OWASP Global AppSec Dublin 2023 · 2023/02
Credential Sharing as a Service: the Dark Side of No Code
Abstract
Why focus on heavily guarded crown jewels when you can dominate an organization through its shadow IT? Low-Code applications have become a reality in the enterprise, with surveys showing that most enterprise apps are now built outside of IT, with lacking security practices. Unsurprisingly, attackers have figured out ways to leverage these platforms for their gain. In this talk, we demonstrate a host of attack techniques found in the wild, where enterprise No-Code platforms are leveraged and abused for every step in the cyber killchain. You will learn how attackers perform an account takeover by making the user simply click a link, move laterally and escalate privileges with zero network traffic, leave behind an untraceable backdoor, and automate data exfiltration, to name a few capabilities. All capabilities will be demonstrated with POCs, and their source code will be shared. Next, we will drop two isolation-breaking vulnerabilities that allow for privilege escalation and cross-tenant access. We will explain how these vulnerabilities were discovered and assess their pre-discovery impact. Finally, we will introduce an open-source recon tool that identifies opportunities for lateral movement and privilege escalation through low-code platforms.
Transcript
AI generated from recording.
Introduction to Low‑Code & No‑Code
00:04 Presenter: So thank you very much for that very generous introduction. Hi everyone. Thank you for spending time with me here today. This is going to be somewhat different, I guess, from most of the talks that you’ve heard so far. The approach is the same, but the subject matter is kind of out there.
00:30 Presenter: The one thing that I will promise is that it’s going to be interesting,
00:34 Presenter: and I hope you learn about new things or get a new perspective.
00:41 Presenter: This talk is focused on low-code, no-code applications.
00:45 Presenter: Before I dive into what those are and what are we specifically going to see in this talk,
00:52 Presenter: this was already covered, but I’ve been working on the intersection of low-code, no-code,
01:00 Presenter: security for the last four years now.
01:03 Presenter: And most of my work goes to an OS project that we have started about a year ago,
01:11 Presenter: a top 10 for low-code, no-code.
01:12 Presenter: We’ve been very fortunate to have other people join us from Microsoft and Palo Alto
01:18 Presenter: and other companies.
01:20 Presenter: If you’re interested, we are right now looking for contributors.
01:23 Presenter: There’s a meetup in a couple of weeks.
01:26 Presenter: So reach out to me or check out my Twitter.
01:30 Presenter: There’s an invite there.
01:32 Presenter: Okay.
01:33 Presenter: This talk is given, of course, from an attacker’s perspective on low-code, no-code.
01:37 Presenter: But it’s important to note that we’re all for low-code, no-code.
01:42 Presenter: These kind of technologies, putting more power in the hands of business users,
01:46 Presenter: is something that we’ve been trying to do as an industry for, I don’t know, for just too long.
01:52 Presenter: and this is actually happening.
Why Low‑Code Matters in the Enterprise; The Dark Side: Attack Vectors & Real‑World Cases
01:56 Presenter: So businesses are actually building their own apps.
01:58 Presenter: You’ll see that in a moment.
02:00 Presenter: And so the idea behind this, of course,
02:02 Presenter: is to help us as security professionals
02:05 Presenter: and help the business do this in a secure way.
02:09 Presenter: Here’s what we’re going to do today.
02:11 Presenter: We’re going to start with understanding
02:12 Presenter: what low-code, no-code applications are.
02:15 Presenter: And the idea behind it is just to make sure
02:18 Presenter: we are all on the same page.
02:20 Presenter: After that, we’ll go into basically how low-code, no-code is being attacked
02:25 Presenter: or how attackers are using low-code, no-code in the wild.
02:28 Presenter: This is all based on real attacks that we’ve observed in large organizations,
02:34 Presenter: mainly large U.S. enterprises.
02:37 Presenter: We’ll see a whole bunch of attacks living off the land,
02:41 Presenter: other attacks, you’ll see them in a moment.
02:43 Presenter: We’ll, of course, finish off with how to defend yourself
02:46 Presenter: and what you can do to basically take this further as part of your red tier arsenal
02:52 Presenter: and also as part of kind of internal evangelism you can do in your organization.
03:00 Presenter: Let’s start with low-code, no-code.
03:01 Presenter: And before I go to what specifically low-code, no-code is,
03:04 Presenter: the reason why it’s important and maybe the most important slide in this talk is the following one.
03:10 Presenter: This chart represents one organization, one Fortune 500 organization, and you can see the number of low-code, no-code apps developed in that organization within a few years.
03:24 Presenter: This chart is really why this talk is important, why this subject is important, and why we as security professionals must be part of the low-code, no-code conversation.
03:33 Presenter: These numbers are, of course, anonymous, so I won’t tell you the company, but they are real.
03:39 Presenter: not an anomaly. We see this again and again
03:41 Presenter: with large organizations. So the
03:43 Presenter: Fortune 500s would have close to
03:45 Presenter: 100,000 applications and the
03:47 Presenter: smaller organizations, like a few thousand
03:49 Presenter: employees, would have tens of thousands of
03:51 Presenter: these applications. Keep in mind, these
03:53 Presenter: are small applications. You can call them
03:55 Presenter: micro-apps or something like that. They can
03:57 Presenter: be like an if-this-then-then rule
03:59 Presenter: or a small widget application.
04:02 Presenter: But they still have identity.
04:03 Presenter: They still access data.
04:05 Presenter: So they have the same kind of threats.
04:07 Presenter: This, again, is why it’s important.
04:09 Presenter: And the other fact that most of you in this room are probably aware of,
04:14 Presenter: this is, in most cases, not where most of the security professionals spend their time on.
04:22 Presenter: This is not where we focus our time.
04:24 Presenter: We focus on pro-code applications or applications built by developers.
04:29 Presenter: But business users are creating many more applications.
04:33 Presenter: And it’s about time we get involved in that discussion.
04:37 Presenter: Okay, low code, no code, this is basically why it exists.
04:41 Presenter: So the reason why people are using it, of course, IT cannot cover all of the needs of the business.
04:50 Presenter: And business users are really tired of waiting around and they want to solve their own problems.
04:56 Presenter: This is actually not new.
Credential Sharing as a Service – How It Works; Exploiting Default Environments & Lateral Movement
04:57 Presenter: So we’ve had multiple instances of trying to do just that.
05:01 Presenter: And by the way, we’ve also had success.
05:06 Presenter: a great example of empowering
05:08 Presenter: business users, right? This is
05:09 Presenter: probably the one tool I’ve been using
05:12 Presenter: throughout my career, no matter
05:14 Presenter: what I’ve been learning besides
05:16 Presenter: that. But you can
05:18 Presenter: see a technology
05:20 Presenter: that was used in order to
05:22 Presenter: empower business users
05:24 Presenter: across this
05:25 Presenter: vertical, you’ll find that some
05:28 Presenter: of these technologies are also our close friends
05:30 Presenter: as security professionals, for example
05:32 Presenter: macros. We are still having
05:36 Presenter: Today, low-code, no-code is kind of the latest iteration on this trend of empowering business users,
05:43 Presenter: of decentralizing IT, putting more power in the hands of the people that can actually move the business forward.
05:50 Presenter: Low-code, no-code applications, and by the way, I’ll be using low-code and no-code interchangeably here,
05:56 Presenter: and we can go into the Q&A on how those differ or if they differ.
06:04 Presenter: these are a few examples of what low-code and no-code applications are actually doing
06:09 Presenter: so there are automations
06:11 Presenter: for example if I get an email with this thing in subject
06:15 Presenter: then create a ticket in Jira
06:17 Presenter: there are integrations
06:19 Presenter: so integrations or automations
06:21 Presenter: you’ll find typically business applications team or automations teams
06:24 Presenter: that are plugging in SaaS and on-prem and everything together
06:28 Presenter: stitching things together
06:30 Presenter: There are business applications,
06:31 Presenter: mostly to facilitate business processes.
06:33 Presenter: So for example, you want to get reimbursed
06:37 Presenter: for expenses you make on this trip.
06:40 Presenter: You’ll have a mini-app that would allow you
06:42 Presenter: to upload those receipts and get those returns.
06:46 Presenter: There are entire products that are built
06:48 Presenter: with low-code, no-code.
06:49 Presenter: This is relatively new, but it is happening.
06:51 Presenter: So people are creating startups
06:53 Presenter: with low-code, no-code as their front-end.
06:55 Presenter: Enterprises are building user-facing,
06:59 Presenter: applications with low-code and no-code, which is really cool.
07:02 Presenter: And of course, mobile apps as well.
07:04 Presenter: There are really, you can really do anything with this.
07:09 Presenter: And this technology is right at the stage right now where, A, it’s been actually been
07:14 Presenter: used by these enterprises for many years now.
07:17 Presenter: So for three, not many years, but for two, three years now.
07:21 Presenter: And some of these applications have become business critical, which is why we’re having
07:25 Presenter: this talk right now.
07:26 Presenter: because, of course, it means that attackers are looking at them,
Persistency & Automation in the Cloud; Defending Against Low‑Code Threats
07:32 Presenter: and we should be doing that too.
07:37 Presenter: I’m sure one of the questions that you have in your mind right now
07:40 Presenter: is whether this applies to you,
07:42 Presenter: so to you in your specific organization with the tools that you’re using.
07:47 Presenter: And one of the things I wanted to tell you today is that it probably does.
07:53 Presenter: Even if you don’t know it, it probably does.
07:56 Presenter: The reason behind it is that low-code, no-code finds its way into an enterprise, into an organization in multiple ways.
08:03 Presenter: Of course, there are some organizations that are going all in on low-code, no-code.
08:08 Presenter: The CIO or somebody in digital transformation would say, this is what we’re going to do.
08:13 Presenter: And we’re seeing this in multiple organizations.
08:15 Presenter: But for the rest of us, if you’re using any one of the services here on this slide or any other major SaaS vendor,
08:23 Presenter: you have low-code, no-code already in your organizations.
08:26 Presenter: Because these vendors are basically using low-code, no-code as a way to expand from something that is solving a specific need to an application development platform.
08:37 Presenter: So consider Salesforce, for example.
08:39 Presenter: Once upon a time, you could be thinking about Salesforce as a CRM.
08:43 Presenter: Today, that’s nonsense.
08:44 Presenter: Salesforce is a cloud.
08:46 Presenter: It’s just a business cloud with different kinds of applications, but it’s closer to AWS, Azure, and GCP than it is to a CRM.
08:56 Presenter: And that’s the main point here.
08:58 Presenter: You see, if you’re a Microsoft job, you have a large low-code, no-code platform already embedded.
09:04 Presenter: People are, I promise you, people are using it.
09:06 Presenter: And others as well.
09:08 Presenter: And so this is really everyone’s problem.
09:13 Presenter: So a quick recap before we move forward.
09:16 Presenter: This is, so low-code, no-code.
09:19 Presenter: A is available on every major enterprise.
09:21 Presenter: It has access to business data and business processes.
09:24 Presenter: is, well, the reason behind that is that when you looked at the logos before in this slide,
09:31 Presenter: these logos also have our data, right?
09:35 Presenter: They also have the sensitive business data.
09:37 Presenter: And so local and local applications are built on top of that sensitive data.
09:42 Presenter: They run as SaaS, so this means that forget about VM monitoring or network monitoring
09:48 Presenter: or any of those.
09:50 Presenter: and to my point earlier, they are underrated by IT and security in most cases.
09:56 Presenter: And this is kind of the premise of why we believe it’s important for us to get involved right now.
10:06 Presenter: So what I’m going to show you, so we’ve gone through the kind of low code in a nutshell.
10:13 Presenter: We understand what we’re talking about right now.
10:16 Presenter: The next part, the meat of the talk, is going to be actually talking about specific attacks that we’ve seen in the wild.
10:23 Presenter: If you’re interested, I’m not going to tell you how to detect those attacks.
10:28 Presenter: If you’re interested in that, check out the OWASP project.
10:32 Presenter: So OWASP, low-code, no-code, top 10.
10:35 Presenter: Before we move to see specific attacks, what I would like to do is show you a concrete example of a low-code application or a no-code application.
10:46 Presenter: And I’m going to create it just so you can see how easy it is
10:49 Presenter: and so we all understand the same thing.
10:53 Presenter: So hopefully this works.
10:57 Presenter: Okay, there’s this annoying thing in Slack
11:00 Presenter: where when somebody mentions you on a public channel,
11:04 Presenter: you get this pressure to respond quickly because people are seeing.
11:08 Presenter: So I’m creating here a very small automation that does a simple thing.
11:12 Presenter: it every time I get mentioned in Slack, it will change my status as if I’m on a call.
Q&A & Takeaways — Part 1
11:18 Presenter: So the person will kind of know not to bother me.
11:21 Presenter: And then a few minutes later, it’s going to change my status back to be free.
11:25 Presenter: So nobody would be suspicious.
11:27 Presenter: And you can see that I’m doing this step by step.
11:30 Presenter: This is, of course, a silly example.
11:32 Presenter: But it shows you the power of what’s actually happening here.
11:35 Presenter: One thing to note is that in no way in this demonstration,
11:40 Presenter: I’m not authenticated to Slack in any way.
11:43 Presenter: We’ll cover that in a moment.
11:45 Presenter: But you can see that I’m dragging and dropping.
11:47 Presenter: I’m choosing parameters, kind of like, for example, the status code that I’m on a call.
11:55 Presenter: This is something that is kind of really easy to do.
11:58 Presenter: And the interesting thing behind it, think about, so you’ll see in a moment, okay, I’m done.
12:05 Presenter: When I’ll be done, I’ll click on that publish button, and that’s it.
12:09 Presenter: and operating.
12:12 Presenter: A few things to note here.
12:14 Presenter: One is that this is a pretty complex piece of software.
12:19 Presenter: It authenticates to Slack.
12:21 Presenter: It needs to somehow maintain that secret.
12:24 Presenter: Maybe it needs to roll it.
12:25 Presenter: It needs to subscribe to Webhook on the Slack side.
12:28 Presenter: It needs to support APIs and their changes.
12:31 Presenter: There’s a delay step because you need to wait five minutes
12:34 Presenter: before I change between status changes.
12:39 Presenter: So it needs to be kind of running somewhere.
12:42 Presenter: This is a significant piece of software.
12:45 Presenter: And you’ll see in 30 seconds it will already be ready.
12:50 Presenter: And I didn’t do anything sophisticated there as a user.
12:53 Presenter: This is specifically an example from Zapier,
12:56 Presenter: which is a tool that is focused on actual end users.
12:59 Presenter: And people are using this.
13:01 Presenter: People are using this a lot.
13:02 Presenter: And this is also why you get so many applications,
13:06 Presenter: just because it’s very easy to create them.
13:09 Presenter: I was alluding to the authentication part here.
13:14 Presenter: One thing that you should be asking yourself is how is this thing running?
13:18 Presenter: What is the identity behind this application?
13:21 Presenter: When it connects to the Slack API, either through the webhook or through the API later,
13:27 Presenter: who’s actually making those calls?
13:29 Presenter: And so here’s the answer.
13:35 Presenter: when you create this application
13:37 Presenter: the first thing that you need to do is to pick
13:40 Presenter: an application you want, so inside of Zapier
13:42 Presenter: you need to pick the application you want to work with, for example here is Slack
13:45 Presenter: but in all of those platforms there are hundreds of connectors
13:49 Presenter: that connect wherever you’d like, it could be SAS,
13:52 Presenter: on-prem, through gateways, wherever you’d like really
13:55 Presenter: and then the first thing you’re going to do after you click on one of them
13:59 Presenter: is you’re going to connect.
14:00 Presenter: And this will be a familiar OAuth experience.
14:02 Presenter: So you get the OAuth pop-up.
14:04 Presenter: You see a bunch of things that Zapier wants to do with your Slack account.
14:08 Presenter: You say allow.
14:09 Presenter: And something magical happens.
14:12 Presenter: They create an object called a connection.
14:15 Presenter: This connection is essentially a wrapper around the OAuth refresh tokens.
14:21 Presenter: What they also give you for that connection is a nice little share button.
14:25 Presenter: What does this share mean?
14:29 Presenter: your wrapped up refresh token with another user.
14:33 Presenter: And that’s how these platforms operate.
14:36 Presenter: This also means that from the Slack perspective,
14:40 Presenter: from the network perspective,
14:41 Presenter: from all of the existing tools that you have,
14:44 Presenter: from all of those perspectives,
14:45 Presenter: there’s no app.
14:47 Presenter: There’s no share.
14:48 Presenter: This is one user reusing their token again and again
14:51 Presenter: from multiple locations.
14:53 Presenter: This is a fundamental flaw in the way
14:56 Presenter: that this technology works.
14:59 Presenter: across platforms. And by the way, the reason behind it is that this is not only
15:03 Presenter: a flaw, it’s also one of the reasons why this works.
15:07 Presenter: Imagine if you wanted to have this graph of so many applications
15:11 Presenter: built in the enterprise, but you had to ask for
15:15 Presenter: permission for each one of these applications to create an identity for that application.
15:19 Presenter: That would never happen. You’ll never see that exponential graph. The reason
15:23 Presenter: why you have that exponential graph is because you can embed your own identity in those applications.
15:29 Presenter: part and the bad part about it.
15:30 Presenter: But it also shows you
15:32 Presenter: why I was able to create this application
15:34 Presenter: before in the demo. I just
15:36 Presenter: created this connection beforehand
15:38 Presenter: or I could have just picked up that connection
15:41 Presenter: that another user created
15:42 Presenter: and just reused it.
15:44 Presenter: Okay.
15:46 Presenter: This is actually…
15:48 Presenter: I’ve kind of explained this, but just to make sure
15:51 Presenter: we all understand, when
15:52 Presenter: we have the application on the
15:55 Presenter: left side and the API on the right
15:56 Presenter: side, and essentially
15:59 Presenter: and this is actually a picture from Microsoft documentation,
16:04 Presenter: there’s basically a proxy that sits between those two,
16:08 Presenter: and it dynamically changes the token
16:11 Presenter: when the request goes to the underlying service.
16:15 Presenter: And so they are able to inject the token, the refresh token,
16:18 Presenter: so the user never sees the actual token.
16:21 Presenter: They don’t understand that they’re sharing a token.
16:22 Presenter: They’re sharing something called connection.
16:24 Presenter: It looks nice.
16:25 Presenter: There’s a nice little button then to share.
16:29 Presenter: So this is how it works.
16:30 Presenter: And when you look at these platforms,
16:35 Presenter: because it’s so easy to create applications,
16:37 Presenter: you get a lot of applications.
16:39 Presenter: These are specific examples from marketplaces of different vendors.
16:44 Presenter: So these are all things that people are just picking up and using.
16:48 Presenter: And you can see the most important thing about this slide
16:51 Presenter: is actually the logos,
16:52 Presenter: because they indicate where the data comes from,
16:55 Presenter: what data these applications are touching.
16:59 Presenter: Behind any one of those logos, there’s business data or there are business operations.
17:04 Presenter: And so behind the tens of thousands of applications that you saw earlier in the chart,
17:12 Presenter: there are at least 10x more connections.
17:17 Presenter: Connections are refresh tokens that are just there on the platforms.
17:20 Presenter: And so when you go to these platforms and you kind of look for those connections,
17:26 Presenter: you’ll find hundreds of those connections.
17:29 Presenter: of the things that is common about these platforms is that they have some notion of a default
17:34 Presenter: environment, a way for you to share those connections, not only with one user, but with
17:40 Presenter: everyone, with everyone in the organization.
17:42 Presenter: And again, there’s a reason behind it, because you want to empower people, you want to let
17:46 Presenter: them work fast.
17:47 Presenter: And so if you go to the default environment in your Office 365 instance, in Zapier, in
17:53 Presenter: Workato, and in others, you’ll find all of those connections ready for you to use.
17:56 Presenter: And so, of course, this is just credential sharing as a service.
18:00 Presenter: This is just built-in credential service being facilitated by those platforms.
18:06 Presenter: And for us to identify that, there’s no real way to do it through network mechanisms
18:11 Presenter: or through monitoring the authentication itself.
18:15 Presenter: It’s only through those platforms.
Q&A & Takeaways — Part 2
18:19 Presenter: So this is one thing that is very common.
18:21 Presenter: So we see attackers using these default environments to just gain all of those credentials.
18:27 Presenter: After you just get access to those credentials, the next piece is, okay, what do you do with them?
18:32 Presenter: Well, so you can do easy things like ransomware, for example, with a drag and drop.
18:37 Presenter: This is very easy.
18:39 Presenter: So I go to a specific SharePoint site.
18:42 Presenter: I list everything in that SharePoint site.
18:44 Presenter: And I encrypt it with a useful encryption function that is provided by the platform.
18:49 Presenter: Okay.
18:51 Presenter: This is not a one-time thing.
18:53 Presenter: I can do this.
18:54 Presenter: This continues to run.
18:57 Presenter: So this is one kind of nice example.
19:00 Presenter: The other example where we, and this one, I think there was,
19:04 Presenter: in any organization that we’ve worked with, this one reoccurred.
19:08 Presenter: This is a great way to expel data outside of organizations, right?
19:13 Presenter: Because you have, for example, to make sure people are not forwarding business email
19:18 Presenter: to their personal Gmail, you have a bunch of things that are preventing that, right?
19:23 Presenter: You have things on the client side and on the email server and DLP and many things.
19:28 Presenter: So people have found out a new way to bypass DLP.
19:31 Presenter: They simply copy the content of the email from one email to another.
19:35 Presenter: So the automation is subscribed to every new corporate email.
19:40 Presenter: And then when it arrives, they create a draft on their own personal Gmail account with that email.
19:45 Presenter: And so there’s no real way to know that, again, from the email server,
19:51 Presenter: because the content here is being copied.
19:53 Presenter: And of course, this is one example with emails,
19:55 Presenter: but this happens with files and drives and everything else.
20:01 Presenter: So that’s, again, that’s a very, very, very common example.
20:05 Presenter: Let me go into another one, which is a bit less trivial.
20:09 Presenter: These platforms also allow you to jump to people’s laptops.
20:12 Presenter: and this is because low code, no code
20:15 Presenter: also has a component called RPA.
20:18 Presenter: In some cases, it’s kind of a different thing
20:20 Presenter: but still RPA is an automation that runs
20:23 Presenter: either on servers or on people’s laptops
20:25 Presenter: like an exe file on the Windows machine.
20:29 Presenter: So some of those connections actually allow you
20:32 Presenter: to run a command,
20:34 Presenter: so any command you’d like on somebody’s laptop
20:38 Presenter: and you can use it, again, pick it up
20:39 Presenter: and use it from the default environment
20:42 Presenter: laterally to the machine.
20:45 Presenter: So this is actually one of the major things that we see again and again
20:51 Presenter: happening with these overshort connections.
20:54 Presenter: And one of the things that we did internally when we worked on this is to
20:59 Presenter: make our lives easier and find these connections is just create some tooling
21:03 Presenter: behind it.
21:04 Presenter: So one thing that we have here is a tool called Zapcreds.
21:08 Presenter: This is a very simple tool.
21:10 Presenter: You can find it at this address.
21:12 Presenter: you plug in a user for Zapier,
21:16 Presenter: and it will give you all of the connections
21:17 Presenter: that that user has access to,
21:19 Presenter: and also show you which of those connections
21:22 Presenter: belong to other users.
21:23 Presenter: And we’re actually expanding this
21:25 Presenter: to support other platforms as well,
21:26 Presenter: Workator, Power Platform, and many others.
21:30 Presenter: So feel free to check this out.
21:35 Presenter: One thing that happened now,
21:38 Presenter: we saw only cases where the connections
21:40 Presenter: were already available,
21:42 Presenter: we want to entice users to create connections? What if we want to create basically a targeted
21:48 Presenter: attack within an organization to get users to log in, to share those connections with us?
21:55 Presenter: So what I’m going to show you is exactly that. Basically, these applications that are built on
22:02 Presenter: top of low-code, no-code, one of the key things behind them is that they operate on the vendor’s
22:08 Presenter: cloud. And so for example, you can use
22:10 Presenter: Office 365 local platform
22:12 Presenter: which allows you to create applications
22:14 Presenter: in a Microsoft domain.
22:16 Presenter: So they’ll be trusted by your
22:18 Presenter: users. And the users will
22:20 Presenter: automatically be authenticated
22:22 Presenter: with their Microsoft accounts.
22:23 Presenter: So here’s a nice little app.
22:26 Presenter: I’m going to
22:28 Presenter: pick up an
22:30 Presenter: application out of the
22:31 Presenter: marketplace.
22:34 Presenter: This is going to be an application
22:36 Presenter: that basically facilitates
22:39 Presenter: an out-of-office.
22:40 Presenter: So it says your out-of-office message,
22:43 Presenter: it declines invites and so on.
22:45 Presenter: And so I’m just picking it up out of the marketplace
22:49 Presenter: and I’m going to apply one simple change
22:52 Presenter: where that application, of course,
22:55 Presenter: has access to user emails, right?
22:57 Presenter: So I’m going to apply one simple change
22:59 Presenter: which is using that email to pawn the account.
23:01 Presenter: To basically, in this example,
23:03 Presenter: just share an email,
23:06 Presenter: use the user’s email on their behalf without them knowing.
23:10 Presenter: Again, this is just a simple application I took off the marketplace.
23:15 Presenter: And what I’m doing here, every application could do that.
23:18 Presenter: When an application has access to a user’s credentials,
23:21 Presenter: it can use it for whatever it wants without the user knowing.
23:26 Presenter: And you can see here exactly what I’m doing to add that kind of malicious line.
23:31 Presenter: It’s one line of code.
23:33 Presenter: The crucial piece here is that this is very simple to do.
23:37 Presenter: This is running on a Microsoft domain,
23:43 Presenter: and this is something that users would automatically trust.
23:47 Presenter: Now, okay, it takes me some time to type.
23:50 Presenter: So after I create that application, I embed my malicious line in it.
23:56 Presenter: I save it.
23:57 Presenter: That’s it.
23:57 Presenter: It’s deployed.
23:58 Presenter: So there’s no, like, CICD, pull request, somebody looking at this.
24:03 Presenter: Nothing like that.
24:04 Presenter: I share it, and you can see that I’m sharing it with everybody in the organization,
24:09 Presenter: which is a nice little feature to have.
24:12 Presenter: And then I get this URL that I’m going to plug in here with another user.
24:18 Presenter: When I use that user to log into the app,
24:20 Presenter: the first thing that I get is asked for credentials.
24:23 Presenter: We’ll go into that in a moment.
24:25 Presenter: And that’s it.
24:26 Presenter: I’m inside of the application.
24:28 Presenter: and, of course, the application has sent an email on my behalf, as I’ve just shown.
24:34 Presenter: So this might have been a bit confusing,
24:37 Presenter: so let me take you step by step on what happened here again.
24:40 Presenter: I picked up a random application from Microsoft’s Marketplace.
24:44 Presenter: That application required access to email.
24:47 Presenter: So I used that email, other than just to do what the application is doing,
24:52 Presenter: to send an email on the user’s behalf without them knowing.
24:55 Presenter: Now, when I created, I saved that application,
24:58 Presenter: which means it’s deployed,
25:00 Presenter: which means I get a URL on a Microsoft domain
25:03 Presenter: that every user in my organization can use.
25:07 Presenter: And now when I use it with another user,
25:10 Presenter: the application created, sent out that email on the user’s behalf.
Q&A & Takeaways — Part 3
25:16 Presenter: So again, this is not special to local and local applications, right?
25:20 Presenter: Every application could use a user’s credential to do whatever it wants.
25:24 Presenter: There is a difference, and the difference is in the way that these applications get access.
25:29 Presenter: This window that we saw when the user entered the application is not the typical OAuth window you’re used to seeing, right?
25:38 Presenter: This is not telling you what permissions the application needs and asking you to make sure that you’re giving it the right permissions.
25:45 Presenter: No, it’s just telling you, hey, I need a connection to Office 365 and to Office 365 users.
25:50 Presenter: These connections are, again, those refresh tokens that we’ve discussed earlier.
25:54 Presenter: And so this is an unbounded permission.
25:59 Presenter: This has all of the permissions that Power Platform could ever want.
26:03 Presenter: And so when I created that connection, so if you examine the token,
26:09 Presenter: you’ll see that it has basically all of the available permission set.
26:13 Presenter: And so once I click allow here, the application gets my refresh token,
26:18 Presenter: and it is able to do whatever it wants with my office credentials.
26:24 Presenter: Now, the title here is interesting because what I’ve basically done here is created a way for us to bait users,
26:35 Presenter: to give us their credentials inside of an organization.
26:38 Presenter: And the only thing that protects them from falling in my trap is clicking that allow button.
26:45 Presenter: So they go into a URL, which I provide, which is in a Microsoft domain, and then they click the allow button and that’s it.
26:54 Presenter: button, that would be terrible, right?
26:57 Presenter: Well, that’s also available as part of the platform.
27:02 Presenter: So this is actually a flag that admins can just turn on, which
27:07 Presenter: removes this window, removes friction from adoption of those
27:11 Presenter: applications, but also makes it so that the only thing I need to
27:15 Presenter: do in order to own a user’s account is just to get them to
27:18 Presenter: click on an email, on the URL that is in a Microsoft domain.
27:23 Presenter: okay so we saw
27:26 Presenter: living of the land attacks for lateral movement
27:29 Presenter: for privilege escalation for ransomware
27:33 Presenter: and for account takeover the next part
27:37 Presenter: and by the way these are just specific
27:41 Presenter: examples but there are many more you understand the gist here
27:43 Presenter: people are just using this to pick off credentials and
27:46 Presenter: be able to move across the organizations very easily
27:51 Presenter: is how do you stay once you’ve owned a local, no-call platform,
27:57 Presenter: how do you stay there as an attacker?
27:59 Presenter: And in this section, what I’m actually going to do
28:02 Presenter: is just show you what hackers have already been doing.
28:07 Presenter: This is a real example from an APT group about two years ago.
28:13 Presenter: This slide is from Microsoft Detection and Response Team.
28:16 Presenter: The APT group owned a large multinational organization.
28:21 Presenter: They knew that they have been hacked and they had teams looking for the hackers in the org for more than six months before they were able to kick them out.
28:33 Presenter: And the reason why it took so long is that instead of installing malware, moving through the network, doing the things that hackers usually do,
28:42 Presenter: they created an automation, a low-code automation that was used as their persistency mechanism.
28:51 Presenter: they created one single automation that ran on a schedule.
28:56 Presenter: Each time it ran, it used the e-discovery tools to search for passwords and PII across the office infrastructure
29:04 Presenter: and then send it off to an exfiltration endpoint.
29:07 Presenter: And because this runs on the office cloud in an area that nobody monitors, that nobody looks at,
29:13 Presenter: this was running for six months.
29:16 Presenter: And so you can find all of the sources in this link of why this happened
29:22 Presenter: There are bits and pieces of information out there.
29:27 Presenter: So let’s start with just doing what the attackers have done.
29:30 Presenter: This is a very simple automation.
29:32 Presenter: On a recurrent schedule, I’m going to list a SharePoint directory,
29:37 Presenter: and then I’m going to encrypt any one of those files,
29:43 Presenter: to dump the encrypted files somewhere,
29:46 Presenter: and tweet about it because nobody will find me anyway.
29:51 Presenter: attackers have done, but this is actually
29:54 Presenter: kind of
29:55 Presenter: this runs on a schedule, so this is
29:57 Presenter: limited. I want more than that.
29:59 Presenter: So here’s one
30:01 Presenter: step better. This
30:03 Presenter: is the same kind of automation, but
30:05 Presenter: instead of running on a schedule, it runs
30:07 Presenter: off a call to a webhook.
30:09 Presenter: So now from the outside in, I can
30:11 Presenter: just call that webhook, and every time I do
30:13 Presenter: that, I’ll exfiltrate the entire SharePoint
30:15 Presenter: site, which is nice.
30:18 Presenter: But if we’re talking about
30:19 Presenter: persistency, we actually need much more. So here’s a laundry list
30:23 Presenter: of the things we might want when talking about persistency.
30:27 Presenter: We want to be able to execute things remotely. We want to be
30:31 Presenter: able to run arbitrary payloads, which is not something we’ve seen so far.
30:35 Presenter: We want to be able to maintain access even if the user itself
30:39 Presenter: is no longer accessible. Of course, we want to avoid detection
30:43 Presenter: and avoid attribution in case we get detected, and we want to produce no logs.
30:47 Presenter: So let’s see how we can accomplish all of this with a non-code app.
30:52 Presenter: So this is actually what we’ve already seen.
30:54 Presenter: This HTTP hook is the persistency because we can just continue to call it,
30:59 Presenter: even if we don’t have the access as a user.
31:02 Presenter: These HTTP endpoints in all of the platforms that we’ve examined
31:06 Presenter: are hardcoding some sort of secret in the URL,
31:09 Presenter: and so you don’t have to be authenticated in order to call them.
31:14 Presenter: so here’s an examination
31:16 Presenter: of what we wanted to achieve
31:19 Presenter: there’s a remote execution here, that’s fine
31:21 Presenter: of course this is not an arbitrary payload, this is specific payload
31:24 Presenter: of dumping an entire SharePoint site
31:27 Presenter: being able to maintain access, I’ve already discussed this
31:30 Presenter: avoiding detection
31:31 Presenter: I mean, this is pretty
31:34 Presenter: I mean, in order to understand who is calling this endpoint
31:38 Presenter: you need to be able to monitor those logs
31:42 Presenter: those logs do not exist.
31:43 Presenter: And more than that, you cannot attribute it
31:47 Presenter: because those endpoints can be called from wherever.
31:49 Presenter: In this demo specifically, I’m calling them using Tor.
31:54 Presenter: Okay.
31:55 Presenter: So logs, the last thing that I wanted to do,
31:59 Presenter: I didn’t really cover it up until now.
32:03 Presenter: So these automations are generating a ton of logs.
32:07 Presenter: By logs, I mean every time you plug in data
32:12 Presenter: the data gets stored as part of the log.
Q&A & Takeaways — Part 4
32:14 Presenter: So this is very, very, very noisy,
32:16 Presenter: and this is something we’re going to need to take care of.
32:19 Presenter: So here’s another attempt.
32:21 Presenter: Instead of hardcoding one payload,
32:24 Presenter: I’m going to hardcode a few of them.
32:26 Presenter: So here are a few useful functions.
32:28 Presenter: Licking an entire SharePoint site,
32:31 Presenter: storing attachments from Outlook.com,
32:34 Presenter: executing a SQL query,
32:37 Presenter: creating ransomware,
32:39 Presenter: basically encrypting an entire SharePoint site,
32:42 Presenter: So these are all specific payloads, and all of them can be called from a single HTTP endpoint, which is nice.
32:50 Presenter: And so for examining our list, actually, we haven’t covered both of the things that we wanted to cover,
32:59 Presenter: both arbitrary payloads.
33:01 Presenter: This is more than one, but it’s still not arbitrary, and there are still logs.
33:04 Presenter: So let’s see how we can cover both of these.
33:08 Presenter: and we’re going to cover these with one little feature, which is awesome.
33:16 Presenter: And that is the fact that in all of the low-code, low-code platforms,
33:20 Presenter: one of their key features is that you can automate the platform itself
33:23 Presenter: with low-code, low-code applications.
33:25 Presenter: And so you have something called, for Microsoft, for example,
33:29 Presenter: you have something called Power Automate Management,
33:31 Presenter: which allows you to create, delete, change,
33:36 Presenter: do whatever you want with the low-code, no-code applications
33:38 Presenter: as a low-code, no-code application.
33:40 Presenter: Okay, so you probably see where I’m going with this,
33:43 Presenter: but I’ll take you through it anyway.
33:46 Presenter: So here’s what we’re going to see right now.
33:49 Presenter: It’s also available.
33:50 Presenter: The source code is available in this address.
33:54 Presenter: It’s called Powerful,
33:55 Presenter: which is kind of a pun over the Microsoft framework.
33:58 Presenter: and this is going to solve all of our persistency problems.
34:03 Presenter: And it’s going to be pretty easy.
34:06 Presenter: So I’m going to start off with an HTTP endpoint,
34:09 Presenter: but instead of just using it as a trigger,
34:13 Presenter: I’m going to accept a definition of an automation.
34:16 Presenter: So just tell me what automation you want to build,
34:19 Presenter: with which connection you want this automation to be built,
34:23 Presenter: and then what this automation is going to do
34:25 Presenter: is create that other automation
34:27 Presenter: that I’ve just given it,
34:29 Presenter: run it,
34:30 Presenter: and then delete it
34:31 Presenter: all at the same time
34:32 Presenter: or kind of
34:33 Presenter: all in a very short period of time.
34:36 Presenter: And so I create the automation,
34:38 Presenter: I give it a definition,
34:39 Presenter: I can choose the specific connections,
34:41 Presenter: I can list which connections are available
34:44 Presenter: so I can always be using fresh connections.
34:47 Presenter: And then I delete the automation.
34:49 Presenter: And the nice part about deleting the automation
34:51 Presenter: is that this also deletes
34:53 Presenter: all of the logs of the automation
34:55 Presenter: part of the automation itself, which is also pretty nice.
35:00 Presenter: This is the flow of what the tool is actually doing,
35:04 Presenter: and this is how the kind of very sophisticated automation looks like.
35:08 Presenter: Again, you can see this is all drag and drop,
35:11 Presenter: but this is kind of the advanced part of the drag and drop.
35:14 Presenter: And of course, because we are security professionals,
35:18 Presenter: we don’t want to drag and drop things, and we want to look cool.
35:22 Presenter: Here’s a CLI for you to do that with Python.
35:26 Presenter: Okay. So this was kind of expanding beyond what hackers have actually done.
35:35 Presenter: But recall that the basis here was something that we’ve observed in the world.
35:41 Presenter: So the APT group has used this as a way to maintain their persistency inside of an organization.
35:47 Presenter: And it took the organization six months to find them there.
35:51 Presenter: So imagine what would happen with something like this.
35:56 Presenter: Okay, so we’ve seen how to basically stay hidden within those local, no-code platforms.
36:02 Presenter: The last thing I want to show you is how you can exploit local, no-code platforms from the outside looking in.
36:12 Presenter: Because up until now, we’ve been discussing what users of those platforms can do.
36:18 Presenter: So you need to first own some user, which is admittedly not that difficult in a large organization.
36:24 Presenter: But still, these platforms also allow,
36:27 Presenter: we are also seeing hackers that are targeting
36:30 Presenter: basically public endpoints
36:32 Presenter: that these platforms are putting out on your behalf.
36:36 Presenter: So let’s see a few examples.
36:38 Presenter: Before I give you a few examples,
36:40 Presenter: let’s just think, let’s just recall
36:42 Presenter: that this is again not something
36:45 Presenter: that is special to low-code, no-code.
36:47 Presenter: If you think about S3 buckets, for example, in AWS,
36:51 Presenter: This is like a misconfiguration that we know that happens again and again
36:55 Presenter: where those S3 buckets are exposed to the public.
36:57 Presenter: We’ve known about it for many years now.
37:00 Presenter: AWS has finally put in place things that are preventing it as a default.
37:05 Presenter: But it’s still happening, right?
37:07 Presenter: It’s still happening because it’s a predictable misconfiguration,
37:11 Presenter: which is very easy to do.
37:13 Presenter: So the same kind of thing is happening within those local and local platforms.
37:17 Presenter: Let me give you a couple of examples.
37:20 Presenter: I’m going to give is again about Microsoft.
37:24 Presenter: Microsoft has one of the features
37:27 Presenter: for their local platform on top of Office
37:30 Presenter: is called Portal Apps.
37:32 Presenter: Portal Apps is basically a public-facing application.
37:36 Presenter: It’s used mainly to basically do things
37:39 Presenter: like onboard contractors or vendors
37:42 Presenter: or people that are coming to your office.
37:44 Presenter: For example, if you visit Microsoft offices physically
37:47 Presenter: and you need to provide a vaccination proof,
37:50 Presenter: You’ll do that through a portal app.
37:52 Presenter: And so those portal apps, they are basically web pages
37:55 Presenter: with a managed SQL instance behind them.
37:58 Presenter: And so when you create a portal app,
38:01 Presenter: you get a dedicated web application.
38:03 Presenter: You can see, note the domain name.
38:06 Presenter: So something.powerappsportals.com.
38:09 Presenter: This is going to be fun later.
38:11 Presenter: And so these applications also have an API
38:17 Presenter: that is created for extendability.
38:20 Presenter: something called OData.
38:21 Presenter: It’s always in the same place, so the same path.
38:24 Presenter: And why am I talking about these types of applications?
38:27 Presenter: Well, because the team at AppGuard, actually a year and a half ago,
38:34 Presenter: found that these applications, the default configurations for those applications,
38:39 Presenter: meant that the API exposed all of the database behind the applications to anonymous users.
38:46 Presenter: That was the default.
38:47 Presenter: and nobody noticed that that was the default for about a year until they did.
38:53 Presenter: And so once they did, they identified about 40 million data records that were exposed.
38:59 Presenter: And so Microsoft was actually very quick to fix the default,
39:04 Presenter: but people are still making mistakes because it’s difficult not to make mistakes.
Q&A & Takeaways — Part 5
39:10 Presenter: And so let’s see what we can find out by just trying to find those applications
39:18 Presenter: here’s one concrete application
39:20 Presenter: this is a real world example
39:21 Presenter: you can see that by going to the
39:24 Presenter: OData route
39:25 Presenter: I get a list of all of the
39:29 Presenter: objects that are available
39:30 Presenter: for me to query, the default and the entities
39:32 Presenter: form set objects
39:34 Presenter: don’t have anything interesting
39:35 Presenter: but you’re also seeing
39:38 Presenter: the global variables
39:40 Presenter: object which is interesting
39:42 Presenter: and when you query the
39:44 Presenter: global variables I’m sure you’ll understand
39:48 Presenter: authentication tokens to Azure, which is kind of nice and available for you out there.
39:53 Presenter: This is a real example from a large financial services company.
39:57 Presenter: Of course, we’ve disclosed this vulnerability to them and they’ve fixed it.
40:02 Presenter: And so this is one example, but the question is,
40:06 Presenter: can we find those problems repeatedly from the outside looking in
40:11 Presenter: without knowing that this specific portal exists?
40:14 Presenter: And here’s the clue of how we do it.
40:17 Presenter: very simple subdomain enumeration.
40:19 Presenter: All of these apps are using the same domain.
40:24 Presenter: And so here’s a very lazy way to do subdomain enumeration in a Microsoft product.
40:29 Presenter: You just use Bing.
40:31 Presenter: It works pretty well.
40:33 Presenter: And so you’re seeing the amount of results that we got here.
40:38 Presenter: You’ve seen a few examples before, kind of on the last slide.
40:43 Presenter: but we found a bunch of PII.
40:47 Presenter: We found lots of secrets.
40:50 Presenter: We found a lot of business data,
40:51 Presenter: so PDFs, contracts, vendor lists,
40:56 Presenter: all sorts of business data that was out there.
40:59 Presenter: And of course, we disclosed this,
41:01 Presenter: but this is just an example of a kind of predictable misconfiguration
41:05 Presenter: that can occur, and it’s very, very easy to exploit.
41:11 Presenter: So let me share another example of the same kind.
41:15 Presenter: So this time, instead of just picking on Microsoft, this is Zapier.
41:22 Presenter: Zapier has a nice little service called Storage by Zapier.
41:25 Presenter: Basically, Zapier is an automation platform,
41:28 Presenter: and if you want to maintain any sort of state in your automations,
41:32 Presenter: you need a store, right?
41:34 Presenter: You need something to store that state in.
41:37 Presenter: So they have a key value store,
41:39 Presenter: that which they provide for you and you can use it to hold state or secrets or whatever you’d like
41:46 Presenter: which is pretty nice the way that it gets that it’s protected this key value store is with a
41:52 Presenter: guide so you provide a secret and that secret allows you to do whatever you want with the
41:56 Presenter: key value store with the keys that you that you own and the secret has to be a good which is
42:02 Presenter: I mean, it’s fine.
42:04 Presenter: It’s not perfect, but it’s fine.
42:07 Presenter: Here’s, when we looked at this,
42:09 Presenter: we looked at the actual API documentation,
42:13 Presenter: and you can see when you call the API,
42:15 Presenter: you get a bunch of kind of text,
42:18 Presenter: but you also get examples.
42:20 Presenter: And you can see the examples on the upper right side.
42:25 Presenter: They use secrets that are very much not a good.
42:28 Presenter: So this kind of triggered us.
42:32 Presenter: So we just, actually we just started by plugging in this specific secret that they have in the documentation.
42:39 Presenter: And voila, we found, kind of, we got access.
42:42 Presenter: And so we just did a very simple dictionary attack and was able to uncover that this is not just one example.
42:54 Presenter: There were actually a bunch of those examples.
42:58 Presenter: And those examples, when I mean an example,
43:02 Presenter: it’s basically a secret that revealed the key value store values to us.
43:09 Presenter: By the way, we could have also changed them, deleted them.
43:12 Presenter: And you can see the types of things that we found here.
43:16 Presenter: And actually, working with the Zapier team,
43:18 Presenter: what we’ve discovered is that they indeed today,
43:22 Presenter: they force you to use GUIDs,
43:24 Presenter: But they didn’t used to do that up until two years ago,
43:27 Presenter: and they simply never did anything with the old secrets.
43:30 Presenter: So they are still there.
43:32 Presenter: So you can reuse them, and then you’re not secured.
43:36 Presenter: So, again, this is a very easy example.
43:40 Presenter: You can very quickly enumerate this from the outside looking in.
43:43 Presenter: Imagine the business user that used the secret equals 1, 2, 3, 4, 5.
43:51 Presenter: they don’t really know that it’s insecure
43:54 Presenter: and it’s really not their job to know that.
43:58 Presenter: Okay.
44:00 Presenter: So I’m going to pause for a bit
44:02 Presenter: and let’s do a quick summary of what we’ve seen so far.
44:06 Presenter: We’ve seen that low-code, no-code is huge in the enterprise
44:10 Presenter: and we’ve seen the ways in which it’s a bit underrated by security teams.
44:15 Presenter: We’ve seen the ways that attackers are taking advantage of it
44:20 Presenter: hiding inside of those platforms,
44:22 Presenter: leveraging predictable misconfigurations.
44:25 Presenter: You’ve also seen two tools
44:26 Presenter: that you can use as part of your education process.
44:31 Presenter: There are others.
44:32 Presenter: I encourage you to look at the links.
44:34 Presenter: There’s a link in the last slide
44:35 Presenter: with a bunch of tools that you can use.
44:38 Presenter: And the last thing I’m going to do
44:39 Presenter: before we finish off
44:42 Presenter: is just to give you a few tips on how to stay safe
44:45 Presenter: or what can you do
44:48 Presenter: basically onboard
44:49 Presenter: local NOCAD into your application
44:52 Presenter: security mandate.
44:55 Presenter: So
44:56 Presenter: some of these things here are
44:58 Presenter: very concrete, but others are
44:59 Presenter: more strategic. In terms
45:02 Presenter: of concrete things, you need to review
45:03 Presenter: configurations. So you need to be aware of the
45:05 Presenter: platforms that are being used inside of your organization.
45:08 Presenter: Specifically,
45:09 Presenter: look at the bypass consent flag for
45:11 Presenter: Microsoft, which allows users to create these
45:13 Presenter: beta applications. Look at
45:16 Presenter: and make sure that you’re limiting which connectors can be used.
45:20 Presenter: Monitor those endpoints.
45:22 Presenter: You need to know which external endpoints are being put out by those platforms on your behalf.
45:27 Presenter: Of course, review the shared connections inside organizations.
45:30 Presenter: I can’t tell you how many organizations.
45:32 Presenter: Just start a conversation with them.
45:34 Presenter: The first thing we did is I told them, okay, go to this address,
45:38 Presenter: look at the shared environment,
45:39 Presenter: and we are seeing SQL servers and FTP servers and shared teams, tokens,
45:45 Presenter: and whatever you’d like.
45:47 Presenter: And from a more strategic perspective, check out the OAS Low-Code, No-Code Top 10.
45:52 Presenter: That should give you a framework on how do you think about Low-Code, No-Code,
45:56 Presenter: and how can you take it under the application security umbrella.
46:00 Presenter: Thank you very much.
Q&A & Takeaways — Part 6
46:08 Presenter: Okay, Michael, I have a question to start with.
46:11 Presenter: Sorry.
46:12 Presenter: You want to start off?
46:14 Presenter: Yeah.
46:14 Presenter: Yeah.
46:19 Presenter: Yeah, we’ve been working with Microsoft on this for a couple of years,
46:22 Presenter: and we’re really pushing them to change things.
46:24 Presenter: The fact that the connectors are so hard to trace,
46:28 Presenter: the fact that they have so many permissions,
46:30 Presenter: the fact that it’s very hard to audit the permissions.
46:33 Presenter: There are other things you can do as well.
46:35 Presenter: You can set the DLP to make sure that your business connectors
46:37 Presenter: and your other connectors don’t mix.
46:39 Presenter: You can set policies in cloud app security.
46:42 Presenter: you can monitor the audit logs and the office activity logs in Sentinel.
46:49 Presenter: So we’ve been monitoring these things and detecting these things,
46:51 Presenter: but we realized that it is a huge task to do.
46:55 Presenter: So thank you.
46:56 Presenter: It was a very interesting talk.
46:57 Presenter: Thank you.
46:57 Presenter: Thank you.
46:58 Presenter: I’m glad to hear that you’ve been working with Microsoft on that.
47:01 Presenter: By the way, this is not a decent Microsoft.
47:03 Presenter: They are doing a good job, but this is still limited.
47:08 Presenter: And some of Microsoft’s teams are actually part of the OWASP group,
47:12 Presenter: working together with them.
47:13 Presenter: One thing I’ll note on the Power Platform DLP, which is important to note,
47:18 Presenter: today we know of seven or eight ways to bypass it.
47:23 Presenter: Those are really simple, like, for example, instead of plugging in the URL,
47:29 Presenter: which can be filtered, just put it in a variable, and then they cannot filter it.
47:33 Presenter: So it’s very basic.
47:35 Presenter: They’re making changes.
47:37 Presenter: Hopefully soon.
47:40 Presenter: okay michael i mean i have two i mean specific questions i would like you to clarify i’m sure i
47:47 Presenter: mean i have this doubt and maybe the audience has a similar kind of thought so who’s actually
47:52 Presenter: responsible for a low code no code application what is that very simple question second is uh
47:58 Presenter: you know uh what essentially what you feel is the difference in terms of securing a low code
48:05 Presenter: no-code application vis-a-vis a traditional commercial application
48:09 Presenter: that we look at.
48:13 Presenter: So the first question is the most challenging.
48:18 Presenter: We are used to work
48:20 Presenter: as application security teams, we focus on applications that developers
48:25 Presenter: are building. And that has been fine up at the end now. But the
48:29 Presenter: rate at which these applications are being built by business
48:32 Presenter: means that in a few years, I mean, this is the mainstream, not what we are doing.
48:39 Presenter: You saw the chart.
48:41 Presenter: There are no, the numbers, like 70,000 different applications.
48:45 Presenter: There are no, there’s no way for developers to create the same kind of amount of applications.
48:52 Presenter: And so we have to be in charge there.
48:55 Presenter: We need to help those business users build those applications correctly.
49:00 Presenter: And if we don’t put ourselves out there, they’re just going to do it without us.
49:05 Presenter: And this is going to leave us, A, exposed to risk, and B, a bit irrelevant.
49:10 Presenter: So we really have to get going there and to be part of the conversation.
49:14 Presenter: In terms of how different this is from what we’ve been doing,
49:18 Presenter: the most important thing to understand about low-code and no-code in terms of technically
49:22 Presenter: is that you don’t have any of the fundamental building blocks you’re used to building your security strategy on.
49:29 Presenter: no code to scan, there’s no
49:31 Presenter: runtime logs or no way to plug
49:33 Presenter: into runtime,
49:35 Presenter: there is no CICD
49:36 Presenter: in most cases, and there’s no security
49:39 Presenter: surveillance from the side of developers. So you need to
49:41 Presenter: really reinvent the way that you do application
49:43 Presenter: security.
49:46 Presenter: Okay, we are
49:47 Presenter: open to any other questions.
49:51 Presenter: Do we have any?
49:55 Presenter: Oh, it’s been too heavy for us.
49:57 Presenter: Yeah, we’ve got one.
50:04 Presenter: Just a short question.
50:05 Presenter: On your slide about Jyapur, it said $400 pointy.
50:09 Presenter: Is that all it gave you?
50:12 Presenter: Yes, and we’ve actually found, on the same week,
50:16 Presenter: we found a sandbox escape, and they gave us $300.
50:21 Presenter: What’s for a party then?
50:26 Presenter: yeah what questions how can we communicate to colleagues through those apps about the security
50:32 Presenter: issues they might not be aware of because you know i just showed that it’s all gooey you can
50:39 Presenter: just click and play okay how can we communicate to them the security implications of building such
50:44 Presenter: tools? I find that the easiest way to communicate the risks here is just to show them. So here’s a
50:53 Presenter: way to drag and drop information outside of the organization, and then they all of a sudden get
50:58 Presenter: the realization. Or here’s a way to impersonate another user or to create an application, embed
51:03 Presenter: your own identity within the application, and then everybody can impersonate you. But this is a
51:08 Presenter: conversation we need to have with business leaders.
51:10 Presenter: In most cases, from what I see,
51:14 Presenter: business leaders understand the people that are managing those platforms,
51:19 Presenter: the admins of those platforms.
51:21 Presenter: They understand that security is important,
51:23 Presenter: and they do whatever they can in order to secure those applications,
51:27 Presenter: but they don’t have the tools.
51:28 Presenter: And they also, to be frank,
51:29 Presenter: they kind of just do what the platform tells them to do.
51:34 Presenter: So the platform gives them best practice.
51:38 Presenter: That’s fine.
51:39 Presenter: But there is a shared responsibility model here, right?
51:42 Presenter: You cannot really rely.
51:44 Presenter: Some of the vendors are still in a mindset where they’re telling their people,
51:49 Presenter: hey, everything you’re building on top of these platforms will be secured.
51:54 Presenter: This is not going to happen.
51:56 Presenter: There’s no way.
51:57 Presenter: We’ve tried that in cloud.
51:58 Presenter: We’ve tried to say that AWS is in charge of everything we’re building in cloud.
52:02 Presenter: That failed dramatically.
52:04 Presenter: There’s a shared responsibility model, and we own part of the responsibility.
52:08 Presenter: The same thing happens here.
52:10 Presenter: Just today, in most cases, we simply don’t do our part.
52:20 Presenter: The most favorite topic, I guess, for each security team,
52:24 Presenter: how do you manage asset inventory for low-code, no-code apps?
52:28 Presenter: Okay, so here I have somewhat better news.
52:31 Presenter: because before low-code, no-code,
52:37 Presenter: business users have been doing whatever they wanted,
52:41 Presenter: mostly through copy and paste.
52:43 Presenter: So there’s this nice little phrase I heard once,
52:46 Presenter: copy and paste integration.
52:48 Presenter: This is what people have been doing, right?
52:50 Presenter: And we’ve been trying to get a hold of it,
52:51 Presenter: shadow IT, DLP, all sorts of this.
52:54 Presenter: We haven’t succeeded in doing that.
52:57 Presenter: When people start to use low-code, no-code platforms,
53:01 Presenter: up with APIs that you can just ask questions.
53:04 Presenter: And you can ask a question like, what are all of the applications that I have that were
53:08 Presenter: built on top of Office 365?
53:09 Presenter: Now, of course, in those large numbers, specifically with Microsoft, inventory is not easy.
53:15 Presenter: Even if there’s an API, it gets flaky when you get to over, I don’t know, a thousand
53:20 Presenter: applications.
53:22 Presenter: But at least there’s someone to ask that question.
53:31 Presenter: Do we have any more questions?
53:35 Presenter: Okay.
53:36 Presenter: Thank you, Michael.
53:37 Presenter: And great talk.
53:39 Presenter: Thank you.
53:39 Presenter: You know, this topic is very nascent to most of us, actually.
53:44 Presenter: And to learn and grow into this particular field, it’s an ask.
53:49 Presenter: And I’m sure some thoughts would have come to our mind after listening to him.
53:53 Presenter: So great talk.
53:55 Presenter: And request for a round of applause for him, please.