Darknet Diaries
"The Building Has Malware." Adventures in Appsec Darknet Diaries Ep. 165: Tanya
Episode Summary
AI-generated · Mar 2026AI-generated summary — may contain inaccuracies. Not a substitute for the full episode or professional advice.
Tanya Janca, a prominent figure in application security (Appsec), recounts her journey from software developer to leading incident response teams, driven by a passion to help developers write more secure code. This episode explores the critical yet often overlooked challenges in securing software and organizations, from navigating internal politics around security policies to handling major data breaches and internal IT incidents.
Janca's pivot into cybersecurity began after witnessing an SQL injection exploit on one of her own applications, leading her to learn penetration testing tools like Burp Suite. Her first pen test, guided by a deceptive mentor, resulted in her accidentally crashing a production web server and polluting its database via a Server-Side Request Forgery, highlighting the severe vulnerabilities applications can harbor and the ethical complexities of early hacking experiences.
Later, as a security leader in the Canadian government, Janca faced a real-world data breach notification from Vice Magazine, which revealed her agency's data was being auctioned for $48 Canadian dollars on the dark web. This led to the discovery of an incomplete application inventory and a year-long blind SQL injection attack that exfiltrated non-public record IDs. She finally understood the attack method years later at a Defcon workshop, illustrating the subtle sophistication of such exploits.
Janca also shares a memorable incident where a satellite office was reported to have “malware.” The situation, mismanaged by an untrained help desk technician, caused widespread panic among executives. Her team's investigation, using Wireshark, quickly revealed the true culprit: mass live-streaming of the Winter Olympics by employees, which had effectively caused a self-inflicted Distributed Denial of Service (DDoS) attack on their own network, demonstrating the impact of ignored policies and lack of security awareness. Another story reveals a catastrophic error by a help desk technician who, in an attempt to “fix” a computer, deleted all evidence of child exploitation images, ruining the chain of custody and preventing prosecution.
Ultimately, Janca's experiences underscore the profound importance of robust application security, proactive incident response, and comprehensive security awareness training for all employees, from executives to front-line IT staff. The episode serves as a powerful reminder that security is not just about tools and policies, but about human behavior, education, and the continuous effort to protect digital assets from both external threats and internal oversights.
👤 Who Should Listen
- Software developers and engineers looking to enhance their understanding of secure coding practices and application vulnerabilities.
- Cybersecurity professionals, especially those in Appsec, incident response, or penetration testing, seeking real-world case studies and insights.
- IT help desk technicians and managers interested in improving incident identification, escalation, and evidence handling protocols.
- Organizational leaders and C-suite executives concerned with internal security policies, employee awareness, and the true cost of security oversights.
- Anyone curious about the practical adventures and misadventures in the world of hacking, data breaches, and digital forensics.
- Government employees and contractors dealing with public data, security compliance, and internal policy enforcement challenges.
🔑 Key Takeaways
- 1.SQL injection is a powerful attack vector that can bypass login screens and exfiltrate sensitive data, as Tanya Janca demonstrated in a Capture the Flag (CTF) challenge and experienced firsthand with her own applications.
- 2.Blind SQL Injection is a sophisticated technique where attackers exfiltrate data by asking a database yes/no questions, often on specific criteria like the first letter of a field, rather than directly retrieving records.
- 3.A complete and accurate inventory of all applications is crucial for organizational security, as demonstrated when Tanya's team discovered numerous unsecured, unknown apps during a data breach investigation.
- 4.Untrained IT help desk staff can escalate panic during incidents or, worse, destroy critical evidence, breaking the chain of custody for potential criminal cases, as tragically illustrated by the child exploitation image incident.
- 5.Organizational policies, such as designated streaming areas during the Olympics, are vital to maintain network integrity; ignoring them can lead to severe network congestion and perceived 'malware' incidents.
- 6.Effective incident response requires specialized training and clear protocols, ensuring that technical experts manage crises and that false alarms are welcomed over missed threats.
- 7.Security leadership sometimes struggles to convey the severity of deeply embedded security problems, as shown by Jack's CISO dismissing concerns about an unfindable security policy.
💡 Key Concepts Explained
Application Security (Appsec)
Appsec is the process of developing, adding, and testing security features within applications to prevent vulnerabilities. Tanya Janca's mission is to help software developers write more secure code, emphasizing that Appsec should focus on aiding developers rather than just criticizing them.
SQL Injection
SQL Injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution. It can allow attackers to bypass authentication, exfiltrate data, or even control the database, as Tanya experienced when her own app was exploited and later demonstrated in a CTF.
Burp Suite
Burp Suite is a widely used set of tools for performing security testing of web applications. It allows users to monitor, capture, and manipulate network traffic between a computer and a web application, facilitating analysis and exploitation of vulnerabilities, as Tanya learned early in her hacking mentorship.
Blind SQL Injection
Blind SQL Injection is a type of SQL injection attack where the attacker asks the database true/false questions and determines the answer based on the application's response (or lack thereof), rather than receiving direct data. This method allows for data exfiltration character by character, which Tanya eventually understood to explain a past government data breach.
Chain of Custody
In digital forensics, the chain of custody is the chronological documentation or paper trail showing the seizure, custody, control, transfer, analysis, and disposition of physical or electronic evidence. Maintaining an unbroken chain of custody is crucial for evidence to be admissible in court, as highlighted by the help desk incident where it was destroyed.
⚡ Actionable Takeaways
- →Sanitize all user inputs in web forms and applications to prevent SQL injection and other code-based exploits, a core principle of application security.
- →Implement comprehensive logging for all applications, including detailed web-app logs in addition to database logs, to enable thorough incident investigation.
- →Maintain a continuously updated and accurate inventory of all applications within your organization to ensure every digital asset is accounted for and secured.
- →Provide mandatory, basic security incident training for all first-line support staff, such as help desk technicians, on how to identify potential incidents and the critical importance of escalating to security teams immediately without 'fixing' evidence.
- →Enforce and communicate network usage policies, especially during high-bandwidth events, to prevent self-inflicted network congestion and ensure business continuity.
- →Establish clear protocols for handling potential criminal evidence found during IT support, prioritizing the preservation of the chain of custody over immediate deletion or reformatting.
- →Integrate security education directly into software development workflows, aiming to help developers write more secure code rather than just 'yelling at devs.'
⏱ Timeline Breakdown
💬 Notable Quotes
“TANYA: I hope software developers write more secure code.”
“TANYA: I’m like, the building’s dumb. It can't have malware. ... Cement does not get malware. They're like, Dan knows and you don’t.”
“JACK: They essentially did a DDoS attack on themselves.”
“TANYA: I’d rather twenty false alarms than one where you didn’t call and we made a mess.”
More from this guest
Tanya Janca
Listen to Full Episode
📬 Get weekly summaries like this one
No spam. Unsubscribe anytime. By subscribing you agree to our Privacy Policy.
Continue Exploring
