Tanya Janca on SQL Injection, Incident Response and Application Security
· 47:44 · Watch on YouTube ↗
Summary
Application security expert Tanya Janca recounts a government data leak involving blind SQL injection, a mistaken malware alarm caused by network congestion, and lessons for incident response and developer training.
Key points
- A demonstration of SQL injection against a login screen prompted Janca to move from software development into security.
- During a penetration test, Janca says code entered into a form field caused file changes and crashed a production server; the server and database were restored from backups.
- A Canadian government team traced a data sample offered for sale to an application missing from its inventory. The records were unclassified, but included nonpublic database identifiers.
- Database logs showed repeated attacks on statutory holidays. After learning about blind SQL injection, Janca concluded that the attacker had extracted data through true-or-false queries; the application was fixed.
- In a separate incident, Wireshark showed that Olympic video streams had congested an office network; contrary to initial claims, there was no malware.
- Janca’s team trained help desk staff to report suspected incidents promptly and preserve evidence, following an example in which deleting files and formatting a drive undermined an investigation.
Article Details
- Topics
- [00:00] Making security policies accessible to employees
- [04:50] SQL injection and a first penetration test
- [12:05] Government data leak and blind SQL injection investigation
- [23:16] Investigating a mistaken building-wide malware alarm
- [31:34] Help desk incident training and evidence preservation
- [36:52] Capture-the-flag training and SQL injection
- [39:58] Building an application security program