Tanya Janca | SheHacksPurple

**Not everything needs to be a damn AI agent.** There. I said it. And I will keep saying it. Warning: hot takes ahead. Recently, I was teaching a secure AI class, and one of my students was telling me about an AI agent they were building. 1/14

Patching a vulnerability doesn't kick an attacker out of your system. We've been talking about PHP2Shell for almost a week now. The patches are available, and hopefully everyone has been updating. But there's an important new development. 1/8

If your organization was running a vulnerable version of PHP, especially on an internet-facing system, there are two important questions to ask: 1. Have we patched it? 2. Have we investigated whether anyone exploited it before we patched? Assume breach isn't just a design philosophy. 7/8

twp.aidreamgroup.comChained PHP2Shell Exploit Roots 25 Servers | Dream Research

It's how we respond as well. Research: https://twp.ai/9OcvXW #AppSec #PHP #CyberSecurity 8/8

We design with defense in depth, least privilege, segmentation, and monitoring because we know prevention isn't perfect. And when a serious vulnerability is disclosed, we don't just patch it and declare victory. We consider whether attackers may have exploited it already. 5/8

Because if an attacker got in before you patched, the patch doesn't remove their webshells, revoke stolen credentials, or eliminate their persistence mechanisms. 6/8

According to their investigation, attackers chained PHP2Shell with a Linux privilege escalation vulnerability, installed webshells, and established persistent access. These findings haven't yet been independently verified, but they remind us of an incredibly important security principle: 3/8

Assume breach. Assume breach means designing our systems AND reacting to security incidents as though attackers may already be inside, or may eventually find their way in. 4/8

Dream Research reports that attackers have successfully compromised 25 real-world systems using PHP2Shell, including internet-facing firewalls and an internal management server. 2/8

If you're building software that handles sensitive personal information, I have a question for you. What would happen to the PEOPLE using your application if that information was stolen? Not just your company's reputation. Not just your compliance obligations. 1/6

And this is also a **software supply chain security** problem, because third-party service providers are part of the systems we depend on. I made a video about the Crime Stoppers breach, the surprising gaps in Canadian privacy law, and how we can better protect vulnerable people. 5/6

twp.aiyoutu.beCrime Stoppers Breach: Who Protects Canadians' Privacy?

🎥 https://twp.ai/9ObcVy **You can't have privacy without security.** #AppSec #Privacy #ThreatModeling #SoftwareSupplyChainSecurity 6/6

What happens if your third-party software provider gets breached? These are questions we should be asking when we threat model our applications. Privacy isn't just a policy someone writes and puts on a website. It needs to be designed INTO the software. 3/6

The recent Crime Stoppers breach is a powerful reminder that removing identifying information before sharing it doesn't necessarily protect the original data while it's stored. 4/6

The actual human beings whose information you're protecting. Imagine you're building software for a nonprofit helping someone escape an abusive relationship. Do you really need their temporary new home address? How long do you retain their information? Who can access it? 2/6

Your AI agent's instructions are NOT the same as its permissions. I think this is one of the most important distinctions developers need to understand as we start integrating agents into our daily work. You might ask an agent to write some code. Sure. But can it also: • Execute that code? 1/5

twp.aiyoutu.beWhat Can Your AI Agent Actually Do?

I share the full story in the latest episode of DevSec Station, along with what happened when my students and I threat modeled it. 🎧 What Can Your AI Agent Actually Do? Watch on YouTube: https://twp.ai/9ObIbJ Also available on your favourite podcast app. 💕 The lesson? 4/5

Design your security controls around an agent's effective capabilities, not just your expectations of its behaviour. #AppSec #AIAgents #SecureCoding #DevSecStation 5/5

• Install dependencies? • Read files containing secrets? • Connect to external services? • Publish an application? • Schedule something to run automatically? Because if it has those capabilities, then your prompt isn't necessarily going to prevent it from using them. 2/5

I learned this firsthand when I asked Claude to build me a simple morning greeting app. It did considerably more than I'd intended. Because Claude always embarrasses me during class! 🙈 3/5

I just learned something about Canadian privacy law that absolutely SHOCKED me. Seriously. 1/7

I made a video explaining what happened with Crime Stoppers, the gaps in Canadian privacy law, and why I think our lawmakers need to address them. Because I've been saying this for years: **You can't have privacy without security.** 6/7

twp.aiyoutu.beCrime Stoppers Breach: Who Protects Canadians' Privacy?

And your right to privacy shouldn't depend on whether an organization makes a profit. 🎥 https://twp.ai/9ObcXw #Privacy #Canada #CrimeStoppers #CyberSecurity 7/7

I just learned something about Canadian privacy law that absolutely SHOCKED me. Seriously. 1/7

Think about that for a moment. Domestic violence shelters. Victim support organizations. Addiction recovery services. Charities helping vulnerable children. These organizations can hold some of the most sensitive personal information imaginable. 4/7

Information that, if exposed, could literally put someone's life in danger. And yet our privacy protections can depend on where an organization operates and what activities it conducts. 5/7

I just learned something about Canadian privacy law that absolutely SHOCKED me. Seriously. 1/7

After the massive Crime Stoppers data breach, Canada's federal privacy commissioner and Ontario's privacy commissioner indicated that they don't have the authority to formally investigate the Crime Stoppers organizations involved. WHAT?!?! 2/7

It turns out that Canada's federal privacy law, PIPEDA, generally doesn't cover nonprofits when they're conducting noncommercial activities. Now, some provinces, including BC, have their own privacy laws that DO cover nonprofits. But protections vary across Canada. 3/7

You can write perfectly secure application code and STILL end up with a critical security vulnerability. That's one of the most important lessons from PHP2Shell, and it's a perfect example of why **software supply chain security** matters so much. 1/8

twp.aiyoutu.bePHP2Shell: 2 Critical PHP Vulnerabilities! Patch NOW!

You still need to rebuild, redeploy, and verify. I made a video explaining the recent PHP2Shell vulnerabilities and what developers need to know. 🎥 https://twp.ai/9Obflm **Secure coding is essential. But securing the entire software supply chain is essential too.** 7/8

#SoftwareSupplyChainSecurity #AppSec #SecureCoding #PHP 8/8

But what happens when the vulnerability isn't in your code? What happens when it's somewhere else in your software supply chain? That's why we need to think about securing the **entire software supply chain**, not just the dependencies listed in our package manager. 5/8

We need to know what we're running, understand what we depend on, keep those components updated, and verify that security fixes actually make it into production. For example, updating a container base image in your repository doesn't mean your running application has been fixed. 6/8

It includes the programming language runtime, frameworks, build tools, container images, infrastructure, and all the other components we depend on to build and run our applications. 3/8

We spend a lot of time teaching developers how to validate input, implement authorization, use safe APIs, and avoid introducing vulnerabilities into their applications. And we should! Secure coding is incredibly important. (Obviously I care about this a lot) 4/8

When we talk about securing the software supply chain, people often think about open-source libraries and third-party dependencies. But our software supply chain is SO much bigger than that! 2/8

"Developers should carefully investigate every dependency before they install or update it." Okay - Sure... And while we're at it, perhaps they could personally audit the source code of all 1,847 transitive dependencies before lunch. 😂 We need security advice that works in the real world. 1/5

And we should also limit what our development environments can access, so one malicious dependency doesn't automatically get every credential we own. I know, this one isn't as fun. :-/ **Our security controls need to scale to the way developers actually build software.** 4/5

twp.aiyoutu.beThis Malicious npm Package Had Valid Provenance. How?!!?!?!

That's one of the lessons I took from the recent GHAPPIER npm supply chain attack. 🎥 https://twp.ai/9OaPxv 5/5

Pin dependencies at dev. Use lock files. Only updating with dependencies that are 7 days or older, unless it's an emergency. But we also need to **automate the security analysis of dependencies.** Modern SCA and software supply chain security tooling needs to go beyond: 2/5

"Does this package have a known CVE?" We also care about things like: → malicious package detection → suspicious changes and behaviour → project and maintainer health → ** reachability ** → provenance and other supply chain integrity signals 3/5

The tree is really are big in British Columbia. #infosecgardening

Three service accounts aren't three security boundaries if your AI coding agent can use all three of them. 😬 Imagine your coding agent can push code to your repository. Great. Then CI has a separate service account to build and test it. Also great. 1/5

Keep production deployment behind a separate identity and an independent approval or policy boundary. Then compromising one part of your development environment doesn't automatically mean: "Congratulations! You now own production!" 4/5

twp.aiyoutu.bePlugin4Shell: AI Coding Plugins Are Part of Your Software Supply Chain

I talk about this, #Plugin4Shell, least privilege, and why AI coding plugins are becoming part of our software supply chain in my latest video: https://twp.ai/9OaKLA 5/5

Then production deployment uses a DIFFERENT identity with different permissions. Excellent! Yay! Separation of duties! Except... If the coding agent has access to all three sets of credentials, we haven't accomplished very much... 😂 2/5

If the coding agent gets compromised, the attacker still gets all 3. **The security boundary needs to exist outside the agent.** Let the agent push code. Let CI build and test it with its own limited identity. 3/5