OWASP Global AppSec DC 2023 · 2023/10
Credential Sharing as a Service: the Dark Side of No Code
Abstract
Why focus on heavily guarded crown jewels when you can dominate an organization through its shadow IT? Low-Code applications have become a reality in the enterprise, with surveys showing that most enterprise apps are now built outside of IT, with lacking security practices. Unsurprisingly, attackers have figured out ways to leverage these platforms for their gain.
In this talk, we demonstrate a host of attack techniques found in the wild, where enterprise No-Code platforms are leveraged and abused for every step in the cyber killchain. You will learn how attackers perform an account takeover by making the user simply click a link, move laterally and escalate privileges with zero network traffic, leave behind an untraceable backdoor, and automate data exfiltration, to name a few capabilities. All capabilities will be demonstrated with POCs, and their source code will be shared.
Transcript
AI generated from recording.
Introduction and Defining No‑Code
00:05 Presenter: But it’s going to be interesting, I’ll tell you that. So let’s, like, briefly about me, I’ve been focused on kind of no-code security and how do you help business users build secure applications for a few years now. I started a company that’s focused on this space. We’ve been around for almost three years now called Xenity. I lead a No-WASP project dedicated to the cloud.
00:30 Presenter: to low-code, no-code, and there are probably a couple of people in the audience right now
00:34 Presenter: that are part of this project, so please do reach out to them afterwards for questions.
00:41 Presenter: And I’m trying to share as much as I can about this space because I feel like we have a really
00:47 Presenter: big opportunity at our hands here. So here’s, like in a nutshell, what we’re going to do today.
00:55 Presenter: We’re going to start by just making sure we’re all on the same page on what no code actually means,
01:00 Presenter: or what do I mean when I say no code.
01:04 Presenter: Then we’re going to shift to the attacker’s perspective,
01:07 Presenter: and I’m going to share concrete examples of attacks we’ve observed in the wild,
01:12 Presenter: where attackers have leveraged no code for their own purposes.
01:17 Presenter: That includes leaving off the land, phishing attacks, and persistency, and much more, depends on time.
01:24 Presenter: And, of course, we’re going to finish it off with helpful tips on how to defend your organization when you get back to office.
01:35 Presenter: So let’s start off with no code.
The Scale of No‑Code Adoption; Security Foundations and Risks of No‑Code
01:40 Presenter: This number right now, 5 million, is the number of .NET developers, according to Microsoft, the number of active .NET developers today.
01:49 Presenter: So 5 million C-sharp developers active right now.
01:54 Presenter: with this number as a reference,
01:57 Presenter: think about how many developers
01:59 Presenter: are there out there
02:00 Presenter: that are building local local apps.
02:03 Presenter: Like, just have a number in your head.
02:06 Presenter: And so, because we’re comparing,
02:08 Presenter: because this is the Microsoft ecosystem,
02:10 Presenter: let’s compare the number of development developers
02:12 Presenter: with the number of developers
02:14 Presenter: that are using the Microsoft
02:15 Presenter: Power Platform ecosystem
02:17 Presenter: to build applications.
02:18 Presenter: I’ve actually gone through their earning reports
02:21 Presenter: and weeded out the numbers.
02:24 Presenter: As you can see here, today there are almost, or according to this regression, there are 8 million active Power Platform developers today.
02:33 Presenter: 8 million Power Platform developers, 5 million .NET developers.
02:38 Presenter: Now, these numbers are, as you can see, the last number that I actually got a quote on was 7 million.
02:45 Presenter: But still, just think about how much we’re investing in those professional developers versus business developers.
02:51 Presenter: So this is why this is important.
02:54 Presenter: thinking about, like, the one thing that is important about these developers is, like,
02:58 Presenter: where do they work?
02:59 Presenter: They work for you, right?
03:01 Presenter: They work for the top organizations in the world because those are the organizations
03:05 Presenter: that are using the Microsoft Suite.
03:06 Presenter: And so here’s an example from one organization, one Fortune 100 organization, on the number
03:13 Presenter: of applications that they’ve seen created with no code throughout the years.
03:18 Presenter: And you can see just how fast this thing grows.
03:21 Presenter: These are real numbers from a real company,
03:25 Presenter: and they are actually not that wild.
03:28 Presenter: There are other companies that have many more.
03:31 Presenter: And it shows, like, of course,
03:33 Presenter: not all of these applications are huge applications.
03:35 Presenter: Some of them are very small.
03:36 Presenter: Some of them are kind of if this, then that rule.
03:39 Presenter: But still, there are applications with identity,
03:44 Presenter: with access to data.
03:45 Presenter: So it’s important for us to understand
03:48 Presenter: just the magnitude of this thing.
03:52 Presenter: And right now, in the last few months, this thing has been happening,
Credential Sharing Attacks in the Wild
03:56 Presenter: where now we are seeing in every major local platform,
03:59 Presenter: we are seeing AI being introduced as a way to lower the bar even more,
04:04 Presenter: to more easily create applications,
04:07 Presenter: and more than that, to create applications that are more complex.
04:10 Presenter: So what you’re seeing right now on screen is an experience in the office suite
04:15 Presenter: where you talk to the chat, to the AI, and it will generate an application for you.
04:22 Presenter: Once you’re done with the chat, this application has created a table in a managed SQL server.
04:27 Presenter: It has exposed an endpoint inside of your organization.
04:32 Presenter: The application is already live.
04:33 Presenter: It’s already in production.
04:34 Presenter: So you understand the magnitude of this.
04:36 Presenter: And, of course, it also means that you can build more complex applications very easily.
04:41 Presenter: And this is not just a Microsoft thing.
04:43 Presenter: This is happening across the industry because AI and no code are very much interconnected in the way that when you think about building Gen.AI application, it’s all about these kind of building blocks and new plugin together.
04:57 Presenter: And so right now, people have the ability across the organization to just spell out the application that they would like built, to have built, and the AI would build it for them.
05:05 Presenter: And of course, assuming that AI would build a secure application is kind of a difficult assumption to make.
05:12 Presenter: this is not new
05:13 Presenter: this has been happening for a long time now
05:16 Presenter: and there have been many
05:17 Presenter: cases, like many technologies
05:20 Presenter: that have come
05:22 Presenter: through that have enabled people
05:24 Presenter: to do more, to accomplish more
05:26 Presenter: with their digital workspaces
05:27 Presenter: Excel comes to mind as one clear example
05:30 Presenter: of software that enables
05:32 Presenter: people to do more, that empowered them
05:34 Presenter: to be able to do more
05:35 Presenter: than they were able to do before
05:37 Presenter: and right now with NocoNoCode and Gen.AI
05:41 Presenter: This is like the next evolution, but it’s really taken on quickly.
05:46 Presenter: And one important thing to note is that this problem or this space is relevant to all of us
05:54 Presenter: because you don’t really get to make the decision whether you have no code in your organization or not.
05:58 Presenter: It’s already there.
05:59 Presenter: If you’re using any one of these platforms on screen,
06:02 Presenter: and most of the SaaS vendors out there have kind of integrated no code directly into their platform.
06:09 Presenter: And so you don’t get the choice.
06:11 Presenter: If you’re using Microsoft, ServiceNow, Salesforce,
06:14 Presenter: you already have a low-code, no-code platform in your organization,
06:17 Presenter: and they have been enabling your business users to build applications,
06:21 Presenter: which they try to make secure,
06:24 Presenter: on top of business data that’s already there.
06:27 Presenter: All right.
06:29 Presenter: So a quick recap on no-code.
06:33 Presenter: We know that no-code is available in every major organization.
06:35 Presenter: We know that it has access to both business data and it also powers business processes by design.
06:43 Presenter: This is part of your business ecosystem.
06:47 Presenter: Of course, because this is based on SaaS, most of it will run on somebody else’s infra.
06:53 Presenter: Admittedly, there are some platforms that would allow you to run your own, but that’s not the norm.
06:59 Presenter: And those applications can be built by anyone between a professional developer and a citizen developer,
07:05 Presenter: everyone in your organization.
07:08 Presenter: And even with professional developers,
07:09 Presenter: you’ll find that the controls are really not there.
07:11 Presenter: But that’s kind of a
Ransomware via Power Automate and Azure
07:13 Presenter: recap happening now to make sure that
07:15 Presenter: we’re all on the same page of what
07:18 Presenter: no code is.
07:20 Presenter: Now I’m going to switch gears
07:21 Presenter: and I’m going to share a few attacks
07:23 Presenter: that we’ve seen in the wild.
07:25 Presenter: And also for each one of the attacks, I’m going to
07:28 Presenter: recreate it together with you
07:30 Presenter: here. And at
07:32 Presenter: the end, you’ll see that all of this is wrapped
07:36 Presenter: access by the end of this talk.
07:38 Presenter: By the way, everything that you’re seeing on screen,
07:40 Presenter: including the deck
07:41 Presenter: and the source
07:44 Presenter: is already published.
07:46 Presenter: You’ll see links in a moment.
07:49 Presenter: All right.
07:50 Presenter: So the first thing I want to…
07:52 Presenter: Before we
07:54 Presenter: talk about this attack, we need to
07:56 Presenter: figure out… We need to have a clear example
07:58 Presenter: of how a low-code application looks like.
08:00 Presenter: So here’s a
08:02 Presenter: quick little demo.
08:03 Presenter: This is a silly example where there’s this annoying thing in Slack
08:09 Presenter: where when somebody mentions me in a public channel,
08:11 Presenter: I’m expected to reply quickly because other people are watching.
08:15 Presenter: And so I’m building here a quick application
08:17 Presenter: where every time they subscribe to a notification
08:20 Presenter: that somebody mentions me in a public channel,
08:23 Presenter: it’s going to replace my status as if I’m on a call.
08:27 Presenter: So people will know that I’m unavailable right now
08:33 Presenter: me alone. And then five minutes later, it’s going to switch off to a regular kind of profile
08:41 Presenter: to make sure that nobody gets suspicious. Now, this is a silly example, but the important
08:46 Presenter: thing here is just to figure out how, A, how easy it is to create this application. You
08:51 Presenter: are seeing it on the screen right now. But B, this is a pretty significant piece of application,
08:56 Presenter: right? It has to authenticate to Slack. It has to maintain secrets that would somehow
09:03 Presenter: to Slack. Note that I’m not providing
09:05 Presenter: secrets in any part right here
09:07 Presenter: in building this app.
09:09 Presenter: It needs to wait for
09:11 Presenter: five minutes so there’s a state somewhere.
09:13 Presenter: It runs
09:15 Presenter: on somebody else’s cloud.
09:17 Presenter: I can share this application.
09:18 Presenter: This is a significant piece of software that I get
09:21 Presenter: to build very quickly.
09:23 Presenter: The number one thing that’s important for
09:25 Presenter: us to figure out about this app
09:26 Presenter: is the identity. How is it
09:29 Presenter: connected to Slack?
09:30 Presenter: If you think
09:33 Presenter: When you think about, when you build an application,
09:36 Presenter: I’m showing you an example for Zapier,
09:38 Presenter: but this is true for almost any no-code platform.
09:42 Presenter: If you think about allowing business users to build applications,
09:46 Presenter: the number one thing that would stop them from building applications is permissions.
09:51 Presenter: If they would need to ask for a service account
09:53 Presenter: every time they wanted to create an application,
09:57 Presenter: you would never see the chart that I showed you earlier
10:00 Presenter: with the number of applications that get developed.
10:03 Presenter: How exactly does this happen?
10:04 Presenter: This happens by, so the way this platform circumvent this problem
Phishing Campaigns Leveraging No‑Code Platforms
10:09 Presenter: is that they allow users to basically record their refresh token,
10:14 Presenter: their OAuth refresh token, and then share it with others.
10:17 Presenter: You’re seeing it on screen.
10:18 Presenter: So when you create, when you plug in Zapier, for example, to your Slack account,
10:23 Presenter: you’re seeing the normal OAuth flow here
10:25 Presenter: where you’re allowing Zapier to operate on your behalf.
10:29 Presenter: And then there is something called connection that gets created, which is essentially just a wrapper around credentials.
10:36 Presenter: But the important thing is that you get this share button.
10:39 Presenter: This share button on top of the connection that allows you to share your identity with others.
10:44 Presenter: Now, know that this is not sharing, like this is not providing access the way that OAuth was intended.
10:51 Presenter: This is just copying and allowing somebody else to use your refresh token,
10:55 Presenter: which means that there is no way to distinguish the application when one user uses it or another user uses it.
11:02 Presenter: Everybody is using the same token.
11:04 Presenter: Behind the scene, the way that this works is that there are mechanisms where the application is sending requests to the APIs of its choice,
11:15 Presenter: and the platform is just replacing the tokens,
11:18 Presenter: just making sure that when the Power Automate or Zapier or any other automation platform reaches out to Slack on your behalf,
11:26 Presenter: then even though the automation itself doesn’t have access to your token,
11:29 Presenter: the token gets stored on a proxy between those two points,
11:35 Presenter: and the token just gets injected between those two points.
11:39 Presenter: This means that every user of the application, every user of the automation,
11:43 Presenter: of the automation would use the same credentials
11:47 Presenter: through this gateway.
11:49 Presenter: They would not have direct access to the credential.
11:51 Presenter: They can’t fetch out, or in most cases,
11:54 Presenter: they can’t fetch out the token.
11:57 Presenter: However, they are free to use it, right?
12:00 Presenter: And so when you look at these platforms,
12:05 Presenter: because people are widely using them,
12:09 Presenter: people are kind of creating a whole bunch of things with them,
12:13 Presenter: examples that I just took off marketplaces for many of the different vendors. The important thing
12:19 Presenter: for what you’re seeing on screen here to note is actually the logos, because they indicate
12:25 Presenter: that these platforms are actually connected on your behalf across your organization. They’re
12:31 Presenter: connected to G Suite, they’re connected to Office, they can be connected anywhere, including on-prem
12:35 Presenter: and to your cloud, which means that behind every one of these logos, there’s access to data. By
12:43 Presenter: only access that could very easily be full access, full control.
12:48 Presenter: And the worst thing is that most of these platforms have some way to share these connections.
12:56 Presenter: And so pretty soon you end up with a whole bunch of connections.
13:00 Presenter: And you’re seeing this example on screen where a bunch of connections were created
13:03 Presenter: because they just created a bunch of applications that were kind of popular in our organization.
13:08 Presenter: And one of the things that you’ll see in most of these platforms is a way to collaborate.
13:13 Presenter: that these platforms are allowing productivity within your environment.
13:17 Presenter: And so there’s this notion of a default environment.
13:21 Presenter: And the default environment is a way, it’s like the place where you log in,
13:26 Presenter: everybody has permissions to build things there by default.
13:31 Presenter: And in this default environment, you will typically find a large pile of connections
13:36 Presenter: that are just waiting around for anybody to use them.
13:41 Presenter: Like, you realize what this means.
13:43 Presenter: just like a bag of
13:45 Presenter: credentials that are waiting for
13:47 Presenter: anybody to join in
13:49 Presenter: and the only thing that you need in order to
13:51 Presenter: get into that
13:53 Presenter: pile of gold is just
13:55 Presenter: a single user inside of
13:57 Presenter: an organization and
13:59 Presenter: of course in a large enterprise
14:01 Presenter: we need to operate under
14:03 Presenter: the assumption that
14:04 Presenter: at least one user would
14:07 Presenter: eventually be attacked
14:09 Presenter: like be compromised right
14:10 Presenter: especially when you
14:13 Presenter: that most of these platforms allow vendors and guests
14:16 Presenter: to have access to your platform as well.
14:18 Presenter: And so once you’re in, you’re able to quickly just pick up those credentials
14:22 Presenter: and reuse them for yourself, and we’ll see that in a moment.
14:28 Presenter: What can you do with these connections?
14:30 Presenter: So you can do basically everything that you can do
14:33 Presenter: with the credentials behind them.
14:35 Presenter: And in most cases, this is full-blown access
14:39 Presenter: to those underlying data stores or services.
14:43 Presenter: Here’s one example. You can build ransomware directly using those connections.
14:48 Presenter: In this Power Automate flow here, I’m listing out all of the folders in a specific SharePoint site,
14:55 Presenter: and then I’m encrypting every file with the encryption function that is provided by the platform
15:03 Presenter: because there are valid use cases to provide an encryption function.
15:07 Presenter: Of course, that could also be used for malicious purposes.
15:11 Presenter: And so that’s one way to do it.
15:13 Presenter: You can, of course, as you can see on the right side,
15:16 Presenter: there’s a whole bunch of connectors here.
15:17 Presenter: So you can do that well across the enterprise,
15:20 Presenter: not just in SharePoint.
15:23 Presenter: One of the things that might be surprising here
15:25 Presenter: is that you can also use this
15:28 Presenter: to bypass your network mechanisms, your DLP mechanisms.
15:33 Presenter: Because this is kind of the latest innovation
15:36 Presenter: in exfiltrating email.
15:38 Presenter: So users have forever been trying to move data to their personal accounts because most people would rather read their corporate, or a lot of people would rather read their corporate email or have their personal and corporate calendar synced with each other.
15:56 Presenter: Of course, this could very easily lead to data leakage from your organization.
16:01 Presenter: And so we have different mechanisms to try to stop that with things that sit on the email server or DLP.
16:08 Presenter: However, what can happen with no code is that you, like a single application, could use two different identities.
Backdoor Persistence and Automation Abuse
16:15 Presenter: One identity is your corporate identity and the other is your personal identity.
16:18 Presenter: And then things get copied from the corporate identity to the personal identity.
16:23 Presenter: And the data itself gets copied on the vendor’s server.
16:28 Presenter: So nothing gets sent on the wire.
16:30 Presenter: There’s no way for you to catch that through email.
16:33 Presenter: This is just an email being read from one place and then stored in another.
16:38 Presenter: so that’s like data exfiltration
16:41 Presenter: through these no-code platforms
16:43 Presenter: is a very common scenario
16:45 Presenter: that you can see exactly
16:47 Presenter: because nothing needs to go on the wire
16:50 Presenter: like the no-code vendor
16:51 Presenter: who does all of the difficult tasks for you
16:55 Presenter: and another thing you can do here
16:58 Presenter: is actually move to on-prem
17:00 Presenter: so move to workstations
17:02 Presenter: because some no-code platforms
17:04 Presenter: have also integrated something called RPA
17:08 Presenter: that runs on somebody’s workstation,
17:10 Presenter: in a different kind of technology,
17:11 Presenter: but it doesn’t really matter,
17:13 Presenter: where you are able to send commands from the cloud
17:16 Presenter: to your workstation to perform automation tasks
17:19 Presenter: on that workstation.
17:20 Presenter: And now, of course,
17:21 Presenter: if you can send something from the cloud to a workstation
17:24 Presenter: and have that workstation accomplish that task,
17:27 Presenter: then if those permissions get shared as well,
17:32 Presenter: then you have found a way to move from cloud,
17:35 Presenter: from those platforms directly to people’s workstations.
17:38 Presenter: And I’ve actually given a talk at DEF CON last year
17:40 Presenter: on how you can basically take,
17:43 Presenter: you could take over that mechanism
17:45 Presenter: and then use it as a way to command and control
17:48 Presenter: into an organization.
17:50 Presenter: This has already been fixed by Microsoft
17:52 Presenter: or at least the vulnerability that I’ve used there.
17:55 Presenter: But this is still like an attack vector
17:58 Presenter: we need to monitor.
17:59 Presenter: And now, up and down,
18:01 Presenter: I’ve kind of shared a few examples here,
18:05 Presenter: switch gears here and show you.
18:08 Presenter: And so, kind of show you how this looks like.
18:11 Presenter: And so, what we’re going to do right now is accomplish one of these attacks with a tool
18:16 Presenter: called PowerPoint.
18:17 Presenter: This is a tool that we’ve published in Black Hat a few months ago.
18:22 Presenter: And it’s available right now.
18:24 Presenter: You can go to the link on screen.
18:26 Presenter: And PowerPoint is a tool that’s focused on the Power Platform ecosystem, so Microsoft
18:30 Presenter: 365.
18:31 Presenter: If you’re a Microsoft CHOP or if you’re doing a penetration testing for a Microsoft CHOP,
18:37 Presenter: this is a nice thing for you to use.
18:39 Presenter: And we’re going to see a few modules of PowerPoint today.
18:42 Presenter: And so the first thing I want to show you is those connections
18:47 Presenter: and what can you actually accomplish with them.
18:49 Presenter: So let me switch off to a quick demo.
18:57 Presenter: All right.
18:59 Presenter: and hopefully this will be easy.
19:05 Presenter: Okay, so I’m just shooting up PowerPoint here
19:09 Presenter: and you can see that there is a simple command on screen,
19:12 Presenter: PowerPoint dump, which would actually go
19:15 Presenter: and I’m providing the tenant that I would like to kind of exfiltrate.
19:19 Presenter: And then what would actually happen is that PowerPoint would reach out
19:23 Presenter: to the tenant, find all of the connections, applications,
19:28 Presenter: that are available to me and then to that user that I have logged in with,
19:32 Presenter: and then just dump all of the data behind them.
19:35 Presenter: So let’s see how this looks like.
19:36 Presenter: I’m providing the tenant ID for PowerPoint.
19:42 Presenter: It’s going to use the device login in order to authenticate,
19:46 Presenter: but of course you can provide a token from anywhere else.
19:49 Presenter: You can also take a token from other tools like road tools
19:55 Presenter: or anything else where you can get a token.
19:58 Presenter: We need a bearer here, but you can switch those off.
20:03 Presenter: Once you log in, then first of all, it’s going to do some recon
20:08 Presenter: to find all of the different environments that exist within this specific Power Platform tenant.
20:16 Presenter: It’s also finding all of the applications and connections
20:20 Presenter: that have been shared across an organization.
20:23 Presenter: And this is just, again, very easy to do.
20:25 Presenter: This is going after that pile of gold that we’ve just described
20:29 Presenter: where people have shared connections with others.
20:34 Presenter: It’s going to fetch a few definitions that would allow us to use those connections.
20:40 Presenter: And then by the end of the script,
20:43 Presenter: what happens here is that all of the data behind all of these connections gets dumped to your disk.
20:49 Presenter: So you can see that I’m showing the specific…
20:56 Presenter: you can see that inside of this dump folder,
20:59 Presenter: for which I’ve listed here,
21:02 Presenter: all of the different types of connections that I found.
21:05 Presenter: So you can see connections to Azure Blob Storage,
21:07 Presenter: to Azure File Storage, Azure Tables,
21:10 Presenter: CDS, Common Data Services, Power Apps for Admin.
Mitigation Strategies and Closing Remarks — Part 1
21:12 Presenter: So these are the different connections
21:13 Presenter: that I would be able to use.
21:19 Presenter: And now for each one of those types of connections,
21:22 Presenter: I can actually look at the actual data,
21:26 Presenter: and we provide a nice little applet for you
21:28 Presenter: with the command PowerPoint GUI,
21:32 Presenter: which creates this little kind of application.
21:35 Presenter: And you can see this is an inventory of everything that we found.
21:38 Presenter: We found a bunch of credentials,
21:41 Presenter: so these are the connections that have been overshared.
21:43 Presenter: We found a bunch of automations that you can use
21:45 Presenter: and applications that you can pick up and use.
21:50 Presenter: So if I click on credentials,
21:52 Presenter: then you’ll see that there’s a whole bunch of credentials here
21:55 Presenter: that I can just pick up and use.
21:56 Presenter: Some of them are for, again, Azure File Storage, Azure Blob Storage.
21:59 Presenter: You can see where these connections are connected.
22:02 Presenter: In some cases, we’re able to actually extract the host name.
22:04 Presenter: So we can see, for example, Enterprise IP Blob Storage
22:08 Presenter: or Jamie Redding Customer Data or Enterprise Financial.
22:12 Presenter: So these are just connections to underlying SQL servers or Azure resources.
22:17 Presenter: And you can see a bunch of information about them,
22:19 Presenter: like when was this credential less…
22:23 Presenter: If we know of an expiry date, when is it
22:25 Presenter: and when was the connection actually less created?
22:28 Presenter: And so when you go into…
22:31 Presenter: And for each one of those connections,
22:35 Presenter: we actually dump all of the data behind them.
22:37 Presenter: So for example, with SQL Server,
22:39 Presenter: we would list out all of the different tables
22:43 Presenter: that are part of the SQL Server.
22:45 Presenter: And as you can see, there are three tables here,
22:49 Presenter: a couple of tables that are kind of default
22:50 Presenter: about the firewall tables.
22:53 Presenter: And when you go to the customer table,
22:54 Presenter: you actually get a full dub of the table.
22:56 Presenter: Don’t worry, these are not real social security numbers.
22:59 Presenter: This is the chat GPT being helpful.
23:02 Presenter: But again, these are like,
23:04 Presenter: this is the data behind the connections
23:06 Presenter: that was overshared.
23:09 Presenter: We can actually do more than that
23:11 Presenter: because this is just showing you
23:14 Presenter: that you can get to the actual connection,
23:17 Presenter: to the actual data behind that connection.
23:19 Presenter: But you can also use those connections to perform operations.
23:23 Presenter: So for example, with SQL Server,
23:25 Presenter: we provide you with an automatedly generated Swagger UI
23:28 Presenter: where you can see that there are a whole bunch of actions
23:31 Presenter: you can perform on top of this connection.
23:33 Presenter: One thing that you can do with a SQL Server
23:35 Presenter: is just pass on a SQL query.
23:37 Presenter: So you can see that action.
23:42 Presenter: So let me move here.
23:45 Presenter: All right, so you can see SQL pass through native query,
23:49 Presenter: that would just allow me to run any query that I want on top of this server.
23:53 Presenter: I’m just going to use the information that I found from the table that you just saw.
23:59 Presenter: And I’m going to add a SQL query that’s simply going to encrypt
24:04 Presenter: some of the social security numbers there on the table.
24:07 Presenter: And, of course, this is just a demo showing how you can use this access
24:12 Presenter: to do some sort of a ransomware attack on top of the data that sits behind that connection.
24:19 Presenter: This specific example is going to find some of the customer records
24:24 Presenter: and encrypt them.
24:26 Presenter: Once I click on execute, this goes through the proxy that we saw earlier
24:30 Presenter: and actually would encrypt the data there.
24:36 Presenter: I’m going to use a get request just to watch the records
24:40 Presenter: and make sure that I’ve actually successfully encrypted them.
24:47 Presenter: and again when I click on execute
24:49 Presenter: you’ll find that I get the information
24:51 Presenter: from the tables, this is actually how we perform
24:54 Presenter: the dump command
24:56 Presenter: and you can see that some of the records
24:58 Presenter: indeed were encrypted
24:59 Presenter: so the social security numbers indeed were encrypted
25:02 Presenter: so this shows you that you can use this tool
25:04 Presenter: to perform operations, any operations that you’d like
25:06 Presenter: on top of the underlying
25:10 Presenter: services behind that connection
25:14 Presenter: tool to actually just use the applications and the automations that have been shared
25:19 Presenter: that we got access to.
25:21 Presenter: So here are the bunch of applications that we were able to detect.
25:26 Presenter: And you can just run each one of them.
25:28 Presenter: So just here is an example.
25:30 Presenter: I’m just going to run one of them, and it lets me into the application.
25:34 Presenter: We are actually bypassing a couple of mechanisms here, but that’s a story for another day.
25:40 Presenter: And you can also look at a bunch of automations that are available here.
25:44 Presenter: actually trigger those automations.
25:46 Presenter: And so the amount of damage that you can do
25:48 Presenter: depends on what the automation allows you to do.
25:50 Presenter: But in many cases, you’ll find automations
25:52 Presenter: that allow you, for example,
25:53 Presenter: to gain permissions to something
25:55 Presenter: or to change access to something.
25:58 Presenter: And so hopefully this gives you kind of a taste
26:05 Presenter: of what you can do with PowerPoint here.
26:08 Presenter: But actually, the number one thing you can do
26:11 Presenter: is just play around with it.
26:12 Presenter: So please go to that link
26:14 Presenter: plenty more documentation.
26:16 Presenter: And if you’re looking to learn more,
26:18 Presenter: specifically about this issue of overshark credentials,
26:21 Presenter: I’ve actually given a talk at Black Hat
26:24 Presenter: that is precisely focused on that issue
26:26 Presenter: and what happens when guests in your organization,
26:30 Presenter: how can they leverage this issue
26:34 Presenter: to actually gain access to SQL servers
26:36 Presenter: and Azure storage across your organization.
26:39 Presenter: So please do check it out.
26:42 Presenter: All right.
26:44 Presenter: seen a few
26:45 Presenter: living-of-the-land attacks.
26:48 Presenter: One, like the next thing I want
26:50 Presenter: to show you is phishing.
26:52 Presenter: And before I’ll
26:54 Presenter: show you how you
26:56 Presenter: can use no code to do
26:57 Presenter: active phishing within an organization,
27:00 Presenter: let’s consider for a second what
27:02 Presenter: would be the ideal
27:04 Presenter: capability for
27:06 Presenter: an attacker to
27:08 Presenter: create a phishing campaign inside of an organization,
27:10 Presenter: like a large organization.
27:11 Presenter: So you would probably want the
27:14 Presenter: to look and feel like something users are used to working with, right?
27:19 Presenter: It should look like something that they’re operating with every day.
27:23 Presenter: You would probably want it, like if you can,
27:26 Presenter: hopefully it’s already integrated to their SSO, right?
27:30 Presenter: That would be amazing because somebody would just need to click a link
27:33 Presenter: and that’s it.
27:33 Presenter: You’ve owned them because they don’t need to provide their credentials.
27:37 Presenter: Ideally, it needs to be hosted on somewhere where users would trust it, right?
27:41 Presenter: Not just a random URL, but hopefully something that they trust.
27:49 Presenter: So I’m going to show you right now how you can use the Microsoft platform to accomplish all of that.
27:56 Presenter: Because when you think about, again, the number of applications that we saw earlier,
28:00 Presenter: like the huge exponential graph at the beginning of this talk,
28:04 Presenter: then you’ll just think about an organization that has created so many of these applications.
Mitigation Strategies and Closing Remarks — Part 2
28:09 Presenter: In an organization that uses these platforms, people are used to using applications that were generated by these platforms a lot.
28:18 Presenter: And they always look and feel the same thing, the same way.
28:21 Presenter: And so here’s the question.
28:23 Presenter: Can we take an application?
28:26 Presenter: Can we create an application that’s actually useful?
28:28 Presenter: It does something useful for an organization.
28:30 Presenter: Maybe you’ll just pick up an application from the marketplace.
28:33 Presenter: And then every time a user logs into that application,
28:37 Presenter: the user would need to log in,
28:39 Presenter: and maybe we can even make them log in automatically.
28:43 Presenter: Once they are in and they have provided us with authorization
28:47 Presenter: to basically, for example, access email on their behalf
28:52 Presenter: to do something that’s all right,
28:54 Presenter: then we can use their email to do whatever we want,
28:56 Presenter: and then we can own their account.
28:57 Presenter: And so this is what we’re going to try to do.
29:00 Presenter: We’re going to try to create an application
29:03 Presenter: is doing something useful so people actually use it.
29:05 Presenter: But every time somebody logs into it,
29:07 Presenter: then we’ve owned them.
29:11 Presenter: And so now I’m going to switch directly to a demo.
29:19 Presenter: All right, so PowerPoint phishing would allow you,
29:24 Presenter: what it allows you to do is first of all,
29:27 Presenter: it’s basically install a phishing application
29:29 Presenter: within an organization.
29:30 Presenter: Of course, you need to be authenticated, right?
29:33 Presenter: some user inside of the organization
29:34 Presenter: in order to be able to create this application.
29:37 Presenter: So I’m creating this phishing application,
29:39 Presenter: and you can see that the name of the application is shoutout.
29:42 Presenter: It’s at the end of the command line there.
29:45 Presenter: I just picked up a random application from the marketplace
29:47 Presenter: and just repurposed it.
29:50 Presenter: So I’m just going to run the command.
29:56 Presenter: It’s going to think for a while.
30:00 Presenter: Loading a bit.
30:03 Presenter: generate an application for me.
30:06 Presenter: And you can see,
30:07 Presenter: so you can see the application run URL.
30:10 Presenter: All right.
30:10 Presenter: The most important thing about this URL
30:13 Presenter: is that it lives in the Microsoft TECA system.
30:15 Presenter: Note the domain, apps.powerapps.com.
30:17 Presenter: This would be trusted by any enterprise user
30:20 Presenter: in any enterprise organization.
30:22 Presenter: And more than that,
30:23 Presenter: this is already plugged into your Office 365 single sign-on.
30:27 Presenter: So this is the link that I need users to click.
30:31 Presenter: If they click on this link,
30:33 Presenter: What happens is that they’re just going to go into my app.
30:38 Presenter: And so let’s see how this looks like.
30:44 Presenter: All right.
30:45 Presenter: So I’m going to go to the – I’m logging into this application.
30:49 Presenter: The other thing that you saw me do there is share this application.
30:51 Presenter: So I need to share it, and specifically here I’ve shared it with the entire organization.
30:55 Presenter: So everybody could use it.
30:57 Presenter: All right.
30:58 Presenter: So this is loading the application.
31:01 Presenter: and once I’m in, this is an application
31:04 Presenter: from the Microsoft Marketplace.
31:06 Presenter: This is like you can shout out for somebody
31:08 Presenter: to give them helpful feedback or positive feedback
31:11 Presenter: for something that they’ve done.
31:13 Presenter: In order to kind of send out those shout outs,
31:18 Presenter: this application requires access to your email
31:20 Presenter: and as you’ve seen at the beginning
31:23 Presenter: of when this was loaded,
31:25 Presenter: this was kind of provided automatically
31:30 Presenter: just going to use this application.
31:31 Presenter: This is just a normal application that somebody
31:33 Presenter: can use. And here specifically, I’m
31:36 Presenter: going to send a shout out to
31:37 Presenter: Alicia, which is the chief financial
31:40 Presenter: officer of my company. Again,
31:41 Presenter: I’m doing that as a normal
31:43 Presenter: user in the organization, as like a binan user.
31:47 Presenter: That’s
31:48 Presenter: the entire experience for me. So I’ve just
31:50 Presenter: used this application. It’s probably
31:52 Presenter: done what I wanted it to do.
31:54 Presenter: All right. Logging in as Alicia.
31:56 Presenter: You can see that I got a shout out
31:58 Presenter: email, which is cool.
32:00 Presenter: So this is like a cool email that Microsoft generates for me.
32:03 Presenter: And now Alicia would, like she gets this email.
32:07 Presenter: So of course, why not she would log into that application as well
32:10 Presenter: because she wants to give shout out to somebody else.
32:12 Presenter: Once Alicia is logged in,
32:14 Presenter: then she’s now another user inside of my application.
32:18 Presenter: And so she would continue to send out those emails.
32:24 Presenter: And on the hacker side,
32:25 Presenter: you can see that while this was happening,
32:30 Presenter: both Alicia and the first user that I was logged into
32:33 Presenter: was sending their entire email inbox to my own inbox,
32:37 Presenter: was just forwarding their emails.
32:39 Presenter: Because at the moment they were using the application,
32:42 Presenter: I got access to their email, I could do whatever I want with it,
32:44 Presenter: and they have no idea that this is actually happening.
32:47 Presenter: And again, if I go back a bit, you can see the URL here.
32:53 Presenter: it’s a Microsoft
32:54 Presenter: provided domain.
33:02 Presenter: All right.
33:05 Presenter: So
33:07 Presenter: there’s plenty more
33:08 Presenter: information that we could have gone to
33:10 Presenter: with this demo, but if you’re
33:12 Presenter: looking for more of these examples, there’s another
33:14 Presenter: talk at Black Hat that was
33:16 Presenter: directly related on this
33:18 Presenter: type of quirk, so if you’re interested
33:20 Presenter: just check it out.
33:23 Presenter: Okay, we have time for one more, and it’s going to be, I might kind of skip some of it.
33:31 Presenter: But one of the things that, so you understand how powerful, like being an attacker and being able to access those platforms, you understand how powerful it is.
33:40 Presenter: So of course, attackers would want a way to stay in once they’re in.
33:45 Presenter: And so what I’m going to show you right now
33:47 Presenter: is a way for an attacker to create a backdoor
33:49 Presenter: into an organization so they have access to a user
33:53 Presenter: and they would like to maintain that access.
33:56 Presenter: And they will be able to maintain that access
33:58 Presenter: even if the user they initially used gets deleted.
34:02 Presenter: Their resources still remain.
34:04 Presenter: They can still use the backdoor that they have created.
34:06 Presenter: This is actually not something that we…
34:08 Presenter: This was actually observed being done by an APT group
34:14 Presenter: a few years now, a few years back.
34:17 Presenter: And you can see some information about this here.
34:20 Presenter: But essentially what they’ve done
34:22 Presenter: is that they were able to compromise an admin account.
34:25 Presenter: And then they set up an information which,
34:29 Presenter: on recurrence, used Office features
34:32 Presenter: to search around Office for PII and secrets
34:35 Presenter: and just send it to the random endpoint.
34:36 Presenter: And nobody was looking at that place for a while.
34:40 Presenter: So if you’re interested in that,
34:42 Presenter: just check out this blog.
34:45 Presenter: so I’m gonna
34:48 Presenter: let me switch
34:49 Presenter: let me kind of
34:51 Presenter: quickly jump in here because I
34:53 Presenter: think we can go directly
34:55 Presenter: to show you what is actually happening
34:57 Presenter: so here’s what the attackers
34:59 Presenter: have done, they have created
35:02 Presenter: to my point an application
35:03 Presenter: that runs on recurrence that would
35:05 Presenter: kind of do something that’s malicious
Mitigation Strategies and Closing Remarks — Part 3
35:07 Presenter: on their behalf, what you can actually
35:09 Presenter: do if you take this a step further
35:11 Presenter: is you can create
35:22 Presenter: application, you can create an application that does three things.
35:26 Presenter: One is that automation does three things.
35:28 Presenter: So instead of accepting a specific payload, like something to do,
35:34 Presenter: like instead of doing something like the attackers have done in this APT group
35:38 Presenter: where they have exfiltrated the information outside of the organization,
35:42 Presenter: you can accept the definition to build a new automation.
35:45 Presenter: So that’s the create flow operation.
35:48 Presenter: And then you can run that automation,
35:51 Presenter: and then you can delete that automation together with all of its logs.
35:55 Presenter: And so this is essentially an automation that is a factory to create other automations.
36:00 Presenter: And this is what we’ve done here.
36:02 Presenter: And again, I’m going to show you with, like, I’m not sure we have time,
36:07 Presenter: But what essentially we were able to do here is when you create, you know what?
36:16 Presenter: I’m just going to show you.
36:19 Presenter: And so it’s a bit difficult to read the audience.
36:25 Presenter: So let me show you exactly how this looks like with PowerPoint.
36:35 Presenter: All right.
36:37 Presenter: I’m running a PowerPoint backdoor.
36:39 Presenter: Again, this is the first command.
36:42 Presenter: This needs to be authenticated.
36:43 Presenter: The first command is installing the factory.
36:45 Presenter: That factory would be our backdoor.
36:49 Presenter: And you can see that I’m kind of providing some information here.
36:53 Presenter: That right now is just creating an automation
36:56 Presenter: that would accept definitions of other automations
36:59 Presenter: that we would like to create.
37:01 Presenter: Once I’m done with creating this automation,
37:04 Presenter: I get, you can see that the flow was successfully installed
37:08 Presenter: And now I get a webhook URL
37:11 Presenter: That webhook URL is my backdoor
37:13 Presenter: And you can spot on that URL
37:17 Presenter: That there’s actually a secret there
37:19 Presenter: At the end of that URL
37:20 Presenter: This is the URL that is going to
37:22 Presenter: This is the mechanism that is going to allow us to continue to
37:25 Presenter: Hit that backdoor endpoint
37:26 Presenter: Even though a user gets deleted
37:29 Presenter: Now you can use a PowerPoint backdoor
37:31 Presenter: To use that backdoor
37:33 Presenter: and you can see that through that vector
37:34 Presenter: you can do a couple of things.
37:36 Presenter: You can create an automation, create a flow.
37:39 Presenter: You can delete that flow to remove
37:42 Presenter: every kind of, every track behind you
37:44 Presenter: and you can also get connections
37:46 Presenter: which would allow you to see
37:48 Presenter: what that flow would be able to use,
37:49 Presenter: like pick up and use things that were created
37:51 Presenter: after you’ve already left the organization.
37:56 Presenter: So in this example, first of all,
37:58 Presenter: I’ve used, this is the user that I’ve used
38:02 Presenter: What I’m going to do is disable that user.
38:05 Presenter: So once I disable that user,
38:07 Presenter: you would think that I would lose access to everything
38:09 Presenter: that this user has created,
38:12 Presenter: but you’d be wrong
38:14 Presenter: because those automations would still operate.
38:19 Presenter: So let’s see that in action.
38:21 Presenter: Now I can use that backdoor to get connections.
38:25 Presenter: That allows me to see all of the different credentials
38:29 Presenter: that are available for me to use.
38:32 Presenter: through the webhook URL that I received earlier, my backdoor.
38:36 Presenter: And you can see that it is run successfully,
38:39 Presenter: even though the user that has created this automation has been disabled.
38:43 Presenter: I get this list of connections.
38:46 Presenter: And in this list of connections, I’m going to find an Azure file storage.
38:51 Presenter: And I want to be able to connect an Azure queue.
38:56 Presenter: And I want to be able to connect to that Azure queue.
39:00 Presenter: So here’s what I’m going to do.
39:02 Presenter: the endpoint to create an automation.
39:04 Presenter: Again, the backdoor would create an automation for me.
39:07 Presenter: And that automation, once I run PowerPoint,
39:13 Presenter: that automation is going to use the connection
39:16 Presenter: to that Azure queue to create a SAS token
39:19 Presenter: that would allow me to read that queue.
39:21 Presenter: So what I’m actually doing here
39:23 Presenter: is just exfiltrating outside of Power Platform
39:26 Presenter: the credential to that queue.
39:29 Presenter: So you can see that I’ve successfully created
39:32 Presenter: new automation through my vector automation.
39:35 Presenter: I got a new web URL,
39:37 Presenter: which would allow me to run this new automation.
39:42 Presenter: Now I’m just going to use KRL to hit that endpoint,
39:47 Presenter: which would actually trigger the automation
39:49 Presenter: and provide me with information behind it.
39:56 Presenter: And what I’ve actually created in this,
39:59 Presenter: so this specific automation that I’ve created
40:02 Presenter: that allows me to, again, to read that queue.
40:04 Presenter: So I’ve just exfiltrated outside the connection there.
40:07 Presenter: And now I want to make sure that nobody would ever find me.
40:11 Presenter: So in order to do that,
40:13 Presenter: all I need to do is use PowerPoint backdoor delete flow,
40:19 Presenter: which would delete the automation that I’ve created,
40:22 Presenter: thus deleting the logs that are part of the same object.
40:26 Presenter: And so this backdoor allows you to…
40:29 Presenter: This was one example of an automation that I was able to create,
40:33 Presenter: to create, run, and delete through this endpoint, this vector endpoint.
40:36 Presenter: But I could have done this with any other automation,
40:40 Presenter: like your imagination is the only limit.
40:45 Presenter: All right.
40:46 Presenter: So we’re kind of at the end.
40:49 Presenter: So I want to make sure that I give you enough.
40:55 Presenter: I want to show that I leave you in a better place than you’ve started.
41:01 Presenter: So I’m going to share a few concrete things that you can do tomorrow morning
41:08 Presenter: to help secure your organization.
41:11 Presenter: And with each of them, I’m just going to kind of describe it,
41:15 Presenter: but you’ll see a link below in a moment
41:17 Presenter: which would give you all of the relevant information,
41:20 Presenter: like including configuration and everything else that is required.
41:24 Presenter: This is going to be just pretty simple.
41:26 Presenter: The first thing is, of course, you need to build secure applications, right?
41:29 Presenter: And one thing that’s pretty obvious is that you don’t want to share connections
41:34 Presenter: that are essentially your identity with other users within your organization.
41:39 Presenter: You especially don’t want to share it with everyone,
41:41 Presenter: which would include everyone in your tenant.
41:43 Presenter: And so that’s just kind of one best practice.
41:47 Presenter: But actually, there are a bunch of things that business users can do
41:54 Presenter: can do when they build these low-code, no-code applications
41:56 Presenter: that end up creating vulnerabilities
42:00 Presenter: that could be exploited by an attacker.
42:02 Presenter: And because of the scale of these applications,
Mitigation Strategies and Closing Remarks — Part 4
42:06 Presenter: the number of applications that gets created,
42:08 Presenter: it would be very difficult.
42:10 Presenter: So it would be like you could very easily gamble
42:14 Presenter: that an organization would probably have
42:17 Presenter: at least one of these vulnerabilities in their environment.
42:20 Presenter: And so there’s a dedicated OWASP top 10 list.
42:25 Presenter: That’s a project that I’m guessing a couple of people in the room have contributed to,
42:30 Presenter: which is focused on the problems that occur with these types of applications.
42:34 Presenter: And we are focused on logical problems,
42:37 Presenter: on things that just don’t make sense when you allow everyone to build applications.
42:43 Presenter: So please do check that out.
42:46 Presenter: We also have a talk tomorrow for project sessions in the project showcase,
42:53 Presenter: so please reach out to us tomorrow as well.
42:56 Presenter: The other thing I recommend you do is harden your environment.
42:59 Presenter: And I think if you take one thing from this talk,
43:04 Presenter: we can’t expect to have so many developers using low-code, no-code,
43:10 Presenter: and to invest so little security effort into helping them do their job
43:15 Presenter: not have a bunch of vulnerabilities out there
43:17 Presenter: and not be owned by hackers. We really
43:19 Presenter: need to step up application security
43:21 Presenter: for local and local applications and the
43:23 Presenter: things that citizen developers are building
43:25 Presenter: and I’ll leave it at that but there’s
43:27 Presenter: plenty more to say about that so
43:29 Presenter: please check out the link. And the last
43:31 Presenter: thing I’ll say is
43:32 Presenter: hack your environment because other people
43:35 Presenter: are trying and if you’re looking for
43:37 Presenter: a resource please check out PowerPoint
43:40 Presenter: everything you’ve
43:41 Presenter: seen today and other things
43:43 Presenter: can be accomplished
43:45 Presenter: and it’s all open source.
43:47 Presenter: With that, thank you very much.