ever since then, DeleteMe has been busy scouring the internet for my name and giving me reports on what they found and deleted stuff. Take control of your data and keep your private life private by signing up for DeleteMe now at a special discount just for my listeners. Get 20% off your DeleteMe plan when you go to www.joindelete.me/darknetdiaries and use promo code DD20 at checkout. The only way to get 20% off

• 6:14Jack Rhysider?

  is to go to www joiningdelete.me/darknetdiaries and enter code DD20 at checkout. That's www joiningdelete.me/darknetdiaries code DD20.

• 6:31Jack Rhysider?

  Today I have the pleasure of sitting down and hearing stories from Tanya Jenka.

• 6:34Speaker 01

  Thank you for having me.

• 6:36Jack Rhysider?

  I've been going to a lot of conferences and time and time again, I see Tanya at almost all of them. But not only is she there, but she's almost always giving talks when she's there. She's on a mission and is very driven.

• 6:47Speaker 01

  I hope software developers write more secure code.

• 6:51Jack Rhysider?

  Boiled down to a word, that's called AppSec, application security. She's laser focused on how applications become insecure and how to make them secure.

• 7:01Speaker 01

  I was a software developer forever and then someone exploited one of my apps and showed me and it created this fascination. It was an SQL injection and it was on the login screen of one of my team's apps and I was in charge of the team. And so if it's not secure, it's my fault. And I remember he was giving a demonstration to us and he showed me, he's like, "This is one of your apps. I'm gonna get past this login screen without a password and the only reason it's gonna take so long is because I'm talking and it's gonna be a minute."

• 7:36Jack Rhysider?

  He demonstrated how he can easily get past her login screen, showed her how it's done and she was stunned.

• 7:43Speaker 01

  Oh my God.

• 7:46Jack Rhysider?

  This was the moment that she saw the whole world differently. Just because there's a right way to use a website by putting in a username where it says username and a password where it says password, doesn't mean people actually play by those rules and follow the website's logic. If you're clever enough to think outside the box, you can manipulate the website to do things that the developer didn't intend.

• 8:08Speaker 01

  And we ended up becoming very close friends and he became my first professional mentor for hacking.

• 8:15Jack Rhysider?

  This was a career pivot. Instead of building things, she wanted to know how to break things. And all this is happening in Canada, by the way. Tanya was living and working in the capital city of Ottawa. So her new mentor was like, "Okay, so you wanna be a hacker? I've got some work for you. You can help me do some penetration tests." And she's like, "Okay, but I'm not exactly sure how."

• 8:35Speaker 01

  And so he told me on the Friday, "Okay, so go learn Burp Suite this weekend. There's videos on YouTube, just go watch them, it's not hard."

• 8:45Jack Rhysider?

  So she starts watching them. Burp Suite is a tool used to monitor the packets that go between your computer and an application or a network or a website. So you can redirect all your computer's traffic to it, and then Burp Suite will show you. Hey, you went to this website, and it responded with this code, and then your computer sent this information back, and then this website sent back a cookie, which has this data in it. It's kind of like getting under the hood of a car, but for network traffic. And Burp Suite is really cool. You can capture that data and replay it if you want. Like, maybe you look in the cookie that a website sent you, and it says that your user ID is 5,000. And so what if you change that user ID to 5,001, and then reconnect to the site and present this cookie, which has a different user ID?

• 9:29Jack Rhysider?

  Will it think that you are a different user? It's kind of like a way to do surgery on the packets that your computer is sending to an application or website. And it's possible to manipulate your packets enough to make the site do some very strange things. So she comes back in on Monday with the basics of Burp Suite understood. And he tells her, okay, great. Spend a few hours a day trying to hack this website, and tell me what you find. And he says,

• 9:55Speaker 01

  I'm gonna be observing you silently while you're working, and I just need you to report anything that you find. And I was like, great. And so the first night, I just found really tiny things. The second night, I found really tiny things. And the third night, he kind of gave me a lecture, and he's like, listen, Tanya, you've got to find something. You can't do a pen test and not find something big. I need you to really think outside the box. Take off your developer hat, put on your black hat. And so I just tried everything I could think of, and I found service-side request forgery. Now, I didn't understand service-side request.

• 10:27Jack Rhysider?

  How'd you find it?

• 10:29Speaker 01

  Basically, there was an email field, and I just started entering in code. And I entered in an email, but then after, I just put in everything I could think of, like all sorts of code, all sorts of stuff. And inadvertently, I started copying and deleting files on the web server. Yeah. And I ended up crashing the production web server. And it turned out I had polluted the database as well. They had to restore both from backup. And so I called my boss and like, I found something and I have crashed everything. And he's like, what? This is production. You can't crash production. And I'm like, well, I found an exploit. And you told me to like, to prove that I had exploited it. So like, here's, you know, I took the whole thing down.

• 11:12Speaker 01

  And he's just, he yelled at me and was really angry. And then he's like, how did you do it? I'm like, these are all the commands I did. And he's like, well, this is garbage. This shouldn't do anything. And I'm like, well, I guess it did, right? I was like, well, weren't you watching me the whole time? And he's like, no, that's just something I said to make you feel better. And I was like, well, like, what is the client gonna say? And he's like, I'm like, I could talk to them. He's like, no, they don't know that you're testing. I'm like, but you said I'm a subcontractor, right? Like, so like, the contract I signed with him that I was subcontracting that they knew, they had no idea I was on their network. So he had given me the keys to production to some random client. They had no idea I was on there. I destroy everything. And he's like, great, now I'm gonna get yelled at tomorrow and it's all your fault. I'm like, really? This is all?

• 11:58Speaker 01

  She was really pissed at me.

• 12:01Jack Rhysider?

  I think they both learned a lesson that day. But Tanya was hooked more than before to copy and delete files on a web server, all by putting in some code through a form field? Wow, such power. But wow, such weakness. These apps she was seeing are surprisingly weak. And she was drawn to that. What are other tricks and techniques for making an app give you data that it's not supposed to do? Or do things it shouldn't let you do? She got more and more into security, wanting to get more hands on with everything related to it.

• 12:33Speaker 01

  And I kept annoying the security team constantly. I would report security incidents. I would fix all the security bugs. I kept asking if I could use security tools. I volunteered to work on their projects. And one day, they said that I could sit in on an incident and just watch and shut up. And literally, I did not have a seat at the table. They had only so many seats that would actually fit at the table. So I was actually against the wall at the back of the room, just being, zipping in, being quiet like they told me to. And then I remember them putting all this stuff on the screen. And looking at it and being like, oh, that's SQL. Oh, that's pretty bad.

• 13:15Speaker 01

  And so I said to them, like, I'm seeing code here. We need to look at this. Can we, can we talk? And they're like, you can read that. And like, just because someone's trying to SQL and inject you doesn't mean they're successful, right? But I'm like, someone's attacking us. And every organization's getting attacked all day, all the time. But the fact that I could sit there and read code, they were like, oh, she's an asset. And then a few weeks later, they said, oh, we've opened a job on the security team. And I was like, oh, my gosh, I'm going to apply. They're like, obviously it's for you, silly. And so they let me transfer onto the team. And I was just, I was so excited to be a part of their team.

• 13:58Jack Rhysider?

  With this new position, she proved herself again and again and rose up the ladder, eventually landing in a security leadership position at an organization, which was within the Canadian government. She was in charge of making sure that agency and all its apps were secure. And one day she came to work and had an email waiting for her.

• 14:18Speaker 01

  I receive an email from Vice Magazine and it says, Dear Tanya, we know you work, you know, at this place and that you're the leader of this team. We would like a quote for you for our magazine about how your data is for sale on the dark web and how you feel about that your data is worth only 48 Canadian dollars. And here's a link if you want to see more. And it's a link to Paste Bin. And on it, it says, you know, here's a sample of the data from the name of my organization. And like, to get more, go here. And then I go there and they're auctioning my data for the Bitcoin equivalent of approximately 48 Canadian dollars, which is

• 15:03Speaker 01

  Not a lot of money.

• 15:05Jack Rhysider?

  What a way to be notified that your agency has suffered a data breach by getting an email asking you for a quote on how you feel about your data being for sale.

• 15:14Speaker 01

  So I talked to my team, I'm like, ah! And, and all of us are just flabbergasted. We're like, first of all, what is this data? Is this actually our data? And so we're looking through all of our apps. And this is when I realized my app inventory was not complete. We were missing lots and lots of apps that I did not know about, that I'm supposed to be securing.

• 15:34Jack Rhysider?

  Step one of a data breach like this is to verify that it's your data. Find out which app or database it's from, and this will help you identify maybe which app is vulnerable. But it took them a while to figure out even where this data was in their network. Eventually, they narrow it down and figure out which app this must have come from.

• 15:52Speaker 01

  And so I go, I find it, that data is in there. The paste bin sample does look a little familiar. And I'm like, oh no. So I go and I talk to my boss, and my boss was so pissed. He was, he was like, have you ever had someone say your name in a way where it sounds like a swear word? There's like, Tanya! And I am not really good when people are upset with me. And so I was like, well, sir, I, you know, our data's for sale on the dark web, that's true. But I think the bigger problem is that it's only $48. Don't you feel we're worth more than that? And he was not impressed. Somehow, my name was at like a higher pitch the next time he said it. And he's like, you are gonna go fix this now!

• 16:38Jack Rhysider?

  Yikes, there's a leak. Data from the Canadian government is getting leaked. And Tanya is head of security for this department that it got leaked out of. This is really bad. She pinpointed the application, though, and got the owners of that application together.

• 16:51Speaker 01

  And I sat down with the team, and they're like, we have no idea what you're talking about. And I showed them, and they said, yep, that's our data. And I said, okay. And one of my team members said, I think we should buy the data to make sure it's an exact match. And it's not like, because they're just showing two or three records on Paste Bin, they weren't showing all of it. And I was like, well... I don't want to give them money because I feel like that's encouraging them. And it feels pretty obvious that like if they got three records, why couldn't they get more records? And so then we look at the data and it's completely unclassified. It was actually data, it turns out, that we have been trying to promote to the Canadian public for quite a while and had been being mostly ignored.

• 17:36Speaker 01

  Like, some journalists would look at it for like a media piece or something, but generally, like, no one was paying attention to a thing we were hoping that they would. So we're like, maybe this will help. My boss also did not find that funny.

• 17:48Jack Rhysider?

  Okay, this wasn't as bad as it seemed. A lot of data within government is, in fact, unclassified and publicly available. And it seemed like the hacker stole some publicly available data and nothing sensitive was actually taken or sold. But what do you do here? If a hacker stole data that's publicly available, is it actually stealing? Is there any action even do here? Like, what's the big deal? Right?

• 18:09Speaker 01

  Yes, this data was public in general, but they had the record ID number, and that's not public. Right? So they, someone clearly got a copy of our full dataset as opposed to just what we wanted to show the public. And every single record except the ID identifier that we used to look it up was considered unclassified, so none of it was sensitive in nature.

• 18:34Jack Rhysider?

  Hmm, I see. Every line of the database has a unique ID, which aren't important or even sensitive information. However, it's not public information. It's only used for how the database sees the data. So whoever got this had full readable access to their database. So it was time to drudge through the logs to try to find out what happened.

• 18:58Speaker 01

  We had only database logs. We had no web app logs. The app itself did not log at all. It was really old. And so we looked through all the database logs and very quickly I figured out what the attacker was doing was one. Attacking us on every single statutory holiday. So we in the government would get paid a time and a half if we work overtime. But if you work a statutory holiday, you get two and a half times your regular pay. And it's policy that unless it's an emergency, you are never booked for on-call or anything like that on those days. So we would never work those days. And so this person, for a year, every single statutory holiday,

• 19:41Speaker 01

  would start hacking us basically at midnight all the way until the next day. And so I started looking through the logs. Well, basically, first I looked at the most recent logs. And then I was like, have I ever seen these commands before?

• 19:56Jack Rhysider?

  She did recognize what was happening, at least kind of. She recognized that the commands in the database were trying to do SQL injection. SQL is the type of database used. And injection is where you try to put your own database commands in through the web form field. So like when you go to login on a website, you put your username and password in, right? Well, the website will grab that information and then go check the SQL database to see if your username exists, which an SQL statement might look like. Select from table where user equals Jack. Like if that's my username, right? And since Jack is what the user typed in, then that's actually what gets queried in the database. But what an SQL injection does is it messes with that.

• 20:39Jack Rhysider?

  Since you're going to take whatever username I type in and search the database for that, what if I type in the username Jack, but then also write something else like Jack or select from table all the passwords? So now if it's vulnerable to this, it'll take that input and go do this database command. Select from table where user equals Jack or select from table all passwords. And if it's vulnerable, it might return all the passwords that you asked for. You see how adding extra commands into a form field can trick it to return extra stuff the developers didn't want you to do? To fix this, developers of the apps need to sanitize their apps, not let users put in extra stuff like that, and really restrict what's allowed to be typed in those form fields.

• 21:24Jack Rhysider?

  So Tanya recognized this was SQL injection by looking at the database logs, but it didn't quite make sense. It wasn't your classic SQL injection.

• 21:32Speaker 01

  But this one was doing trues and falses, and I was very confused. So they're looking for this person, and they're always true. And then it would say. And instead of or, which I was not used to. And I'd say, and, you know, the name of this table, the first letter is A. And I was like, what? And why do you need and? I'm very confused here. And so we, I started running them and almost all of them were false. It would just return an error. There is no one named Jack. And I was like, but there is a person named Jack. And I'm like, but that's because they did the and you have to both of them be true. Like, this is so weird. So I kept going through and finally one was true. And I'm like, well, what the heck is this?

• 22:16Speaker 01

  And I look and it's a letter from one of the names of the fields of that table. And I'm confused. I'm like, why? Why would you look up an A? Like, it was like, is this A? Is this B? Is this C? And I was super confused.

• 22:35Jack Rhysider?

  Well, they fixed that app so that it wasn't vulnerable to SQL injection anymore. But they were still perplexed on how those commands worked, how they got data with those commands.

• 22:44Speaker 01

  We spent two or three months looking at it. And no matter what we did, we couldn't figure out how they got the data. There were just errors or returning this one record.

• 22:52Jack Rhysider?

  She never did figure it out. She ended up leaving that organization, still not understanding how that data got out with those commands.

• 22:59Speaker 01

  And so then I went to DEF CON and I did a workshop called Blind SQL Injection. And I was super excited to finally make it into a workshop because I don't know if you know, Jack, but there are long lines and there's a lot of competition to get those seats. And I made it. And so here I am at the back of the class and the teacher is explaining, oh, well, what you're doing when you do Blind SQL Injection is you are asking questions. And the questions you are asking is either like the names of fields in the database, the names of tables, what's inside a field. So it's like, oh, this record exists? Great. You know, like, is there a field called this?

• 23:44Speaker 01

  No, is there a field called that? Oh, there is? Is the first letter? Because you can't say return that record. It won't do it with Blind SQL Injection.

• 23:53Jack Rhysider?

  So the only option you get back is yes or no. So you can ask the database any question, but they're not going to give you data. They're just going to tell you yes or no.

• 24:01Speaker 01

  Exactly. And so if it's an error, it's a no. And if you receive the record that you have searched for every time, it's true. And so.

• 24:10Speaker 01

  I went to this workshop and it's like this giant light bulb went up for me and I was like, oh my gosh. And so I call my old boss and I'm like, I know what happened. And he's like, have you been poking around since you left? I'm like, no, I went and I took a workshop and I learned and I know exactly what happened. And so I went back and we had a meeting in our special secret room. And that wasn't very secret. Anyway, and we had a meeting and I and it's funny because I walked them through the logic of this is how you ask the database questions. And this is how you can know for sure that it's true. So I explained this. And then all of them, except the really, really big boss, the really, really big boss was like, I still don't get it. But everyone else is nodding. So that's fine. So they

• 24:52Speaker 01

  did exfiltrate our data. And that is what happened. And, okay, so now we know.

• 24:58Jack Rhysider?

  We're gonna take a short ad break here, but stay with us because Tanya is gonna tell us more stories about the fires that she's extinguished.

• 25:07Jack Rhysider?

  This episode is sponsored by Vanta. As AI adoption grows, so do your company's security risks and requirements. New frameworks, audits, and vendors keep piling on, but your team isn't getting any bigger. Most compliance tools promise automation, but you're really stuck doing all the work by hand, chasing screenshots, validating controls, and playing catch up when audit season is coming around the corner again. Vanta works differently. Their Agentic Trust platform is built to scale with you, not slow you down. With over 1,400 automated tests across 400-plus integrations, Vanta collects evidence and monitors your controls year round, cutting your audit prep by 82%. Plus, you can access the Vanta agent

• 25:49Jack Rhysider?

  everywhere you work, whether your team is in Vanta every day or living in tools like Claude or Cursor. Want proof? Over 16,000 fast-growing companies like Ramp, Writer, and Harvey save time and resources while scaling fast with Vanta. Learn more at vanta.com/darknet. That's spelled V-A-N-T-A. vanta.com/darknet.

• 26:15Jack Rhysider?

  Tanya had a lot of roles in different companies and organizations over time. And at one point, she was leader of incident responders. You know, if there's a severe security problem in the network, it would be her and her team that would manage the problem. She would identify the problem, engage with the right people, and get working on it and tell leadership what's happening. And then stay on the incident in order to make sure it gets the resources it needs to get resolved.

• 26:37Speaker 01

  And so I was the lead of the incident responders. So we had like a guy that did malware analysis, you know, all of those things. And so I was the AppSec expert, as not surprising, right? And so I would always do the software incidents. I came into work late one day because I had a dentist appointment. And I had told my boss, I told my team where I was. It was in my calendar, anyone could see. And I come in at maybe 10 a.m. And basically, there were two of us that managed incidents, me and this amazing person named Eric. And I come in and all my team's sitting there, including the Eric that is the incident manager. And I'm like, hey, guys, what's up? And they all look really tense. And they're like, there's a really big incident. And everyone's in the really big boardroom.

• 27:21Speaker 01

  And I'm like, but Eric's sitting there and I'm standing here. So who's managing the incident? And they're like, some guy named Dan from Helpdesk. And I've changed Dan's name because that is what you do. And I was like, what? And they're like, yeah, they wouldn't let us in the room. And I was like, what is happening? They're like, we need you to go in there. They won't listen to us.

• 27:51Speaker 01

  So I go in and I open the door and they're like, Tanya, where have you been? I'm like, at the dentist, no cavities. And no one thought that was funny. And they're like, we needed you and you weren't there. Like, everyone stared at me. And I'm looking and there is the director of every department, a bunch of managers, and all of the executives from our organization in this room. So this is an extremely expensive meeting. Everyone looks really stressed and upset. And there's, so this was a while ago. So there's like that big, huge thing in the middle of the table that was the phone with the giant buttons.

• 28:31Jack Rhysider?

  A UFO.

• 28:32Speaker 01

  And it sounds terrible. And yeah, it's one of those. And there's this guy on the phone named Dan from Helpdesk. And They're like, "We're having this huge incident and you weren't here and we needed you, but Dan's helping us, so we don't need you and you can go." And I'm like, "I'm not going anywhere. Like, I'm the head of incident response. I'm the incident manager that is on duty now and I'm doing the thing." I'm like, "I've got this, Dan." And he's like, "Oh, no, I have it. I'm handling it."

• 28:59Jack Rhysider?

  She's like, "Who the heck is this Dan guy?" Dan was from Help Desk, which is often the front line for office workers when they have problems, right? If your computer stops working, or the internet is out, or you're locked out of your computer, or your password doesn't work, who are you gonna call? Help Desk. And that's where Dan was working. And he was answering a lot of phone calls that day. He just kept getting call after call from that office. People were saying, "Nothing is working, managers are in a panic, they can't do their work." People were getting so upset in that office.

• 29:26Speaker 01

  And I found out later, we had people go home because they'd had, like, at least one panic attack. Just several people were just too nervous and upset that they actually went home for the day because they just felt very uncomfortable and unsafe.

• 29:40Jack Rhysider?

  And just call after call was coming into the Help Desk. And Dan was answering these calls, and he was doing his best to solve the issues.

• 29:46Speaker 01

  I'm like, "Okay, so what is happening?" So I'm standing there in HQ, our headquarters office. We have a satellite office that's maybe 20 kilometers away. And I am informed that our satellite office is infected with malware. And I said, "Oh, someone has malware. No worry, we'll go mop it up. We'll be right there." And they're like, "No, no, the building has malware." And I'm like, "The building's dumb. It can't have malware." And I laugh. And then someone says, "Don't call them dumb, they're nice." "No, no, the people aren't dumb, the building's dumb." And they're like, "Don't call them dumb." "Okay, the building's not smart." And that didn't go well either. I'm like, "So a smart refrigerator is internet-connected?

• 30:29Speaker 01

  It's not internet-connected, it's cement. Cement does not get malware." And they're like, "Dan knows and you don't. You weren't even here. You were busy at the dentist." I got so much flack about the dentist, you would not believe. But anyway, so everyone's very upset. I try to calm them down. I'm like, listen, my team will look into this. And Dan's like, we should evacuate. They're in danger. He's like ramping them up so they are panicking. I'm like, Dan, that's not true. Everything's fine. Let my team look at this. And finally, I get everyone, I wouldn't say settled. I would say that they were less panicky. I'm like, everyone, go back to your desk. I am going to update you in half an hour. I am going to find out what is happening. Everything's going to be OK.

• 31:12Speaker 01

  And they're like, someone needs to go to the dentist instead of helping us. But I'm like, literally, people were so upset with me. They're furious. So I dismiss everyone. I hang up on Dan. Dan's not helping. And he said over and over again, the building has malware. We should evacuate. And I was like, no one's evacuating. And so I go back to my desk and I'm like, someone flip on Wireshark.

• 31:35Speaker 01

  He's claiming the entire building has malware. We all know that's not true. They all respond, but the building's dumb. I'm like, I know. I know, guys. We all know. Dan has whipped everyone into a frenzy. We need to do something about this now. So we flip it on. And so there are some stereotypes about Canadians. And some of them are true. Like, they take our passport if we're rude. We all eat poutine. There's many, many stereotypes. And one of the stereotypes is that we love the Winter Olympics. We love watching hockey. We love watching the figure skating. As an entire nation, like, we tune in. We really like it. And so when we turned on Wireshark,

• 32:20Speaker 01

  we immediately saw every single person in the entire building was going to the exact same site. And the figure skating for the Olympics was on and Canada was skating.

• 32:32Jack Rhysider?

  So there is no malware. The reason why nothing was working is if everyone is live streaming the Olympics, that takes up a ton of bandwidth. So the work that those office workers were supposed to be doing, they couldn't do it because the network was basically clogged up, bogged down. They essentially did a DDoS attack on themselves. And the funny thing was, they had a policy in place that should prevent... Prevent things like this from happening.

• 32:56Speaker 01

  We have a policy in the government, or we did at the time, where when the Olympics happened, we knew Canadians are gonna Canadian. And so we would make a boardroom in one building, and that was where the Olympics are showing. And so if you need to go see your guy win his thing, you go and you watch the skating and the twirling and whatever it is you're gonna do. And no one's allowed to stream it because if every single person is streaming, there's no internet. So we blocked that and make many Canadians cry. And we found out later that some executive had decided, oh, you're gonna take a vacation day if you wanna watch the Olympics. Like, you're here to work, blah, blah, blah. And had gone against policy, thinking they were super smart.

• 33:40Speaker 01

  And this is what had happened, right? And so I call a meeting on the next hour. And I'm already sending emails, explaining to everyone, there is no malware, there was never any malware, everything's fine. So I call everyone into the room, I'm like, hi, everyone. Everything's fine. Everything's cleaned up, there is no problem. There was no malware. They're like, but when are we gonna clean up the malware? I'm like, there never was any. Everyone was just watching the Olympics. The internet slowed down. Everything is fine. It was actually always safe. We do not need to panic. I need you to all go calm your staff, especially the satellite building staff. Tell everyone, everything's fine, they were always fine.

• 34:21Speaker 01

  We just were too busy streaming and not busy enough working. And everyone seemed not super satisfied with that answer, but enough, right? And so everyone left. But going forward, people talked about how that building had had malware for six months. Like, I couldn't squash the rumor. It didn't matter how many times I corrected people. They're like, yeah, she doesn't believe it, she doesn't know. I'm like, I'm the incident manager.

• 34:51Jack Rhysider?

  So after it was all fixed and resolved, it was time to pay a visit to the help desk to help them identify and handle incidents better.

• 35:00Speaker 01

  So Help Desk wants to help, right? Like, people that are really good at Help Desk, they love literally helping and solving problems. And so they are the first line of everything, right? Like, you call Help Desk. First of all, you fiddle around yourself. You try to fix it, and if not, you go to them. I go to them, right? If I can't fix it myself, which it happens. And so this person received this call, and they're like, I know what I'll do. I will solve this problem for them. Because that person, because I know, because I was working at that org, had never had any training about what a security incident looks like. And so what my team did to solve this problem going forward is we had Help Desk in, and we gave them a training on what security incidents look like.

• 35:45Speaker 01

  And we told them, we will never, ever, ever get angry if you call us and it's a false alarm. I'd rather 20 false alarms than one where you didn't call and we made a mess.

• 35:56Jack Rhysider?

  So her and one of our incident managers named Eric gave some training to them. And Eric had a doozy of a story himself to share with the Help Desk team. So Eric's last job, he was an incident handler. If there was a security incident, it would go across his desk. And one day, someone from the IT Help Desk discovered a problem. They were given a computer to fix something on. And when they were looking through the computer for problems, the Help Desk technician discovered sexually explicit images of children.

• 36:28Speaker 01

  And he understandably was extraordinarily upset.

• 36:33Jack Rhysider?

  Yeah, I mean, of course. Seeing images like that, you can't unsee it. It feels like you did something wrong just by taking a look. Well, this IT Help Desk technician was like, well, that's wrong. Employees shouldn't have this on their computer.

• 36:46Speaker 01

  And he deleted the images, and then he was still upset, and he formatted the drive.

• 36:52Jack Rhysider?

  Which actually makes sense. When people who work in IT help desk see problems, it's usually on them to fix it. Virus on computer? Clean it off. Apps installed that are against company policy? Delete them. Apps missing which should be there? Install them. Software out of date? Update it. Help desk people are action oriented. They take control and fix things. All day, every day, they're fixing things. So for him to delete these photos, seemed like the right thing for him to do.

• 37:17Speaker 01

  So he calls incident response.

• 37:20Jack Rhysider?

  He's like, "Man, I was just fixing a problem on some employee's computer, and I found sexually explicit images of children. And this feels like something I should report to you." And Eric, the incident response manager is like, "Okay, wow, um, thanks for telling me. How bad is it?" "Real bad." "Okay, well, let's be careful here. Can you show me what you found?"

• 37:40Speaker 01

  Essentially, what happened is the entire chain of custody, the evidence, was ruined.

• 37:46Jack Rhysider?

  Because the help desk technician deleted all the evidence and didn't take any screenshots? I mean, how could you take screenshots? And then he reformatted the hard drive? There was zero proof that what he saw was actually there. So there was nothing for the incident manager to evaluate. But they did report it to HR.

• 38:05Speaker 01

  And they were able to fire that person for violating the acceptable use policy of the computer.

• 38:12Jack Rhysider?

  But HR was like, "Hold on. This is actually more than an acceptable use violation. This is illegal. We should report them to the police." And so they did. But then the police are like, "Okay, show us the evidence." And they had nothing to provide. There were traces of backups and archives that they could have dug into, but it didn't matter because the chain of custody was broken. So they had nothing admissible to give.

• 38:37Speaker 01

  So they're unable to prosecute that person.

• 38:40Jack Rhysider?

  Man, what a blunder by help desk there, huh?

• 38:43Speaker 01

  The poor help desk guy. He feels incredible guilt. And the person from help desk ended up in therapy for a long time.

• 38:52Jack Rhysider?

  Why?

• 38:53Speaker 01

  Well, probably for two reasons. So one is he felt incredible guilt because he did not know better. So he did what help desk does, which is usually erase, reformat, reimage. And so he did what his training told him to do, right? But meanwhile, he saw things he can't unsee. And he also... Unintentionally let a very bad criminal go free. And so when I give training on the topic and I talk to help desk, I'm like, I know you want to help. I know you want to help. That's why you're so good at what you do. But if you see anything that you think looks criminal, you need to call us right away.

• 39:35Speaker 01

  If you see anything where you're like, this just makes absolutely no sense, I need you to call us right away. Like if all your normal steps to fix something don't work, please call us and we will come in because we have different tools than you have. So we started this annual training that me and Eric would give where it was just like, these are the things that we need you to know. And the training would just be like 20 minutes. And it was just very basic, like if you see this, call us. We will never, ever be angry.

• 40:07Jack Rhysider?

  Now, Tanya has been to a lot of conferences. It's a great way to learn and meet amazing people. But one really cool thing you often see at conferences are CTFs, which stands for capture the flag. It's a game where you can form teams and then try to hack into something. Like there's a computer that's intentionally vulnerable. And if you can hack into it, you'll see a flag. And if you can get that flag, you'll get points. And the team with the most points wins the CTF challenge.

• 40:31Speaker 01

  I did do a few CTFs. I went to a bunch the first year, year and a half when I was trying to become a pen tester because I heard they're a great way to learn and I did learn lots of things. And I also learned that I was always the only female everywhere I went. Everywhere, I'm the only woman and I was a little tired of that. So I put a note on LinkedIn and said, hey, do any women want to form a CTF team with me? Because I don't want to be the only woman everywhere I go.

• 40:59Jack Rhysider?

  Where was this going to be?

• 41:01Speaker 01

  It was going to be in Ottawa. And I formed, I ended up having so many women say, yes, we had to form two teams, which was really exciting. I was pretty surprised and all of them said the same thing. Like I was curious to go, but I felt like I didn't know enough and I'm always the only woman and it's weird. And so a bunch of us wore party dresses, which was really fun. And so I was showing them. Okay, so here's this login screen and we're supposed to try to get past the login screen. And I'm like, I know how to do this. I'm sure there's going to be some sort of SQL injection opportunity. And so I was walking them through it, the way that my mentor had walked me through it, and I showed it to them and then we got in.

• 41:41Jack Rhysider?

  Tanya was able to use SQL injection to bypass login screen. Basically, when you type in the username and password, the website sends the data to the database. And if they are a match, the database returns true. If they aren't, it returns false. Well, she put in the username field, something that will always return as true. Like, is there a username Tanya? Or does one equal one? And because there's an or statement there, and one equals one is true, the database returns true, no matter what the username is. So since the database returned true, she logged in without providing a valid password. Her teammates were amazed at how she did it and asked her to explain.

• 42:20Speaker 01

  Yep. And then two of us got up and did happy dances. And a third one got up and she's like, hi, I have to go. And we're like, where are you going? And she's like, I have to go to work right now, because I am not sure that we are safe from this. And I need to go test every app I've ever built and make sure that it is okay. And I have to go right now. And she literally went to work and spent, apparently she was there quite late, because she came to the CTF quite bleary eyed the next morning. And I was like, oh, how'd it go? And she's like, we're fine now. And I'm like, now? And she said she had fixed a whole bunch of things. And she's like, what's the next thing I'm going to learn to fix? Let's do this.

• 43:02Jack Rhysider?

  So in the middle of CTF, she learned she was vulnerable and ran out of there.

• 43:07Speaker 01

  I think she suspected. I don't know if she knew for sure, but she's like, I am shocked. I am. And she just like ran out of there.

• 43:16Jack Rhysider?

  So professionally, Tanya has two passions: application development, which is coding, and cybersecurity, hacking. And so, over time, she simply found her favorite place to be was at the intersection of these two things. She's given talks and written frameworks on how app developers can write secure apps, which is known as secure coding or application security. Okay, so application security is yelling at devs. Why do you laugh? Why do you laugh?

• 43:44Speaker 01

  It should be helping devs. It should be helping devs make more secure code and being nice to them, ideally, most of the time, or all the time, in my opinion. And so, I was in charge of pen testing and doing, like, running and launching their first AppSec program. And so, there was five developer teams. I was asking to be able to pen test their apps before they went to prod. And I was hoping that they would scan their apps with Zap for me first.

• 44:18Jack Rhysider?

  Zap?

• 44:19Speaker 01

  Yeah, so Zap is a dynamic scanning tool that used to be part of OWASP. And it's the most-used dynamic scanner on the planet. And basically, I wanted the developers to scan the app first, and I'd made a grid. So I'm like, "If you find this, fix it. If you find that, just ignore it."

• 44:37Jack Rhysider?

  But the manager of that development team did not want his developers to do any of this.

• 44:42Speaker 01

  And one of the teams, their manager told me, "Leave my devs alone. We don't have time for your crap."

• 44:49Speaker 01

  I was pretty new to AppSec. It was only my second job in AppSec. And he felt I was inexperienced and that, in his words, I was a pain in his ass. And I was like, "I'm here to help." And he's like, "Then go away. That would help." And I was like, "Listen, like, I need to take a look at your apps for security." He's like, "They're fine. Just trust me." And I was like, "Well, I'd like to talk." He's like, "I don't have time." And each time, I kept trying to approach him. He was more aggressive. And so, the last time I'd talked to him, he'd literally said, "Go fuck yourself. Get the fuck out of my face." And like, was pointing at my face and pointing away. And then he just started yelling at me. And I, so I left.

• 45:30Jack Rhysider?

  Rude, rude. But this is why I don't want to be a manager. Managers take on too much stress. Directives from higher ups and deadlines with not enough resources to get it done. And their team always having problems too. And they can't always be transparent about things either, like how much their budget is or plans for upcoming layoffs. If their manager has a bad day, then that rubs off on them. And that means that manager's team has a bad day too. Or someone like Tanya gets yelled at for no reason.

• 46:02Speaker 01

  My boss was like, I know what we're gonna do. We're gonna hold a meeting and we're gonna tell them about a whole bunch of security incidents. And we're gonna deputize them and tell them not to tell anyone. So don't worry. I'm like, I'm very worried. And he's like, and it's gonna be fine and then they'll listen. And I was like, this is a terrible idea.

• 46:22Speaker 01

  And so he invited them in and he explained what it's like when a computer gets malware. And he's like, and then, you know, then this guy on the team, he does the malware analysis and he does this and you lose all your local files that you should have had. And he's like, so this is why we don't stick USB keys in our computers. And they're like, okay. And then like our worst incident recently, like there was this app and there was an SQL injection in it. And they managed to exfiltrate a whole bunch of our sensitive data. We had to report ourselves to the Privacy Commissioner. We ended up having to like, cause like they attacked the SQL server itself. We ended up to having to send that server away for analysis. He's like, we had to do this, this and that.

• 47:06Speaker 01

  And, you know, we ended up spending all these weeks of overtime on it. And he's like, it ended up costing over half a million dollars. And they're like, oh my gosh. And he's like, yeah, we could hire five engineers for that. And they're like, oh my gosh, wow, what a giant screw up. And he's like, that was your app. That was an app that Tanya asked in writing. And she came up and asked you personally if she could test it and you said no. She has been bugging you for six months and you have not let her test a single one of your apps. Tanya can't do this job by herself. She needs you. She needs your help so bad. She keeps asking for it and you keep... You told her to F off, dude. That's rude. We need you guys.

• 47:51Speaker 01

  We can't do it without you. Please, please, please, please help us. Let us test stuff. Let us tell you when things are wrong. Work with us, please. And the manager was like, oh my God, I'm so sorry. I had no idea. And he's like, dude, we spend so much on app tech. Like, we have, you know, her full time. That costs money. But he's like, there's the tools she has to buy. There's the time it takes. There's when there's an incident happens, it's a mess. Like, we can't do this without you. You guys are so much more important than you realize as this piece of the puzzle. And he's like, I need you to let her test and I need you to fix things if she says they're serious. Please? And the guy said yes. And then everyone chatted a lot.

• 48:36Speaker 01

  And then when everyone walked out, the manager that had been so unfriendly with me, he came up to me and he put his hand on my shoulder. He's like, Tanya, I had no idea how serious this was. I am sorry. This will never happen again on my watch. We are gonna be number one. You tell us everything, we're gonna fix everything. Our apps are gonna be bulletproof. This is over. And he did it. Like, he would fix all the things. He had them open up their old apps that weren't even on my list. And he had them scanning it with Zap and fixing things. And like, his team, like, the next luncheon lunch I had, they were all sitting there right at the front, eating the bagels. Uh, cuz I bribe people with carbs. And, like, all of them were there, like, the whole team, right at the front.

• 49:21Speaker 01

  We're ready, Tanya. And I was just like, oh my gosh, this is so amazing. And like, I thought by hiding... Like, it sounds dumb in retrospect, but he's like, if we show them we've made mistakes, they're not gonna trust us anymore. They're gonna think we're stupid and we're bad at our jobs. We can't let them know we're having lots of incidents all the time. They'll think we're failures. But in fact, that made sympathy and empathy. And then it was, it was like a completely different workplace then.

• 49:57Jack Rhysider?

  Thank you to Tanya Janka for coming on the show and sharing these stories with us. She's written two books, Alice and Bob Learn: Application Security and Alice and Bob Learn: Secure Coding. She also has a newsletter and would love it if you joined. You can find the newsletter at newsletter she hacks purple.ca. It's totally free, but it's crammed full of great, helpful information on how to make your apps more secure. It's holiday time and you know what your loved ones would love most? A Darknet Diaries t-shirt. And if they don't want something like that, then you tell them to get you one. And by the way, these shirts don't all say Darknet Diaries on them. Most of them are just really cool designs that I came up with. You have to check it out. Go to shop dot darknetdiaries dot com. The show is created by me, the spaghetti coder, Jack Recider. Our editor is the copy pasta coder Tristan Ledger.

• 50:42Jack Rhysider?

  Mixing done by Proximity Sound and our intro music is by The Mysterious Breakmaster Cylinder. One day I hope to change the world, but I don't have access to the source code. This is Darknet Diaries.