Abstract
Why focus on heavily guarded crown jewels when you can dominate an organization through its shadow IT? Low-Code applications have become a reality in the enterprise, with surveys showing that most enterprise apps are now built outside of IT, with lacking security practices. Unsurprisingly, attackers have figured out ways to leverage these platforms for their gain. In this talk, we demonstrate a host of attack techniques found in the wild, where enterprise No-Code platforms are leveraged and abused for every step in the cyber killchain. You will learn how attackers perform an account takeover by making the user simply click a link, move laterally and escalate privileges with zero network traffic, leave behind an untraceable backdoor, and automate data exfiltration, to name a few capabilities. All capabilities will be demonstrated with POCs, and their source code will be shared. Finally, we will introduce an open-source recon tool that identifies opportunities for lateral movement and privilege escalation through low-code platforms.
Transcript
AI generated from recording.
Introduction & Low‑Code Overview
00:00 Presenter: Yeah. So please join me in welcoming Michael Bargery for Low Code High Risk Enterprise Domination via Low Code Abuse.
00:17 Presenter: Hi everyone. So first of all thank you for staying. This is a difficult time. But we’re gonna have some fun today. So this talk is
00:30 Presenter: is gonna focus on how do we take low code,
00:33 Presenter: which is kind of technology that are about enabling users,
00:37 Presenter: users to build their own things,
00:39 Presenter: and seeing how attackers are using that
00:42 Presenter: to basically own the enterprise.
00:43 Presenter: And this entire talk is based on attacks
00:45 Presenter: that we’ve observed in the wild,
00:48 Presenter: that we are going to recreate today.
00:53 Presenter: My name is Michael, I’ve been doing security
00:55 Presenter: for a long time now, I spent a few years at Microsoft
01:00 Presenter: IoT and APIs and cloud.
01:02 Presenter: If you’ve seen my first talk this morning,
01:05 Presenter: so thank you again for coming and I hope I don’t bore you.
01:11 Presenter: Other than that, I’ve started a company called Zenity
Low‑Code Definition & Enterprise Adoption
01:17 Presenter: a year and a half ago, we were focused on
01:19 Presenter: low-code and no-code security.
01:20 Presenter: That’s how we got to observe this space.
01:23 Presenter: And this entire research is going to be,
01:25 Presenter: is featuring research from Riel Zilberberg,
01:28 Presenter: which is sitting right here.
01:30 Presenter: him some love. Thank you. And I’m really excited to be here, my first DEFCON, so it’s been
01:38 Presenter: really amazing. A short disclaimer, this talk gives an attacker perspective on low code,
01:45 Presenter: but of course we are all for low code development. This is the, the, the trend of low code is
01:51 Presenter: really cool, providing users the ability to build stuff on their own, but it’s important
01:56 Presenter: to do it securely so that’s why we’re giving this talk.
02:00 Presenter: Here’s what we’re gonna do today.
02:01 Presenter: We’ll start off with making sure we all understand
02:05 Presenter: what low code is.
02:06 Presenter: We’ll then see, we’ll then dive into attacks
02:09 Presenter: that we’ve observed in the wild on low code platforms.
02:12 Presenter: We’ll start with a living of the land attack.
02:15 Presenter: So cases where attackers are using low code
02:18 Presenter: to basically do whatever they want inside the enterprise.
02:21 Presenter: The second part would be how do you remain
02:26 Presenter: persistent, how do you establish persistency through local
02:29 Presenter: platforms, and then we’ll go to predictable misconfigurations
02:34 Presenter: and how those are abused through outside-end scanning.
02:37 Presenter: We’ll finish off with two things.
02:39 Presenter: One is you’ll have a couple more tools in your
02:42 Presenter: relative arsenal to play around with, and the second thing
02:45 Presenter: is how to protect your organization.
02:47 Presenter: So we’ll go through that as well.
02:50 Presenter: So let’s start.
02:52 Presenter: Low code is really all about empowering of business users.
02:56 Presenter: So the idea, the idea is basically business users are tired
03:01 Presenter: of waiting for IT, they want to solve their own things,
03:04 Presenter: their own problems, and so they have these
03:07 Presenter: drag and drop interfaces which allow them to create
03:09 Presenter: applications and automations, and the crucial piece here
03:12 Presenter: is that it’s built on top of platforms that you already know
03:15 Presenter: and we’ll see that in a moment.
03:17 Presenter: If this idea of enabling business users
03:21 Presenter: own thing sounds familiar, well there’s a long history behind it. So there are these, there
03:27 Presenter: were software that allowed you to record your keyboard and your mouse and then reiterate
03:34 Presenter: that for automation. There are macros which are of course our close friends. And there’s
03:41 Presenter: low code now that it is on the same axis. And people are building all kinds of things
03:49 Presenter: with it. So if this then that automation, for example, every time I get an email with an
03:57 Presenter: attachment, store that attachment in Google Drive, applications like handling receipts
04:03 Presenter: or onboarding and offboarding users, there’s really lots and lots of business cases for
04:11 Presenter: these kind of applications. And the crucial thing is this is already in all of the enterprises
04:19 Presenter: they made the kind of conscious choice to do it, it because the vendors, the vendors
04:24 Presenter: that you’re seeing up here but also others, they basically built a low code platform around
04:31 Presenter: existing services that they already have. So if you’re a Microsoft job or if you just
04:36 Presenter: have Office, every user can build automations and applications based on their own identities
04:41 Presenter: within Office and this is something that you already have in your organization today. The
04:45 Presenter: same thing applies for Salesforce and ServiceNow and all of the logos that you’re seeing here.
04:49 Presenter: So this is by definition also already inside your org and touching business data. So here’s
04:58 Presenter: a very quick recap on what low code is. We’ve seen that it’s, we’ve discussed that it’s
05:03 Presenter: available in every major enterprise. Actually what we’re seeing is that in every organization
Attack Landscape: Living Off the Land
05:08 Presenter: that we’re starting to work with there are tens of thousands of these applications and
05:12 Presenter: these are not exaggerated numbers.
05:15 Presenter: Tens of thousands of applications
05:16 Presenter: being built by business users.
05:18 Presenter: People in IT, people in HR,
05:19 Presenter: they are all building their own things
05:21 Presenter: and you will see in a moment
05:22 Presenter: that it takes just a couple of minutes.
05:25 Presenter: We see that, we’ve seen that this is,
05:28 Presenter: this allows, this by definition has access to business data
05:31 Presenter: or powers business processes
05:32 Presenter: because that’s what it’s meant for.
05:34 Presenter: And it runs as SAS, which is important
05:36 Presenter: because there’s all of the controls that you’re used to,
05:39 Presenter: well, they’re not there.
05:42 Presenter: or on Microsoft Cloud, on Salesforce Cloud.
05:44 Presenter: And the last piece is that this is vastly underrated
05:48 Presenter: by IT and security teams.
05:49 Presenter: So people have started noticing this area,
05:52 Presenter: but there’s a lot more to go there.
05:57 Presenter: So that was the recap.
05:59 Presenter: That was the kind of figuring out,
06:01 Presenter: making sure we’re all on the same page
06:02 Presenter: and what low code is.
06:04 Presenter: The next part is observing attacks.
06:07 Presenter: And before we are going to,
06:08 Presenter: and by the way, this part will be heavily focused
06:12 Presenter: which is built around Office, simply because many people are using it. It’s very successful and so
06:17 Presenter: hackers are using it as well. Before we start figuring out how hackers live off the land of
06:24 Presenter: low code, no code and specifically Power Platform, let’s just make sure that we understand
06:31 Presenter: how this looks like. So this is going to be a very quick example and let me play while I explain.
06:38 Presenter: Basically, this is a very simple automation.
06:41 Presenter: It’s gonna be built in a couple of minutes.
06:44 Presenter: This automation does one thing.
06:46 Presenter: When I’m in Slack and somebody mentions me
06:49 Presenter: on a common channel, it’s very annoying
06:51 Presenter: because I always have to respond quickly
06:54 Presenter: because it’s in a common channel and everybody’s seeing.
06:56 Presenter: So this automation, every time that somebody mentions me,
07:01 Presenter: it changes my status as if I’m on a call.
07:03 Presenter: Then that person could figure out
07:06 Presenter: that I’m not available right now.
07:08 Presenter: And then of course it moves me back to a status that is clear so nobody will suspect anything.
07:15 Presenter: And you’re seeing that in order to build this automation I’m kind of dragging and dropping,
07:22 Presenter: I’m going through select boxes. These are things that everybody can do. And that’s the power of
07:27 Presenter: this technology. That’s also the risk. One of the key parts to notice here and I’m gonna stop it
07:35 Presenter: somewhere along the way, is the fact that you haven’t seen
07:38 Presenter: any sort of authentication.
07:39 Presenter: Keep in mind this is Zapier, one of those platforms,
07:43 Presenter: going out to Slack with my own identity
07:46 Presenter: and changing stuff, right?
07:48 Presenter: But you haven’t seen any window pop up,
07:50 Presenter: you haven’t seen any overflow,
07:52 Presenter: so how exactly does this happen?
07:53 Presenter: This is very important in order to understand
07:56 Presenter: how attacks are being made on those platforms.
08:02 Presenter: So here’s a step by step of what happens
08:05 Presenter: create a new automation with low code.
08:09 Presenter: The first step is that you pick from a list of
08:12 Presenter: lots and lots of applications.
08:13 Presenter: Those could be SaaS applications, on-prem connectors.
08:17 Presenter: Those are basically hundreds and hundreds of connectors
08:20 Presenter: that are being provided by the platform themselves
08:23 Presenter: to connect wherever you’d like.
08:24 Presenter: The second thing is that there is this all of consent flow
08:27 Presenter: that basically allows the application
08:29 Presenter: to operate on your behalf as a user.
08:31 Presenter: but notice the last part and specifically the share button. So something is going on here,
08:41 Presenter: right? There’s an application, it logs in on a user’s behalf to Slack and then somehow it’s able
08:47 Presenter: to share that user’s authentication with Slack with other users. And so the next thing we’re
08:54 Presenter: going to try and figure out is how does this work. So on one side we have a lot of users
09:01 Presenter: Zapier or Power Automate or other automation tools that are part of low code and on the other side we
09:07 Presenter: have Slack and again the idea is to figure out how does this authentication work and especially
09:11 Presenter: how does connection sharing work. So here’s how they do it. Instead of going through the
09:19 Presenter: usual route of kind of RBAC and asking for permissions for each user separately, they simply
09:26 Presenter: copy the refresh tokens and then replay them.
09:29 Presenter: So you plug in, you do the consent flow for Slack,
09:34 Presenter: Power Automate will store your refresh token
09:36 Presenter: and then you can share that refresh token
09:39 Presenter: with other users through Power Automate.
Persistence & Privilege Escalation via Low‑Code
09:41 Presenter: Now of course from Slack’s perspective
09:43 Presenter: or from a network security perspective,
09:47 Presenter: there’s no sharing here, right?
09:48 Presenter: It’s the user, the user is always the one
09:50 Presenter: that’s doing the operations.
09:52 Presenter: It doesn’t matter if an application is using it,
09:54 Presenter: other users are using it, this is a crucial point. These applications are basically blocking,
10:00 Presenter: are basically breaking the permission model that we’re used to in SAS and in connectivity
10:05 Presenter: between applications. Okay. Now that we figured that out, let’s see what attackers are doing
10:12 Presenter: with it. So the first thing that we need to make, to understand is that because lots of,
10:18 Presenter: you’ve seen how easy it is to create these applications, uh, and lots of more, lots more
10:24 Presenter: that means that you get lots and lots and lots of applications.
10:28 Presenter: These are all examples from the marketplaces
10:31 Presenter: of the different vendors and you can,
10:33 Presenter: maybe you can see the numbers, it might be too small,
10:35 Presenter: but there are hundreds of thousands of those being deployed
10:38 Presenter: and again we see that in an enterprise all of the time.
10:40 Presenter: And the important thing here is actually the logos
10:43 Presenter: because behind every logo in these processes,
10:47 Presenter: there’s data, there’s connection to data,
10:50 Presenter: or there’s the ability to do all sorts of operation.
10:52 Presenter: So behind every one of those applications,
10:56 Presenter: those tens of thousands of applications within enterprises,
10:58 Presenter: there’s a trail of connections.
11:00 Presenter: A trail of connections that can be shared with other users.
11:03 Presenter: And actually, it’s not only that it can be shared,
11:06 Presenter: in many cases that’s the default.
11:08 Presenter: So if you look at Microsoft Power Platform for example,
11:12 Presenter: if you look at Zapier or other platforms as well,
11:15 Presenter: they all have a notion of a default environment.
11:19 Presenter: Some place where we create an application,
11:23 Presenter: the connection will go there, and other users can just
11:26 Presenter: pick it up and use it.
11:28 Presenter: So those are examples of the default environment
11:30 Presenter: from different vendors.
11:31 Presenter: Again, this is not a problem with one platform.
11:35 Presenter: This is a basic concept of how this technology works.
11:38 Presenter: And so every platform has their own version
11:40 Presenter: of this default environment, and when you have access
11:43 Presenter: to this default environment, you get access to tons
11:45 Presenter: and tons of connections across the organization.
11:48 Presenter: And I’m talking about, from what we’ve seen,
11:52 Presenter: with root accounts, users, the users own identities
11:56 Presenter: to Office and to Slack, FTP connections,
12:01 Presenter: all of the things that you could think about
12:02 Presenter: that users are using these platforms for.
12:05 Presenter: So what we’re seeing hackers do very easily
12:09 Presenter: is once they get into an enterprise,
12:12 Presenter: once they find at least one user’s account
12:14 Presenter: and they’re able to log into their SaaS,
12:16 Presenter: they can very easily escalate their privileges.
12:19 Presenter: It’s already there, it’s kind of, it’s built in.
12:22 Presenter: So that’s really, really, really simple.
12:24 Presenter: But the next thing that they’ll do is that they’ll use
12:27 Presenter: these connections that are part of the platform
12:31 Presenter: and they do a bunch of things with it.
12:33 Presenter: So here’s an example of a ransomware attack
12:35 Presenter: and again these are all attacks that we’ve observed
12:37 Presenter: and recreated.
12:39 Presenter: So in this example I’m going through a SharePoint site
12:43 Presenter: on a schedule and I’m simply encrypting every file
12:47 Presenter: on that SharePoint with the comfortably provided
12:50 Presenter: and encryption function within Power Automate
12:52 Presenter: Microsoft’s platform.
12:54 Presenter: So again, ransomware here is just really, really easy
12:58 Presenter: and this is ransomware without installing any agents,
13:02 Presenter: without going through the network.
13:04 Presenter: This is all on the SaaS cloud.
13:09 Presenter: The other thing that we’re seeing people do is
13:12 Presenter: export data outside of the organization.
13:14 Presenter: This is a crucial piece.
13:16 Presenter: There’s a bunch of, so when you think about
13:20 Presenter: protect from data leakage, we can go at it through the network,
13:23 Presenter: we can try and scan storage accounts and cloud accounts,
13:28 Presenter: but because these platforms, they mix up identities
13:31 Presenter: of different users and you can also plug in
13:34 Presenter: your personal identities, then you don’t really have access
13:37 Presenter: to scan everything here.
13:38 Presenter: So for example, in this example which we’ve seen,
13:41 Presenter: I think in every organization that we’re working with,
13:44 Presenter: we find, what people are doing is in order to send
13:50 Presenter: a corporate email to their Gmail account,
13:53 Presenter: they’re simply copying the content
13:54 Presenter: instead of forwarding the email.
13:56 Presenter: And then really there’s nothing you can do
13:58 Presenter: outside of the platform to even catch this
14:00 Presenter: because remember, this is impersonating the user.
14:05 Presenter: It’s not going through any sort of approval process.
14:09 Presenter: So data expelation is really easy here.
14:12 Presenter: We’ve seen this not only with emails,
14:14 Presenter: but you can do it with other things as well.
14:20 Presenter: creating a useful application and then even by mistake, storing its data in your own
14:25 Presenter: personal Dropbox because you can mix and match these things very easily. So we’re seeing this
14:30 Presenter: again multiple times. Another thing you can do which is actually kind of weird is that you can
14:37 Presenter: jump from the cloud to people’s laptops and that’s because these platforms are uh have a
14:44 Presenter: component that’s called RPA which is about automation on the user side, on the laptop
14:50 Presenter: another talk on this earlier today. So you can, the materials are there in the link and you can
14:55 Presenter: find it online. But it’s very easy once you have access to those shared connections, some of
15:02 Presenter: those shared connections are actually privileges to execute something, a payload, on a user’s
15:07 Presenter: machine. And then you can just pick it up and use it. Again, the same thing that we’ve seen
Misconfigurations & Data Exfiltration
15:10 Presenter: for lateral movement. Um, so as you can see there’s a lot of risk in these overshared
15:20 Presenter: again recall these are wrappers around authentication, refresh tokens. This means that
15:26 Presenter: from the outside you won’t be able to figure out that there has been a shell. So that’s one
15:32 Presenter: user that’s simply reusing that connection again and again. In order to make it easy for us and
15:39 Presenter: for you as well to kind of figure out whether this happens within your organization and to plug
15:44 Presenter: it into part of your kind of red team arsenal, we built a small tool that basically allows you
15:50 Presenter: in a user and get a table with all of the different connections
15:55 Presenter: that that user has access to, which users are, uh,
15:59 Presenter: those connections belong to, so that’s all available very
16:03 Presenter: quickly. You’ll see that tool is kind of a, it’s less than a
16:07 Presenter: hundred lines of code. It’s very, very, very easy. So feel free
16:10 Presenter: to kind of use it and play around with it. The next piece I
16:16 Presenter: want to talk about is how do we make, so let’s say that we got into an organization and we’re
16:22 Presenter: seeing those shared connections but we want more. We want to find, we want to entice users to
16:27 Presenter: create those connections and we want to own a specific user identity for example. What we can,
16:33 Presenter: what we, what we can do here is we can set up a beta application that basically asks for, for
16:39 Presenter: example your email connection with a good reason for that but then we can use that email
16:44 Presenter: connection while the user is connected to do whatever we want. Of course this is not special
16:49 Presenter: to low code applications. Every application can do that. The simple, the key thing here is that
16:55 Presenter: somebody from HR can create this application. Somebody from finance. So the, the, there’s a
17:01 Presenter: very, there’s a much lower bar to create these applications. And there’s also another crucial
17:06 Presenter: piece here. This is all run on the vendor’s SaaS products. So for example, in the example that
17:14 Presenter: Power Plus or Microsoft’s local platform, the application will end up in a Microsoft.com
17:19 Presenter: domain. So users will trust it. Why not? So let’s see how it works. So while this is
17:29 Presenter: running, what I’m going to do is I’m picking an application from the template list. I’m
17:35 Presenter: specifically taking an application that is about creating an out of office. So you go into the
17:40 Presenter: application, you give it access to your email and it will decline emails for you. You’ve seen
17:46 Presenter: briefly that I needed to create those connections to click allow. We’ll see it again shortly.
17:51 Presenter: So you see I’m picking a date and then I can have, I can configure a few things and the
17:57 Presenter: application will do everything for me. And this is a useful application. I didn’t create it. I
18:01 Presenter: just picked it off the marketplace. What we’re going to do is take this useful application and
18:05 Presenter: abuse it for our own needs. So I’m hitting the edit button here and I’m going to do a very
18:11 Presenter: simple thing. I’m going to use the user’s email while it is connected to send myself an email
18:17 Presenter: saying hi, I’ve been pwned. Now of course I could have done other things here but the important
18:24 Presenter: thing to note is how simple it is. So it’s a single line of code to reuse that user’s
18:30 Presenter: connection to do anything we’d like and the user don’t really
18:36 Presenter: have a way to know what’s happening here.
18:41 Presenter: Okay, so while it takes me a lot of time to type,
18:46 Presenter: the next thing that’s going to happen here is that I’m going
18:49 Presenter: to save the application and by the way, when I click save,
18:52 Presenter: it’s already deployed so there’s no deployment process here
18:55 Presenter: and then I’m gonna share it and I’m gonna share it with
18:57 Presenter: the entire org because that’s a function that’s available
19:00 Presenter: so why not?
19:02 Presenter: Once I create this share, Microsoft provides me
19:05 Presenter: with a nice link for my application.
19:07 Presenter: So I’m gonna copy that link, and now I’m in another user,
19:11 Presenter: and I’m going to plug in that link on the browser,
19:13 Presenter: and let’s see what happens.
19:16 Presenter: First of all, I get this window that’s asking me
19:19 Presenter: to use my credentials, and it was asking me for two things,
19:23 Presenter: for my account to Office and for my calendar.
19:27 Presenter: And of course, while I click allow and I use the application,
19:32 Presenter: very quickly I get the email that have been pwned.
19:35 Presenter: So we’ve seen how easy it is to do it, but there’s one key
19:43 Presenter: thing to understand about this example,
19:44 Presenter: and that is this window, okay?
19:47 Presenter: This window is what allowed the application to take over
19:52 Presenter: the user’s identity, and as you can see,
19:54 Presenter: this is not the usual OAuth window that you’re used to.
19:58 Presenter: It’s not telling you, hey, these are the operations
20:00 Presenter: I’m going to use so you’ll know that other operations
20:02 Presenter: are being created, no.
20:04 Presenter: This window is about sharing the connection,
20:08 Presenter: the connection that we saw earlier.
20:11 Presenter: And so the only thing that gave the user a hint
20:15 Presenter: that I might be able to steal their identity
20:17 Presenter: is this window.
20:19 Presenter: And so naturally, we want to figure out a way
20:22 Presenter: to remove this window. Note that if I’m able to do that, I have a link on Microsoft.com and if I
20:30 Presenter: share it with anybody in the organization and they click it, that’s it. That’s game over.
20:36 Presenter: So thankfully, this is something that’s already available. This is for Microsoft docs so an
20:43 Presenter: admin can basically set a flag that means that this window just goes away. And actually people
20:52 Presenter: doing this in order to make these applications easier to use.
20:55 Presenter: So if you’re in an organization that has done this,
20:58 Presenter: you might be in big trouble.
21:01 Presenter: So we have seen multiple ways in which hackers are living
21:06 Presenter: off the land, specifically we’ve seen things about Microsoft
21:10 Presenter: Power Platform and we’ve seen it about Zapier.
21:13 Presenter: We’ve seen lateral movement, privilege escalation,
21:15 Presenter: ransomware, account takeover, and these were all drag and drop,
21:19 Presenter: very simple, very easy to use.
21:22 Presenter: The next part that I’m going to talk about
21:25 Presenter: is how do we stay there?
21:28 Presenter: So this has been, as you can see,
21:31 Presenter: there are a ton of things that you can do
21:34 Presenter: once you get into those applications,
21:36 Presenter: into those local platforms.
21:38 Presenter: And the next part is how do we make sure
21:41 Presenter: that we remain persistent within those platforms?
21:45 Presenter: But actually it’s more than within those platforms,
21:47 Presenter: it’s to remain persistent in an organization.
21:49 Presenter: Because again, if I’m there, I can use the connections
21:52 Presenter: and continue on from there.
21:54 Presenter: We are actually not going to invent anything here.
21:56 Presenter: This has been done by an APT group about two years ago.
22:03 Presenter: So what happened here, and if you follow the link
22:06 Presenter: you’ll see all of the sources.
22:08 Presenter: Basically this is a slide from a Microsoft
22:10 Presenter: detection and response team where an APT group
Tools & Mitigation Strategies
22:12 Presenter: was able to stay hidden within an enterprise.
22:16 Presenter: They knew that they got hacked and they were looking
22:19 Presenter: to find the hackers and it took them six months to find
22:23 Presenter: that there was a single automation on Power Platform
22:28 Presenter: that did a very simple thing.
22:30 Presenter: It used e-discovery to go out and find secrets
22:34 Presenter: and find business data in email, in Outlook,
22:38 Presenter: in SharePoint and then just send it off to a random endpoint.
22:42 Presenter: And nobody was looking for it.
22:44 Presenter: You don’t really have a network appliance looking
22:46 Presenter: at what Microsoft is doing.
22:49 Presenter: a long time to find. So what we’re going to do now is recreate that and see how it can
22:55 Presenter: work, see exactly how it works. Here’s the first version. So on a schedule I’m going to go
23:03 Presenter: through all of the files in a single SharePoint site. I’m going to encrypt them, send them
23:09 Presenter: over to a random endpoint, for example pastebin and I’m going to tweet about it because why
23:13 Presenter: Why not?
23:14 Presenter: I mean, nobody will find me anyway.
23:17 Presenter: You can also apply this to on-prem,
23:19 Presenter: you can plug in any one of the connections
23:21 Presenter: that we’ve just, that we saw before.
23:23 Presenter: So this is actually exactly what the attackers have done.
23:26 Presenter: Now let’s take it a step further.
23:29 Presenter: So instead of starting with a schedule,
23:32 Presenter: let’s plug in an HTTP endpoint
23:35 Presenter: that you can just call from the outside
23:37 Presenter: and in this example what it’s going to do
23:39 Presenter: is encrypt an entire Google Drive.
23:42 Presenter: Again, why not?
23:43 Presenter: So this is basically encryption, ransomware for a specific
23:48 Presenter: Google Drive that is available through an HTTP endpoint
23:51 Presenter: outside of the org.
23:54 Presenter: But actually I’ve mentioned that this part of the talk
23:57 Presenter: is about persistency.
23:58 Presenter: This is just a very small part of what we need in order
24:01 Presenter: to remain persistent so here’s a laundry list.
24:04 Presenter: Of course this is not everything but there are a few
24:06 Presenter: things that we need to be able to do.
24:08 Presenter: We need to be able to run code remotely.
24:11 Presenter: we want to be able to run arbitrary payloads, not just a fixed list of payloads that we’ve
24:16 Presenter: described earlier. We want to maintain access even if the user that created that gave us the
24:22 Presenter: initial access gets blocked or removed or whatever. We want to make sure that we avoid
24:27 Presenter: detection and attribution and of course leave no logs behind. So let’s see how we can do that.
24:32 Presenter: We’ve already seen a first version of persistency because there’s this HTTP end point. Let’s try
24:39 Presenter: and figure out what does it cover from our laundry list.
24:43 Presenter: So, I’m able to execute things remotely,
24:46 Presenter: that’s pretty obvious, that’s an HTTP endpoint.
24:49 Presenter: This is definitely not an arbitrary payload,
24:51 Presenter: this is a specific payload that I’ve created
24:53 Presenter: and that’s the only one that I’m going to be able to run.
24:57 Presenter: In terms of maintaining access, that’s covered here
25:01 Presenter: because that HTTP endpoint comes built in with a secret,
25:06 Presenter: So we don’t need to be authenticated in order to call
25:10 Presenter: that HTTP endpoint, again, something that is the same
25:13 Presenter: in every local platform that we’ve observed.
25:15 Presenter: And so I can very easily just call that endpoint
25:17 Presenter: and that’s all the access I need.
25:20 Presenter: Avoiding detection is, again, very easy
25:23 Presenter: because it’s somebody else’s cloud.
25:24 Presenter: You have no security controls there.
25:26 Presenter: Avoiding attribution is also very easy
25:28 Presenter: because that’s an endpoint, you can call it from wherever.
25:32 Presenter: They’re not blocking Tor or anything like that,
25:37 Presenter: And in terms of logs, not really. We’re kind of in a problem here. Those automations
25:44 Presenter: generate a ton of logs. So I’m talking about every single piece of information that goes
25:51 Presenter: through those automations is actually being logged there, including the data itself.
25:56 Presenter: So we need to figure out how do we tackle those two points, the arbitrary payloads
26:00 Presenter: and the logs. Here’s one attempt. We’re just gonna have a single end point. We’re just
26:06 Presenter: But this time we will implement a whole bunch of payloads.
26:09 Presenter: So there we can think in advance about the payloads
26:12 Presenter: that we would like to execute.
26:14 Presenter: So one of them is leaking an entire SharePoint site,
26:18 Presenter: another is encrypting an entire SharePoint site,
26:21 Presenter: executing a SQL on a random database.
26:24 Presenter: All of those things are available through a single endpoint.
26:28 Presenter: Actually I didn’t have, there’s no advancement here, right?
26:32 Presenter: Still no arbitrary payloads and I really haven’t touched
26:35 Presenter: the log thing.
26:36 Presenter: So let’s see how both of these things can get solved.
26:42 Presenter: And for that I’m gonna use a very useful piece of,
26:46 Presenter: of piece of software from those low code platforms
26:50 Presenter: which is the fact that the low code platforms,
26:53 Presenter: the low code platforms themselves provide a way for you
26:57 Presenter: to manage them through low code.
26:59 Presenter: So you can use low code to create new low code applications,
27:04 Presenter: you can trigger them, you can delete them.
27:06 Presenter: sure you’ll see where I’m going with this but I’m going to take you through it anyways.
27:12 Presenter: Um, here’s, here’s what we’re going to do. So I’m going to show you exactly how I cover both,
27:19 Presenter: both logs and the payloads. This is already out there so you can go ahead and use it. Um,
27:26 Presenter: and this tool basically allows you to install this, uh, this back door inside of an organization
27:32 Presenter: and then you remain persistent.
27:35 Presenter: Here’s how it works.
27:37 Presenter: I have a single endpoint, an HTTP endpoint,
27:39 Presenter: and instead of running a specific payload,
27:42 Presenter: it’s running a payload that’s creating a new payload.
27:44 Presenter: So I’m passing through the definition of the automation,
27:48 Presenter: which connections it should use,
27:50 Presenter: and then what this automation does
27:54 Presenter: is creates that new automation and triggers it.
27:58 Presenter: I actually need more than that,
28:02 Presenter: three different things that this covers.
External Reconnaissance & Scanning
28:06 Presenter: One is creating the automation,
28:08 Presenter: the other is deleting the automation,
28:09 Presenter: and another crucial piece is just listing those credentials,
28:13 Presenter: those connections that are laying out there.
28:14 Presenter: So we’ll always be able to use fresh ones.
28:18 Presenter: And of course this completely covers the general payload,
28:23 Presenter: so I can just run whatever I want now.
28:28 Presenter: The, sorry, one more thing that we need to,
28:32 Presenter: one more thing that’s covered here,
28:35 Presenter: and I haven’t actually specifically described it,
28:38 Presenter: is because I can delete the flow after I run it,
28:42 Presenter: all of the logs get deleted as well.
28:45 Presenter: So the logs are actually maintained
28:47 Presenter: as part of the flow itself.
28:49 Presenter: And so by deleting, by executing the flow
28:52 Presenter: and then deleting it, I’m remaining completely, I leave completely no logs behind. So the only
28:58 Presenter: logs that are left are the fact that this flow is running and this can be hidden by basically
29:05 Presenter: saying okay this flow, don’t remember anything about it. Here’s the entire flow, the entire
29:13 Presenter: automation. So again, one HTTP endpoint, three main commands, create an automation and trigger
29:22 Presenter: so I can create new automations with that new connection
29:26 Presenter: and deleting the automation.
29:28 Presenter: Here’s the same thing with the Python wrapper
29:30 Presenter: that makes it easier for you to use it
29:34 Presenter: without going through the UI for Microsoft.
29:36 Presenter: So this is kind of small so let me make sure
29:40 Presenter: that you understand what’s going on here.
29:42 Presenter: I plug in the web hook that I got
29:44 Presenter: from installing this backdoor on Power Platform
29:48 Presenter: and then I create a flow, I trigger it
29:52 Presenter: I delete it all within the comfort of my Python CLI. And this of course is all available
29:58 Presenter: for you to use right now. So I’ll describe briefly what this thing, what you need to
30:04 Presenter: do in order to use this. Basically once you have access to Power Platform you follow a
30:11 Presenter: small guide that I have there that’s about installing that vector that’s basically
30:18 Presenter: uploading that automation that you just see here,
30:20 Presenter: and you get in response the webhook,
30:23 Presenter: and then you can use it.
30:25 Presenter: So, and again, keep in mind, this is far more advanced
30:31 Presenter: than what we’ve seen the threat actor actually do,
30:33 Presenter: and the basic thing that the threat actor did
30:37 Presenter: took defenders six months to find.
30:42 Presenter: So I wonder how much this could take.
30:46 Presenter: Okay, so we’ve seen two subsections right now.
30:51 Presenter: We’ve seen how hackers are living off the land of low code
30:53 Presenter: to create or to run their own malicious operations
30:59 Presenter: based on the local platforms themselves.
31:01 Presenter: We see now you can stay within these local platforms,
31:04 Presenter: remain persistent.
31:05 Presenter: The last thing I want to cover
31:07 Presenter: is how does this look like from the outside?
31:10 Presenter: So, sorry.
31:14 Presenter: So both of the sections before started off when I have some sort of access to the platform.
31:20 Presenter: But actually there’s more going on here. Because business users are creating these applications,
31:27 Presenter: there are common misconfigurations that we can find, that we can look for, and that are
31:32 Presenter: predictable that expose business data outside of the organization. And actually we’ve seen
31:38 Presenter: this with AWS S3 buckets, right, so the default was insecure, every new bucket was public,
31:45 Presenter: and then even though the new, they changed the default, we’re still finding these public S3
31:52 Presenter: buckets today. And so the same, the same thing applies here, but the key difference is that
31:59 Presenter: these are not only developers that are building this, these are business users, so there’s a
32:03 Presenter: lot more of it. We’ll see a couple of examples. The first example is Microsoft, and we’re
32:09 Presenter: Power Pages, which is basically a website that allows you to
32:15 Presenter: authenticate, it allows unauthenticated users to observe the website.
32:20 Presenter: This is being used for vendor management, contractors that come into your office
32:25 Presenter: and that’s an entire application that you create with drag and drop. Of course
32:29 Presenter: there’s a database behind it, there’s a bunch of information there that should
32:32 Presenter: not be available to the vendors and the contractors. Actually about a year ago
32:38 Presenter: the team at AppGuard found that there was an insecure
32:42 Presenter: folder that basically meant that the entire database
32:47 Presenter: behind that application was available to anonymous users.
32:50 Presenter: And this was the default configuration for about a couple
32:54 Presenter: of years.
32:55 Presenter: Now this was a major thing, about 40 million records were
33:00 Presenter: exposed by AppGuard’s estimation and Microsoft has actually
33:04 Presenter: been very quick to change the default.
33:08 Presenter: the default is not everything. So there are still these
33:11 Presenter: applications that were created beforehand and users can always
33:14 Presenter: make mistakes. What we wanted to do here is to try and find out
33:18 Presenter: how many of these mistakes we can find. So how do we do it?
33:23 Presenter: Basically we’re going to scan the internet looking for portals,
33:27 Presenter: these kinds of applications that have, that are exposing
33:30 Presenter: business sensitive data without any authentication and here’s
Summary & Recommendations
33:33 Presenter: an example and this is actually a real example from a large
33:38 Presenter: services company. You can see that by querying the API I get three different objects that I can
33:44 Presenter: query. One is the default object, it’s not really interesting, it has nothing there. The second
33:49 Presenter: thing is an entity form set which is basically the way to store form submissions. So again,
33:55 Presenter: not really interesting. But the third part, global variables is kind of interesting. And of
34:01 Presenter: course when we look into these global variables what we found was authentication tokens for
34:08 Presenter: that were being used by the application itself.
34:10 Presenter: And again, this is available to anonymous users.
34:14 Presenter: We browse it through Tor.
34:16 Presenter: So very, very, very, and the crucial part here
34:20 Presenter: is that it’s very easy to find.
34:22 Presenter: So why is it easy to find?
34:23 Presenter: Because it’s all in the same subdomain.
34:26 Presenter: So every one of those applications is in this subdomain
34:30 Presenter: and the endpoint, the API endpoint,
34:32 Presenter: is always the same as well.
34:34 Presenter: So of course we can do kind of subdomain enumeration here.
34:38 Presenter: lazy way to do self domain enumeration, we just use Bing,
34:42 Presenter: and Bing because this is Microsoft so it works.
34:44 Presenter: So you’re seeing about 60,000 different portals
34:48 Presenter: that are available out there.
34:49 Presenter: And we have actually been going out to people
34:54 Presenter: and trying to help them make sure that they are able
34:57 Presenter: to kind of solve this issue.
35:00 Presenter: Here are the examples of what we found.
35:02 Presenter: So lots of, woo, nice.
35:09 Presenter: secrets, API keys, authentication tokens and lots of business data. So PDFs, pictures of
35:17 Presenter: recipes, of receipts, so a whole bunch of business data. So again, this was a case where there’s
35:25 Presenter: a misconfiguration that is very predictable and it’s very easy to scan for it. Let’s see
35:31 Presenter: another example. This time we’ll focus on Zapier. Zapier is a tool that users, business users
35:38 Presenter: are bringing into the enterprise themselves.
35:40 Presenter: And Zapier is again an automation tool,
35:42 Presenter: you can drag and drop and you create automations.
35:45 Presenter: Zapier has a nice feature called storage by Zapier.
35:50 Presenter: Basically, what this means is that if you need to store
35:53 Presenter: some sort of state for your automation
35:56 Presenter: or you need to store secrets for it to operate,
35:59 Presenter: then you can use this storage and the way that it’s protected
36:03 Presenter: is that you need to choose a GUID, some sort of GUID
36:08 Presenter: that’s a key value store, you get your, uh, your secret back. Now, as you can see, I mean GUID
36:14 Presenter: are, GUIDs are not the best but it’s still kind of difficult to guess. When we’ve observed the,
36:20 Presenter: kind of the, the API documentation, you can actually see that the, the example that they
36:25 Presenter: provide is secret equals one, two, three, four, five. This is definitely not a GUID. So, we
36:33 Presenter: are curious, the first thing that we try to do is kind of just try a random secret and that’s
36:39 Presenter: the error that you’re getting if that’s not a good. But actually once you go through what we
36:45 Presenter: actually did is we iterated through a list of known passwords and what we got was that many of
36:51 Presenter: those passwords actually worked. So you’re seeing here examples of things that we found again
36:56 Presenter: authentication tokens, API keys, emails, phone numbers and actually what happened here was that
37:05 Presenter: So up until about two years ago, Zapier was not really
37:09 Presenter: making sure that users were using GUIDs.
37:12 Presenter: They could use whatever they want, and then they started
37:15 Presenter: doing it, but they didn’t block the old secrets.
37:19 Presenter: So you can still use them, and they are still available,
37:21 Presenter: I mean some of them are available today.
37:23 Presenter: We are working with, we have been working with Zapier
37:26 Presenter: to make sure that this is covered, and actually,
37:28 Presenter: the vast majority have already been cleaned up.
37:31 Presenter: Okay, so we’ve seen two examples where platforms allow
37:36 Presenter: a predictable misconfiguration and how from the outside
37:39 Presenter: looking in without having any access we can go ahead
37:42 Presenter: and access business data.
37:44 Presenter: Here’s a summary of everything that we’ve seen up until now.
37:48 Presenter: So we discussed low code, we understand how it’s pervasive
37:54 Presenter: in any enterprise and the fact that it’s built around
37:57 Presenter: business data.
37:58 Presenter: We understand it is kind of underrated by IT and security teams which make it a great
38:02 Presenter: target for attackers. We’re seeing our hackers are taking advantage of it really kind of
38:08 Presenter: all around. So living off the land of low code, for lateral movement, for privilege
38:12 Presenter: escalation, we’ve seen everything. We’ve seen how you can hide within those low code
38:16 Presenter: platforms and use that as a way to persist within an organization. And we’ve seen how
38:20 Presenter: you can use those same platforms and the predictable misconfigurations that they create in order
38:25 Presenter: to find business data. There are two things and actually we’ve also seen two tools that
38:31 Presenter: we’ve released today. One is for Zapier that allows you to find those connections, those
38:37 Presenter: shared connections and the other is the back door that you can install on Power Platform.
38:42 Presenter: So the last thing I want to do is leave you with some tips on how you can secure your
38:48 Presenter: organization, how you can protect yourself.
38:52 Presenter: So here are very, here are specific things
38:55 Presenter: that I really recommend you do quickly.
38:58 Presenter: The first thing is that you need to review configuration.
39:01 Presenter: For example, the bypass consent flag from Microsoft,
39:05 Presenter: make sure that’s off.
39:06 Presenter: There’s also the usage of those connectors,
39:10 Presenter: so make sure that connectors that are administrative,
39:12 Presenter: for example, couldn’t be shared in a default environment.
39:15 Presenter: I recommend that you view those end points,
39:18 Presenter: those external end points,
39:19 Presenter: those platforms are creating for you.
39:22 Presenter: So again, you don’t have to be fully aware of it,
39:25 Presenter: but it’s already there.
39:26 Presenter: The platforms are exposing these end points for you
39:29 Presenter: and you have no easy way to monitor them.
39:33 Presenter: The number one thing that you should take out of this talk
39:36 Presenter: is go through those shared connections.
39:38 Presenter: Go to those different environments,
39:39 Presenter: see what users have built.
39:42 Presenter: You’ll be surprised.
39:45 Presenter: that you can use here.
39:48 Presenter: There’s an OWASP that is dedicated to low code, no code
39:50 Presenter: that would help you figure out what are the different risks
39:53 Presenter: that are around the space.
39:54 Presenter: And there’s a whole bunch of articles there
39:56 Presenter: that could help you.
39:58 Presenter: So thank you everyone for, thank you very much for your time.
40:02 Presenter: It’s been fun.