1
00:00:00,240 --> 00:00:01,073
- Yeah.

2
00:00:01,073 --> 00:00:03,960
So please join me in
welcoming Michael Bargury

3
00:00:03,960 --> 00:00:06,030
for Low Code High Risk:

4
00:00:06,030 --> 00:00:08,463
Enterprise Domination via Low Code Abuse.

5
00:00:09,733 --> 00:00:12,733
(audience clapping)

6
00:00:19,183 --> 00:00:20,623
- Hi, everyone.

7
00:00:20,623 --> 00:00:23,103
So, first of all, thank you for staying.

8
00:00:24,353 --> 00:00:25,603
This is a difficult time,

9
00:00:26,508 --> 00:00:29,105
but we are gonna have some fun today.

10
00:00:29,105 --> 00:00:33,483
So, this talk is gonna focus
on how do we take low code,

11
00:00:34,591 --> 00:00:38,427
which is kind of technologies
that are about enabling users,

12
00:00:38,427 --> 00:00:39,780
users to build their own things

13
00:00:39,780 --> 00:00:42,440
and seeing how attackers are using that

14
00:00:42,440 --> 00:00:44,130
to basically own the enterprise.

15
00:00:44,130 --> 00:00:46,743
And this entire talk
is based on the attacks

16
00:00:46,743 --> 00:00:48,690
that we've observed in the world

17
00:00:48,690 --> 00:00:50,490
that we are going to recreate today.

18
00:00:54,060 --> 00:00:55,718
My name is Michael.

19
00:00:55,718 --> 00:00:57,700
I've been doing security
for a long time now,

20
00:00:57,700 --> 00:01:00,337
I spent a few years at Microsoft, on IoT,

21
00:01:01,483 --> 00:01:02,463
and APIs and cloud.

22
00:01:03,886 --> 00:01:06,065
If you've seen my first talk this morning,

23
00:01:06,065 --> 00:01:10,083
so thank you again for coming
and I hope I don't bore you.

24
00:01:12,649 --> 00:01:16,090
Other than that, I've started
a company called Zenity

25
00:01:17,850 --> 00:01:19,652
a year and a half ago.

26
00:01:19,652 --> 00:01:21,846
We're focused low-code/no-code security.

27
00:01:21,846 --> 00:01:24,415
That's how we got to observe this space.

28
00:01:24,415 --> 00:01:28,170
And this entire research featuring
research from Wales Berg,

29
00:01:28,170 --> 00:01:29,901
which is sitting right here.

30
00:01:29,901 --> 00:01:31,447
So giving some love.

31
00:01:31,447 --> 00:01:35,079
(audience clapping)

32
00:01:35,079 --> 00:01:36,002
Thank you.

33
00:01:36,002 --> 00:01:37,290
And I'm really excited to
be here my first Defcon.

34
00:01:37,290 --> 00:01:39,123
So, it's been really amazing.

35
00:01:41,070 --> 00:01:42,063
To show disclaimer,

36
00:01:42,983 --> 00:01:46,076
this talk gives them attacker's
perspective on low code,

37
00:01:46,076 --> 00:01:49,402
but of course, we are all
full low code development.

38
00:01:49,402 --> 00:01:52,330
This is the trend of
low-code is really cool

39
00:01:53,432 --> 00:01:55,950
providing users the ability
to build stuff on their own,

40
00:01:55,950 --> 00:01:58,094
but it's important to do it securely.

41
00:01:58,094 --> 00:01:59,753
So that's why we're giving this talk.

42
00:02:01,519 --> 00:02:02,352
Here's what we're gonna do today.

43
00:02:02,352 --> 00:02:06,343
We'll start off with making
sure we all understand

44
00:02:06,343 --> 00:02:07,193
what low code is.

45
00:02:09,063 --> 00:02:10,249
We'll then dive into attacks

46
00:02:10,249 --> 00:02:13,320
that we've observed in the
world on low-code platforms.

47
00:02:13,320 --> 00:02:15,813
We'll start with living
off the land attack.

48
00:02:16,690 --> 00:02:18,990
So cases where attackers
are using low-code

49
00:02:18,990 --> 00:02:21,900
to basically do whatever they
want inside the enterprise.

50
00:02:21,900 --> 00:02:26,900
The second part would be,
how do you remain persistent?

51
00:02:27,330 --> 00:02:30,633
How do you establish persistency
through low code platforms?

52
00:02:31,577 --> 00:02:34,260
And then we'll go to
predictable mis-configurations

53
00:02:34,260 --> 00:02:37,680
and how those are abused,
who are outside in scanning.

54
00:02:37,680 --> 00:02:39,860
We'll finish off with two things.

55
00:02:39,860 --> 00:02:42,700
One is you'll have a couple more tools

56
00:02:43,542 --> 00:02:46,132
in your red team arsenal
to play around with.

57
00:02:46,132 --> 00:02:48,120
And the second thing is how
to protect your organization.

58
00:02:48,120 --> 00:02:49,770
So we'll go through that as well.

59
00:02:51,513 --> 00:02:53,040
So, let's start.

60
00:02:53,040 --> 00:02:56,883
Low code is really all about
empowering of business users.

61
00:02:57,765 --> 00:03:01,180
So the idea is basically business users

62
00:03:02,138 --> 00:03:02,971
are tired of waiting for IT,

63
00:03:02,971 --> 00:03:05,703
they want to solve their own
things, their own problems.

64
00:03:06,674 --> 00:03:08,760
And so they have these
drag and drop interfaces,

65
00:03:08,760 --> 00:03:12,185
which allow them to create
applications and automations.

66
00:03:12,185 --> 00:03:13,018
And the crucial piece here

67
00:03:13,018 --> 00:03:14,890
is that it's built on top of platforms

68
00:03:15,751 --> 00:03:17,483
that you already know and
will see that in a moment.

69
00:03:18,468 --> 00:03:21,120
If this idea of enabling business users

70
00:03:21,120 --> 00:03:23,313
to build their own thing, sounds familiar,

71
00:03:24,285 --> 00:03:26,010
well, there's a long history behind it.

72
00:03:26,010 --> 00:03:31,010
So software that allowed
you to record your keyboard

73
00:03:33,540 --> 00:03:36,000
and your mouse, and then
reiterate that for automation,

74
00:03:36,000 --> 00:03:40,150
there are macros, which are
of course, our close friends

75
00:03:41,905 --> 00:03:45,453
and there's low code now that
there is on the same access.

76
00:03:47,669 --> 00:03:49,740
And people are building all
kinds of things with it.

77
00:03:49,740 --> 00:03:54,360
So than that automation, for example,

78
00:03:54,360 --> 00:03:58,388
every time I get an
email with an attachment

79
00:03:58,388 --> 00:04:00,303
store that attachment in Google Drive,

80
00:04:01,234 --> 00:04:03,180
applications like handling receipts

81
00:04:03,180 --> 00:04:07,800
or onboarding and offboarding users.

82
00:04:07,800 --> 00:04:10,980
There's really lots and
lots of business cases

83
00:04:10,980 --> 00:04:13,140
for this kind of applications.

84
00:04:13,140 --> 00:04:14,970
And the crucial thing is,

85
00:04:14,970 --> 00:04:18,213
this is all already in all of
the enterprises in the world,

86
00:04:19,098 --> 00:04:21,990
and it's not because they made
the kind of conscious choice

87
00:04:21,990 --> 00:04:23,469
to do it,

88
00:04:23,469 --> 00:04:26,402
it's because the vendors
that you're seeing up here,

89
00:04:26,402 --> 00:04:29,530
but also others have basically
built a low code platform

90
00:04:31,474 --> 00:04:33,810
around existing services
that they already have.

91
00:04:33,810 --> 00:04:37,680
So if you are a Microsoft shop
or if you just have office,

92
00:04:37,680 --> 00:04:40,921
every user can build
automations and applications

93
00:04:40,921 --> 00:04:43,335
based on their own
identities within office.

94
00:04:43,335 --> 00:04:44,813
And this is something
that you already have

95
00:04:44,813 --> 00:04:45,646
in your organization today.

96
00:04:45,646 --> 00:04:47,910
The same thing applies for
Salesforce and ServiceNow

97
00:04:47,910 --> 00:04:49,830
and all of the logos
that you're seeing here.

98
00:04:49,830 --> 00:04:54,480
So this is by definition
also already inside your org

99
00:04:54,480 --> 00:04:56,343
and touching business data.

100
00:04:57,630 --> 00:05:01,650
So, here's a very quick
recap on what low code is.

101
00:05:01,650 --> 00:05:04,230
We've discussed that it's available

102
00:05:04,230 --> 00:05:06,159
in each major enterprise.

103
00:05:06,159 --> 00:05:09,161
Actually, what we're seeing
is that in every organization

104
00:05:09,161 --> 00:05:09,994
that we are starting to work with,

105
00:05:09,994 --> 00:05:13,570
there are tens of thousands
of these applications,

106
00:05:13,570 --> 00:05:15,210
and these are not exaggerated numbers.

107
00:05:15,210 --> 00:05:18,217
Tens of thousands of
applications being built

108
00:05:18,217 --> 00:05:19,050
by business users.

109
00:05:19,050 --> 00:05:19,920
People in IT, people in HR,

110
00:05:19,920 --> 00:05:21,540
they are all building their own things.

111
00:05:21,540 --> 00:05:23,218
And you'll see in a moment

112
00:05:23,218 --> 00:05:25,133
that it takes just a couple of minutes.

113
00:05:27,627 --> 00:05:31,050
We've seen that this by definition

114
00:05:31,050 --> 00:05:33,786
has access to business data
or powers business processes,

115
00:05:33,786 --> 00:05:35,389
because that's what it's meant for.

116
00:05:35,389 --> 00:05:37,080
And it runs as SaaS, which is important

117
00:05:37,080 --> 00:05:40,730
because all of the controls
that you're used to.

118
00:05:40,730 --> 00:05:42,840
Well, they're not there, this
runs on the vendors cloud.

119
00:05:42,840 --> 00:05:45,666
So, on Microsoft cloud,
on Salesforce cloud.

120
00:05:45,666 --> 00:05:48,120
And the last piece is that
this is vastly underrated

121
00:05:48,120 --> 00:05:49,533
by IT and security teams.

122
00:05:50,527 --> 00:05:53,010
So people have started noticing this area,

123
00:05:53,010 --> 00:05:55,773
but there's a lot more to go there.

124
00:05:58,664 --> 00:06:02,347
So that was the recap, that
was the kind of figuring out,

125
00:06:02,347 --> 00:06:04,320
making sure we're all on the
same page on what low code is.

126
00:06:04,320 --> 00:06:06,960
The next part is observing attacks.

127
00:06:06,960 --> 00:06:10,023
And before, we are going
to, and by the way,

128
00:06:10,957 --> 00:06:12,324
this part will be heavily focused

129
00:06:12,324 --> 00:06:14,520
on Microsoft power platform,
which is built around office

130
00:06:14,520 --> 00:06:16,500
simply because many people are using it.

131
00:06:16,500 --> 00:06:17,430
It's very successful.

132
00:06:17,430 --> 00:06:20,370
And so hackers are using it as well.

133
00:06:20,370 --> 00:06:25,370
Before we start figuring out
how hacks live off the land

134
00:06:25,640 --> 00:06:28,240
of low-code/no-code and
specifically power platform.

135
00:06:29,460 --> 00:06:32,763
Just make sure that we all
understand how this looks like.

136
00:06:34,591 --> 00:06:36,593
So this is gonna be a very quick example.

137
00:06:37,824 --> 00:06:39,450
And let me play while I explain,

138
00:06:39,450 --> 00:06:41,610
basically this is a
very simple automation.

139
00:06:41,610 --> 00:06:45,240
It's gonna be built in
a couple of minutes.

140
00:06:45,240 --> 00:06:47,880
This automation does one
thing when I'm in slack

141
00:06:47,880 --> 00:06:50,880
and somebody mentions
me on a common channel.

142
00:06:50,880 --> 00:06:54,660
It's very annoying because I
always have to respond quickly

143
00:06:54,660 --> 00:06:57,659
because it's in a common
channel, everybody's seeing.

144
00:06:57,659 --> 00:07:01,590
So this automation, every time
that somebody mentions me,

145
00:07:01,590 --> 00:07:04,080
it changes my status as if I'm on a call,

146
00:07:04,080 --> 00:07:06,480
then that person could figure out

147
00:07:06,480 --> 00:07:08,130
that I'm not available right now.

148
00:07:09,090 --> 00:07:13,215
And then, of course, it
moves me back to a status

149
00:07:13,215 --> 00:07:15,810
that is clear so nobody
will suspect anything.

150
00:07:15,810 --> 00:07:19,503
And you'll seeing that in
order to build this automation,

151
00:07:20,429 --> 00:07:24,240
I'm dragging and dropping,
I'm going to do select boxes.

152
00:07:24,240 --> 00:07:26,340
These are things that everybody can do.

153
00:07:26,340 --> 00:07:28,110
And that's the power of this technology.

154
00:07:28,110 --> 00:07:29,193
That's also the risk.

155
00:07:31,546 --> 00:07:33,603
One of the key parts to notice here,

156
00:07:34,439 --> 00:07:36,780
and I'm gonna stop it
somewhere along the way,

157
00:07:36,780 --> 00:07:39,466
is the fact that you haven't seen

158
00:07:39,466 --> 00:07:41,940
any sort of authentication,
keep in mind this is API,

159
00:07:41,940 --> 00:07:44,410
one of those platforms going out to slack

160
00:07:45,390 --> 00:07:49,571
with my own identity and
changing stuff, right?

161
00:07:49,571 --> 00:07:50,580
But you haven't seen any window pop up.

162
00:07:50,580 --> 00:07:52,320
You haven't seen any over flow.

163
00:07:52,320 --> 00:07:54,030
So how exactly does this happen?

164
00:07:54,030 --> 00:07:56,320
This is very important
in order to understand

165
00:07:57,270 --> 00:07:59,213
how attacks are been
made on those platforms.

166
00:08:03,136 --> 00:08:05,728
So here's a step by step of what happens

167
00:08:05,728 --> 00:08:09,213
when you create a new
automation with low-code.

168
00:08:10,120 --> 00:08:11,280
The first step is that
you pick from a list

169
00:08:11,280 --> 00:08:14,070
of lots and lots of applications,

170
00:08:14,070 --> 00:08:18,630
those could be SaaS
applications on-prem connectors.

171
00:08:18,630 --> 00:08:21,731
Those are basically hundreds
and hundreds of connectors

172
00:08:21,731 --> 00:08:22,980
that are being provided
by the platform themselves

173
00:08:22,980 --> 00:08:24,840
to connect wherever you'd like.

174
00:08:24,840 --> 00:08:27,910
The second thing is that there
is this O of consent flow

175
00:08:29,001 --> 00:08:30,822
that basically allows the application

176
00:08:30,822 --> 00:08:32,423
to operate on your behalf as a user,

177
00:08:33,270 --> 00:08:38,070
but notice the last part and
specifically the shell button.

178
00:08:38,070 --> 00:08:42,270
So something is going on here, right?

179
00:08:42,270 --> 00:08:45,860
There's an application, it
logs in on a user's behalf

180
00:08:45,860 --> 00:08:46,919
to slack.

181
00:08:46,919 --> 00:08:48,510
And then somehow it's able to share

182
00:08:48,510 --> 00:08:52,920
that user's authentication
with slack with other users.

183
00:08:52,920 --> 00:08:56,840
And so the next thing we're
going to try and figure out

184
00:08:56,840 --> 00:08:57,863
is how does this work?

185
00:08:59,250 --> 00:09:03,460
So on one side we have
ZPL or power automate

186
00:09:04,328 --> 00:09:06,480
or other automation tools
that are part of low-code.

187
00:09:06,480 --> 00:09:08,340
And on the other side, we have slack.

188
00:09:08,340 --> 00:09:10,770
And again, the idea is to figure out

189
00:09:10,770 --> 00:09:12,138
how does this authentication work

190
00:09:12,138 --> 00:09:15,030
and especially how does
connection sharing work.

191
00:09:15,030 --> 00:09:17,583
So here's how they do it.

192
00:09:18,474 --> 00:09:21,138
Instead of going through the usual layout

193
00:09:21,138 --> 00:09:22,800
of kind of ABAP and asking for permissions

194
00:09:22,800 --> 00:09:24,330
for user separately,

195
00:09:24,330 --> 00:09:29,330
they simply copy the refresh
tokens and then replay them.

196
00:09:30,607 --> 00:09:34,590
So you do the consent flow for slack

197
00:09:34,590 --> 00:09:37,023
power automate will
store your refresh token.

198
00:09:37,918 --> 00:09:41,643
And then you can share that
refresh token with other users.

199
00:09:41,643 --> 00:09:42,799
So power automate.

200
00:09:42,799 --> 00:09:44,130
Now, of course, from Slack's perspective

201
00:09:44,130 --> 00:09:47,280
or from a network security perspective,

202
00:09:47,280 --> 00:09:48,660
there's no sharing here, right?

203
00:09:48,660 --> 00:09:49,620
It's the user,

204
00:09:49,620 --> 00:09:52,380
the is always the one
that's doing the operations.

205
00:09:52,380 --> 00:09:55,687
It doesn't matter if an
application is using it.

206
00:09:55,687 --> 00:09:58,290
If other users are using
it, this is a crucial point.

207
00:09:58,290 --> 00:10:01,600
These applications are basically breaking

208
00:10:02,508 --> 00:10:04,900
the permission model that
we're used to in SaaS

209
00:10:05,748 --> 00:10:07,523
and in connectivity between applications.

210
00:10:09,310 --> 00:10:10,697
Okay.

211
00:10:10,697 --> 00:10:12,564
Now that we figure that out,

212
00:10:12,564 --> 00:10:14,532
let's see what attackers
are doing with it.

213
00:10:14,532 --> 00:10:16,860
So the first thing that
we need to understand

214
00:10:16,860 --> 00:10:20,130
is that because you've seen how easy it is

215
00:10:20,130 --> 00:10:22,080
to create these applications.

216
00:10:22,080 --> 00:10:26,066
And lots of more people can
create these applications.

217
00:10:26,066 --> 00:10:28,462
That means that you get lots and lots

218
00:10:28,462 --> 00:10:29,450
and lots of applications.

219
00:10:29,450 --> 00:10:31,470
These are all examples
from the market prices

220
00:10:31,470 --> 00:10:32,760
of the different vendors.

221
00:10:32,760 --> 00:10:35,910
And maybe you can see the
numbers, it might be too small,

222
00:10:35,910 --> 00:10:38,280
but there are hundreds of
thousands of those being deployed.

223
00:10:38,280 --> 00:10:41,010
And again, we see that in
enterprise all of the time.

224
00:10:41,010 --> 00:10:44,100
And the important thing
here is actually the logos

225
00:10:44,100 --> 00:10:48,780
because behind every logo in
these processes, there's data,

226
00:10:48,780 --> 00:10:50,070
there's connection to data,

227
00:10:50,070 --> 00:10:53,370
or there's the ability to
do all sorts of operation.

228
00:10:53,370 --> 00:10:56,823
So behind every one of those applications,

229
00:10:56,823 --> 00:10:58,950
those tens of thousands of
applications within enterprises,

230
00:10:58,950 --> 00:11:00,480
there's a trail of connections,

231
00:11:00,480 --> 00:11:03,660
a trail of connections that
can be shared with other users.

232
00:11:03,660 --> 00:11:06,660
And actually it's not
only that it can be shared

233
00:11:06,660 --> 00:11:08,490
in many cases, that's the default.

234
00:11:08,490 --> 00:11:12,660
So if you look at the Microsoft
Power platform, for example,

235
00:11:12,660 --> 00:11:16,080
if you look at Zapier over
other platforms as well,

236
00:11:16,080 --> 00:11:20,543
they all have a notion
of a default environment,

237
00:11:20,543 --> 00:11:22,847
some place where you create an application

238
00:11:22,847 --> 00:11:23,680
and you don't think about it,

239
00:11:23,680 --> 00:11:25,350
the connection will go there

240
00:11:25,350 --> 00:11:28,200
and other users can just
pick it up and use it.

241
00:11:28,200 --> 00:11:31,238
So those are examples of
that default environment

242
00:11:31,238 --> 00:11:32,071
from different vendors.

243
00:11:32,071 --> 00:11:35,130
Again, this is not a
problem with one platform.

244
00:11:35,130 --> 00:11:39,150
This is a basic concept of
how this technology works.

245
00:11:39,150 --> 00:11:41,874
And so every platform
has their own version

246
00:11:41,874 --> 00:11:42,707
of this default environment.

247
00:11:42,707 --> 00:11:44,490
And when you have access to
this default environment,

248
00:11:44,490 --> 00:11:47,490
you get access to tons
and tons of connections

249
00:11:47,490 --> 00:11:48,630
across the organization.

250
00:11:48,630 --> 00:11:53,630
And I'm talking about from
what we've seen SQL servers

251
00:11:54,009 --> 00:11:55,350
with route accounts users,

252
00:11:55,350 --> 00:11:59,850
the users own identities
to office and to slack,

253
00:11:59,850 --> 00:12:01,020
FTP connections.

254
00:12:01,020 --> 00:12:02,700
All of the things that
you could think about

255
00:12:02,700 --> 00:12:05,520
that users are using these platforms for.

256
00:12:05,520 --> 00:12:09,930
So what we are seeing
hackers do very easily

257
00:12:09,930 --> 00:12:13,289
is once they get into an enterprise,

258
00:12:13,289 --> 00:12:15,679
once they find at least one user's account

259
00:12:15,679 --> 00:12:16,800
and they're able to log into their SaaS,

260
00:12:16,800 --> 00:12:20,501
they can very easily
escalate their privileges.

261
00:12:20,501 --> 00:12:22,920
Like it's already there, it's built in.

262
00:12:22,920 --> 00:12:25,200
So that's really, really, really simple.

263
00:12:25,200 --> 00:12:26,940
But the next thing that they'll do

264
00:12:26,940 --> 00:12:28,590
is that they'll use these connections

265
00:12:28,590 --> 00:12:31,860
that are part of the platform

266
00:12:31,860 --> 00:12:34,294
and they do a bunch of things with it.

267
00:12:34,294 --> 00:12:36,536
So here's an example of ransomware attack.

268
00:12:36,536 --> 00:12:38,310
And again, these are all
attacks that we've observed

269
00:12:38,310 --> 00:12:39,450
and recreated.

270
00:12:39,450 --> 00:12:43,540
So in this example, I'm going
through a SharePoint site

271
00:12:44,446 --> 00:12:47,320
on a schedule and I'm
simply encrypting every file

272
00:12:48,186 --> 00:12:49,084
on the SharePoint

273
00:12:49,084 --> 00:12:52,202
with the comfortably
provided encryption function

274
00:12:52,202 --> 00:12:54,270
within power automate Microsoft platform.

275
00:12:54,270 --> 00:12:57,690
So again, ransomware here
is just really, really,

276
00:12:57,690 --> 00:13:01,380
really easy, and this is ransomware

277
00:13:01,380 --> 00:13:02,790
without installing any agents,

278
00:13:02,790 --> 00:13:05,373
without going through the network.

279
00:13:05,373 --> 00:13:07,953
This is all on the SaaS cloud.

280
00:13:10,918 --> 00:13:12,719
The other thing that
we're seeing people do

281
00:13:12,719 --> 00:13:15,527
is exfiltrate the data
outside of the organization.

282
00:13:15,527 --> 00:13:16,727
This is a crucial piece.

283
00:13:19,231 --> 00:13:21,630
So when you think about how do
we protect from data leakage,

284
00:13:21,630 --> 00:13:24,683
we can go at it through the network.

285
00:13:24,683 --> 00:13:28,320
We can tie and scan storage
accounts and cloud accounts,

286
00:13:28,320 --> 00:13:30,390
but because these platforms,

287
00:13:30,390 --> 00:13:33,210
they mix up identities of different users

288
00:13:33,210 --> 00:13:36,000
and you can also plug in
your personal identities.

289
00:13:36,000 --> 00:13:39,003
Then you don't really have
access to scan everything here.

290
00:13:40,131 --> 00:13:42,150
So for example, in this
example, which we've seen,

291
00:13:42,150 --> 00:13:44,940
I think in every organization
that we are working with,

292
00:13:44,940 --> 00:13:49,940
we find what people are
doing in order to send email

293
00:13:52,097 --> 00:13:53,250
a corporate email to their Gmail account,

294
00:13:53,250 --> 00:13:55,270
they're simply copying the content

295
00:13:56,183 --> 00:13:57,444
instead of forwarding the email.

296
00:13:57,444 --> 00:13:58,770
And then really there's nothing you can do

297
00:13:58,770 --> 00:14:01,820
outside of the platform
to even catch this.

298
00:14:01,820 --> 00:14:05,943
Because remember, this is
impersonating the user.

299
00:14:06,857 --> 00:14:09,413
It's not going through any
sort of approval process.

300
00:14:10,649 --> 00:14:13,170
So data exfiltration is really easy here.

301
00:14:13,170 --> 00:14:16,533
We've seen this, not only
with emails, but with other,

302
00:14:18,246 --> 00:14:19,331
you can do it with other things as well.

303
00:14:19,331 --> 00:14:22,020
So for example, creating
a useful application

304
00:14:22,020 --> 00:14:23,670
and then even by mistakes,

305
00:14:23,670 --> 00:14:27,126
towing its data in your
own personal draw books,

306
00:14:27,126 --> 00:14:29,070
because you can mix and match
these things very easily.

307
00:14:29,070 --> 00:14:32,673
So, we're seeing this
again, multiple times.

308
00:14:34,662 --> 00:14:37,080
Another thing you can do,
which is actually kind of weird

309
00:14:37,080 --> 00:14:40,563
is that you can jump from the
cloud to people's laptops.

310
00:14:41,468 --> 00:14:45,519
And that's because these
platforms have a component

311
00:14:45,519 --> 00:14:46,638
that's called RPA,

312
00:14:46,638 --> 00:14:49,532
which is about automation
on the user side,

313
00:14:49,532 --> 00:14:50,435
on the laptop side.

314
00:14:50,435 --> 00:14:53,742
We actually had another
talk on this earlier today.

315
00:14:53,742 --> 00:14:56,142
So the materials are there in the link

316
00:14:56,142 --> 00:14:59,040
and you can find it
online, but it's very easy

317
00:14:59,040 --> 00:15:01,710
once you have access to
those shared connections,

318
00:15:01,710 --> 00:15:04,540
some of those shared connections
are actually privileges

319
00:15:05,427 --> 00:15:08,492
to execute something, a
payload only use those machine.

320
00:15:08,492 --> 00:15:09,510
And then you can just pick
it up and use it again.

321
00:15:09,510 --> 00:15:12,153
The same thing that we've
seen for lateral movement.

322
00:15:14,481 --> 00:15:15,993
So as you can see,

323
00:15:15,993 --> 00:15:19,350
there's a lot of risk in
these overshared connections,

324
00:15:19,350 --> 00:15:22,435
which are, again, recall,

325
00:15:22,435 --> 00:15:25,293
these are wrappers around refresh tokens.

326
00:15:26,179 --> 00:15:28,388
This means that from the outside,

327
00:15:28,388 --> 00:15:30,063
you want to be able to figure out

328
00:15:30,063 --> 00:15:31,983
that there has been a shell.

329
00:15:32,910 --> 00:15:36,304
So that's one user that's
simply reusing that connection

330
00:15:36,304 --> 00:15:37,203
again and again.

331
00:15:37,203 --> 00:15:39,903
In order to make it easy
for us and for you as well,

332
00:15:40,806 --> 00:15:42,558
to kinda figure out whether this happens

333
00:15:42,558 --> 00:15:43,391
within your organization

334
00:15:43,391 --> 00:15:46,563
and to plug it into part of
your kind of red team arsenal,

335
00:15:47,540 --> 00:15:49,560
we've built a small tool
that basically allows you

336
00:15:49,560 --> 00:15:54,360
to plug in a user and get a table

337
00:15:54,360 --> 00:15:56,664
with all of the different connections

338
00:15:56,664 --> 00:15:58,227
that user has access to,

339
00:15:58,227 --> 00:16:01,980
which users are those
connections belong to.

340
00:16:01,980 --> 00:16:04,230
So that's all available very quickly.

341
00:16:04,230 --> 00:16:08,343
You'll see that tool it's less
than a hundred lines of code.

342
00:16:09,281 --> 00:16:10,114
It's very, very, very easy.

343
00:16:10,114 --> 00:16:12,453
So feel free to kinda use
it and play around with it.

344
00:16:15,804 --> 00:16:19,590
The next piece I want to talk
about is how do we make...

345
00:16:19,590 --> 00:16:22,450
So, let's say that we
got into an organization

346
00:16:23,451 --> 00:16:25,793
and we're seeing those sales
connections, but we want more.

347
00:16:25,793 --> 00:16:29,462
We want to entice users to
create those connections.

348
00:16:29,462 --> 00:16:32,763
And we want to own a specific
user identity, for example.

349
00:16:33,799 --> 00:16:37,350
What we can do here is we
can set up a bait application

350
00:16:37,350 --> 00:16:40,810
that basically asks, for
example, your email connection

351
00:16:41,719 --> 00:16:43,290
with a good reason for that.

352
00:16:43,290 --> 00:16:45,895
But then we can use that email connection

353
00:16:45,895 --> 00:16:47,400
while the user is connected
to do whatever we want.

354
00:16:47,400 --> 00:16:50,583
Of course, this is not special
to low-code applications.

355
00:16:51,531 --> 00:16:52,364
Every application can do that.

356
00:16:53,987 --> 00:16:56,140
The key thing here is
that somebody from HR

357
00:16:56,978 --> 00:16:59,259
can create this application,
somebody from finance.

358
00:16:59,259 --> 00:17:04,259
So there's a much lower bar
to create these applications.

359
00:17:05,899 --> 00:17:08,477
And there's also another
crucial piece here.

360
00:17:08,477 --> 00:17:11,580
This is all run on the
vendors SaaS products.

361
00:17:12,490 --> 00:17:13,830
So for example, in the example
that I'm gonna show you

362
00:17:13,830 --> 00:17:17,280
it's about power plus or
Microsoft's low code platform.

363
00:17:17,280 --> 00:17:20,433
The application will end up
in a microsoft.com domain.

364
00:17:21,470 --> 00:17:23,734
So users will trust it, why not?

365
00:17:23,734 --> 00:17:25,034
So let's see how it works.

366
00:17:29,439 --> 00:17:31,366
So while this is running,
what I'm going to do

367
00:17:31,366 --> 00:17:35,200
is I'm picking an application
from the template list

368
00:17:36,066 --> 00:17:36,900
and specifically taking an application

369
00:17:36,900 --> 00:17:40,314
that is about creating an out of office.

370
00:17:40,314 --> 00:17:42,382
So, you go into the application,

371
00:17:42,382 --> 00:17:43,350
you give it access to your email

372
00:17:43,350 --> 00:17:45,180
and it'll decline emails for you.

373
00:17:45,180 --> 00:17:47,696
You've seen a briefly

374
00:17:47,696 --> 00:17:50,715
that I needed to create those
connections to click allow.

375
00:17:50,715 --> 00:17:51,548
We'll see it again shortly.

376
00:17:51,548 --> 00:17:54,420
So you see how I'm picking a date

377
00:17:54,420 --> 00:17:56,730
and then I can configure a few things

378
00:17:56,730 --> 00:17:59,030
and the application will
do everything for me.

379
00:17:59,989 --> 00:18:02,490
And this is a useful
application, I didn't create it.

380
00:18:02,490 --> 00:18:03,683
I just picked it off the marketplace.

381
00:18:04,572 --> 00:18:06,698
What we're going to do is
take this useful application

382
00:18:06,698 --> 00:18:08,820
and abuse it for our own needs.

383
00:18:08,820 --> 00:18:10,290
So I'm hitting the edit button here,

384
00:18:10,290 --> 00:18:13,230
and I'm going to do a very simple thing.

385
00:18:13,230 --> 00:18:16,440
I'm going to use the user's
email while it is connected

386
00:18:16,440 --> 00:18:19,830
to send myself an email saying,
"Hi, I've, I've been pawed."

387
00:18:19,830 --> 00:18:23,073
Now, of course, I could
have done other things here.

388
00:18:23,933 --> 00:18:27,735
But the important thing to
note is how simple it is.

389
00:18:27,735 --> 00:18:30,960
So it's a single line of code
to use that user's connection

390
00:18:30,960 --> 00:18:34,230
to do anything we'd like,

391
00:18:34,230 --> 00:18:38,310
and the user don't
really have a way to know

392
00:18:38,310 --> 00:18:39,410
what's happening here.

393
00:18:42,150 --> 00:18:46,380
Okay, so while it takes
me a lot of time to type,

394
00:18:46,380 --> 00:18:48,012
then (laughs) the next thing

395
00:18:48,012 --> 00:18:48,900
that that's going to happen here

396
00:18:48,900 --> 00:18:50,880
is that I'm going to save the application.

397
00:18:50,880 --> 00:18:53,760
And by the way, when I click
save, it's already deployed.

398
00:18:53,760 --> 00:18:55,650
So there's no deployment process here,

399
00:18:55,650 --> 00:18:56,790
and then I'm gonna share it

400
00:18:56,790 --> 00:18:59,277
and I'm gonna share it with the entire org

401
00:18:59,277 --> 00:19:00,480
because that's a function
that's available here.

402
00:19:00,480 --> 00:19:02,490
So why not?

403
00:19:02,490 --> 00:19:04,200
Once I create this shell,

404
00:19:04,200 --> 00:19:07,863
Microsoft provides me with a
nice link for my application.

405
00:19:08,887 --> 00:19:09,720
So I'm gonna copy that link.

406
00:19:09,720 --> 00:19:11,430
And now I'm in another user

407
00:19:11,430 --> 00:19:13,950
and I'm going to plug in
that link on the browser

408
00:19:13,950 --> 00:19:15,300
and let's see what happens.

409
00:19:17,143 --> 00:19:18,570
First of all, I get this window

410
00:19:18,570 --> 00:19:21,180
that's asking me to use my credentials.

411
00:19:21,180 --> 00:19:26,180
And it was asking me for two
things for my account to office

412
00:19:26,356 --> 00:19:27,870
and for my calendar.

413
00:19:27,870 --> 00:19:31,859
And of course one when I click allow

414
00:19:31,859 --> 00:19:34,170
and I use the application,
very quickly, I get the email

415
00:19:34,170 --> 00:19:35,370
that I have been pawned.

416
00:19:35,370 --> 00:19:40,370
So we've seen how easy it is to do it,

417
00:19:40,560 --> 00:19:45,150
but there's one key to
understand about this example,

418
00:19:45,150 --> 00:19:47,523
and that is this window, okay?

419
00:19:48,739 --> 00:19:53,044
This window is what allowed
the application to take over

420
00:19:53,044 --> 00:19:53,877
the user's identity.

421
00:19:53,877 --> 00:19:57,390
And as you can see, this is
not the usual O of window

422
00:19:57,390 --> 00:19:58,410
that you used to.

423
00:19:58,410 --> 00:20:00,337
It's not telling you, "Hey,
these are the operations

424
00:20:00,337 --> 00:20:02,925
"I'm going to use so that you'll know

425
00:20:02,925 --> 00:20:05,220
"that other operations
are being created," no.

426
00:20:05,220 --> 00:20:09,407
This window is about
sharing the connection,

427
00:20:09,407 --> 00:20:10,703
the connection that we saw earlier.

428
00:20:12,333 --> 00:20:15,250
And so the only thing
that gave the user a hint

429
00:20:16,157 --> 00:20:19,563
that I might be able to steal
their identity is this window.

430
00:20:20,765 --> 00:20:23,281
And so naturally we
want to figure out a way

431
00:20:23,281 --> 00:20:27,300
to remove this window, know
that if I'm able to do that,

432
00:20:28,515 --> 00:20:30,580
or I have a link on microsoft.com

433
00:20:31,569 --> 00:20:33,480
and if I will share it with
anybody in the organization

434
00:20:33,480 --> 00:20:35,830
and they click it, that's
it, that's game over.

435
00:20:37,696 --> 00:20:41,580
So thankfully, this is something
that's already available.

436
00:20:41,580 --> 00:20:43,991
This is for Microsoft Docs.

437
00:20:43,991 --> 00:20:46,023
So an admin can basically set a flag.

438
00:20:46,920 --> 00:20:50,910
That means that this
window just goes away.

439
00:20:50,910 --> 00:20:53,370
And actually people are doing this

440
00:20:53,370 --> 00:20:55,770
in order to make these
applications easier to use.

441
00:20:55,770 --> 00:20:58,736
So if you're in an organization
that has done this,

442
00:20:58,736 --> 00:21:00,453
you might be in big trouble.

443
00:21:02,496 --> 00:21:07,172
So we have seen multiple ways
in which hackers are living

444
00:21:07,172 --> 00:21:08,022
off the land.

445
00:21:08,022 --> 00:21:10,164
Specifically, we've seen things

446
00:21:10,164 --> 00:21:11,940
about Microsoft power platform,

447
00:21:11,940 --> 00:21:13,440
and we've seen it about Zapier.

448
00:21:13,440 --> 00:21:16,634
We've seen lateral movement
privilege escalation

449
00:21:16,634 --> 00:21:17,467
ransomware account takeover,

450
00:21:17,467 --> 00:21:20,190
and this will all drag
and drop, very simple,

451
00:21:20,190 --> 00:21:21,543
very easy to use.

452
00:21:23,113 --> 00:21:25,630
The next part that I'm going to talk about

453
00:21:27,056 --> 00:21:28,073
is how do we stay there?

454
00:21:28,909 --> 00:21:32,790
So this has been, as you can
see, there are a ton of things

455
00:21:32,790 --> 00:21:37,790
that you can do once you get
into those low code platforms.

456
00:21:38,700 --> 00:21:42,340
And the next part is how do we make sure

457
00:21:42,340 --> 00:21:45,330
that we remain persistent
within those platforms?

458
00:21:45,330 --> 00:21:47,490
But actually it's more than
within those platforms.

459
00:21:47,490 --> 00:21:49,680
It's to remain persistent
in an organization.

460
00:21:49,680 --> 00:21:52,200
Because again, if I'm there,
I can use the connections

461
00:21:52,200 --> 00:21:53,583
and continue on from there.

462
00:21:55,231 --> 00:21:56,940
We are actually not going
to invent anything here.

463
00:21:56,940 --> 00:22:01,143
This has been done by an APT
group about two years ago.

464
00:22:04,741 --> 00:22:08,014
So what happened here and and
if you'll follow the link,

465
00:22:08,014 --> 00:22:08,847
you'll see all of the sources.

466
00:22:08,847 --> 00:22:10,105
Basically,

467
00:22:10,105 --> 00:22:12,060
this is slide from a Microsoft
detection response team,

468
00:22:12,060 --> 00:22:16,850
where an APT group was able to stay hidden

469
00:22:16,850 --> 00:22:17,774
within an enterprise.

470
00:22:17,774 --> 00:22:18,720
They knew that they got hacked

471
00:22:18,720 --> 00:22:21,807
and they were looking to find the hackers.

472
00:22:21,807 --> 00:22:23,457
They took them six months to find

473
00:22:25,450 --> 00:22:28,900
that there was a single
automation on power platform

474
00:22:29,807 --> 00:22:30,640
that did a very simple thing.

475
00:22:30,640 --> 00:22:35,640
It used e-discovery to
go out and find secrets

476
00:22:35,867 --> 00:22:39,800
and find business data in email,
in Outlook, in SharePoint,

477
00:22:41,308 --> 00:22:43,950
and then just send it
off to one domain point.

478
00:22:43,950 --> 00:22:44,783
And nobody was looking for it.

479
00:22:44,783 --> 00:22:47,282
You don't really have a network appliance

480
00:22:47,282 --> 00:22:48,150
looking at what Microsoft is doing.

481
00:22:48,150 --> 00:22:51,090
And so this took a long time to find.

482
00:22:51,090 --> 00:22:55,253
So what we're going to
do now is recreate that

483
00:22:55,253 --> 00:22:57,513
and see exactly how it works.

484
00:23:00,060 --> 00:23:01,260
Here's the first version.

485
00:23:01,260 --> 00:23:04,950
So on a schedule, I'm gonna
go through all of the files

486
00:23:04,950 --> 00:23:07,260
in a single SharePoint site.

487
00:23:07,260 --> 00:23:08,610
I'm going to encrypt them,

488
00:23:08,610 --> 00:23:12,090
send them over to random
endpoint, for example, Pastebin.

489
00:23:12,090 --> 00:23:14,343
And I'm gonna tweet
about it because why not?

490
00:23:15,453 --> 00:23:17,203
I mean, nobody will find me anyway.

491
00:23:18,330 --> 00:23:19,916
You can also apply this to on-prem.

492
00:23:19,916 --> 00:23:22,059
You can plug in any one of the connections

493
00:23:22,059 --> 00:23:23,043
that we saw before.

494
00:23:24,677 --> 00:23:27,113
So this is actually exactly
what the attackers have done.

495
00:23:28,083 --> 00:23:29,363
Now let's take it a step further.

496
00:23:30,616 --> 00:23:32,850
So, instead of starting with a schedule,

497
00:23:32,850 --> 00:23:37,240
let's plug in an HTTP endpoint
that you can just call

498
00:23:37,240 --> 00:23:38,073
from the outside.

499
00:23:38,073 --> 00:23:40,255
And in this example, what it's going to do

500
00:23:40,255 --> 00:23:41,955
is encrypt an entire Google Drive.

501
00:23:43,071 --> 00:23:43,904
Again, why not?

502
00:23:43,904 --> 00:23:48,830
So this is basically encryption ransomware

503
00:23:48,830 --> 00:23:49,800
for a specific Google Drive

504
00:23:49,800 --> 00:23:52,454
that is available through an HTTP endpoint

505
00:23:52,454 --> 00:23:53,513
of outside of the org.

506
00:23:54,540 --> 00:23:57,430
But actually I've mentioned
that this part of the talk

507
00:23:58,390 --> 00:23:59,223
is about persistency,

508
00:23:59,223 --> 00:24:01,310
this is just a very small
part of what we need

509
00:24:02,179 --> 00:24:03,234
in order to remain persistent.

510
00:24:03,234 --> 00:24:04,260
So here's the laundry list.

511
00:24:04,260 --> 00:24:06,397
Of course, this is not everything,

512
00:24:06,397 --> 00:24:09,322
but there are few things that
we need to be able to do.

513
00:24:09,322 --> 00:24:11,823
We need to be able to run code remotely.

514
00:24:12,801 --> 00:24:15,539
We want to be able to
run arbitrary payloads,

515
00:24:15,539 --> 00:24:16,440
not just a fixed list of payloads

516
00:24:16,440 --> 00:24:18,570
that we've described earlier.

517
00:24:18,570 --> 00:24:22,086
We want to maintain access
even if the user that created

518
00:24:22,086 --> 00:24:23,310
that gave us the initial access

519
00:24:23,310 --> 00:24:25,680
gets blocked or removed or whatever,

520
00:24:25,680 --> 00:24:29,224
we want to make sure that we
avoid detection attribution,

521
00:24:29,224 --> 00:24:31,005
and of course leave no logs behind.

522
00:24:31,005 --> 00:24:32,280
So let's see how we can do that.

523
00:24:32,280 --> 00:24:35,850
We've already seen a first
version of persistency

524
00:24:35,850 --> 00:24:37,953
because there's this HTTP endpoint,

525
00:24:38,820 --> 00:24:41,863
let's try and figure
out what does it cover

526
00:24:41,863 --> 00:24:43,143
from a laundry list.

527
00:24:44,123 --> 00:24:47,709
So, I'm able to execute things remotely.

528
00:24:47,709 --> 00:24:49,530
That's pretty obvious,
that's an HTTP endpoint.

529
00:24:49,530 --> 00:24:51,780
This is definitely not
an arbitrary payload.

530
00:24:51,780 --> 00:24:54,090
This is a specific
payload that I've created.

531
00:24:54,090 --> 00:24:57,033
And that's the only one that
I'm going to be able to run.

532
00:24:57,900 --> 00:25:01,990
In terms of maintaining
access, that's covered here

533
00:25:03,994 --> 00:25:07,170
because that HTTP endpoint
comes built in with a secret.

534
00:25:07,170 --> 00:25:09,690
So we don't need to be authenticated

535
00:25:09,690 --> 00:25:12,225
in order to call the HTTP endpoint,

536
00:25:12,225 --> 00:25:14,391
again, something that is the same

537
00:25:14,391 --> 00:25:15,390
in every low code platform
that we've observed.

538
00:25:15,390 --> 00:25:17,940
And so I can very easily
just call the endpoint.

539
00:25:17,940 --> 00:25:20,190
And that's the only access I need.

540
00:25:20,190 --> 00:25:23,320
Avoiding detection is again, very easy

541
00:25:24,169 --> 00:25:25,447
because it's somebody else's cloud.

542
00:25:25,447 --> 00:25:26,820
You have no security controls there.

543
00:25:26,820 --> 00:25:29,817
Avoiding attribution is also very easy

544
00:25:29,817 --> 00:25:32,760
because that's an endpoint,
you can call it from wherever.

545
00:25:32,760 --> 00:25:35,683
They're not blocking tool
or anything like that.

546
00:25:35,683 --> 00:25:36,533
So just go ahead.

547
00:25:39,253 --> 00:25:41,553
And in terms of no of logs, not really,

548
00:25:42,511 --> 00:25:43,344
we're kind of in a problem here.

549
00:25:43,344 --> 00:25:47,286
Those automations generate a ton of logs.

550
00:25:47,286 --> 00:25:51,909
So I'm talking about every
single piece of information

551
00:25:51,909 --> 00:25:53,130
that goes through those automations

552
00:25:53,130 --> 00:25:56,610
is actually being logged there,
including the data itself.

553
00:25:56,610 --> 00:26:00,310
So we need to figure out how
do we tackle those two points,

554
00:26:00,310 --> 00:26:02,110
the arbitrary payloads and the logs.

555
00:26:03,714 --> 00:26:06,930
Here's one attempt, we're just
gonna have a single endpoint,

556
00:26:06,930 --> 00:26:10,428
but this time we will implement
a whole bunch of payloads.

557
00:26:10,428 --> 00:26:11,850
So there we can think in advance

558
00:26:11,850 --> 00:26:14,433
about the payloads that
we would like to execute.

559
00:26:15,534 --> 00:26:19,067
So one of them is linking
an entire SharePoint site.

560
00:26:19,067 --> 00:26:21,300
Another is encrypting
entire SharePoint site

561
00:26:21,300 --> 00:26:24,600
executing a SQL on a random database.

562
00:26:24,600 --> 00:26:27,400
All of those things are
available, so a single endpoint.

563
00:26:29,668 --> 00:26:32,793
Actually, there was no
advancement here, right?

564
00:26:33,699 --> 00:26:35,312
Still no arbitrary payloads.

565
00:26:35,312 --> 00:26:36,450
And I really haven't
touched the log thing.

566
00:26:36,450 --> 00:26:41,163
So let's see how both of
these things can get solved.

567
00:26:43,650 --> 00:26:47,098
And for that, I'm gonna
use a very useful piece

568
00:26:47,098 --> 00:26:51,210
of software from those low code platforms,

569
00:26:51,210 --> 00:26:55,680
which is the fact that the
low code platforms themselves

570
00:26:55,680 --> 00:27:00,680
provide a way for you to
manage them through low code.

571
00:27:00,700 --> 00:27:05,012
So you can use low code to
create new low-code applications.

572
00:27:05,012 --> 00:27:06,956
You can trigger them, you can delete them.

573
00:27:06,956 --> 00:27:09,090
And so I'm sure you'll see
where I'm going with this,

574
00:27:09,090 --> 00:27:11,823
but I'm gonna take you through it anyways.

575
00:27:13,770 --> 00:27:15,120
Here's what we're gonna do.

576
00:27:15,991 --> 00:27:20,617
So I'm going to show you
exactly how we cover both logs

577
00:27:21,575 --> 00:27:24,402
and the payloads, this
is already out there.

578
00:27:24,402 --> 00:27:26,010
So you can go ahead and use it.

579
00:27:26,010 --> 00:27:30,990
And this tool basically allows
you to install this back door

580
00:27:30,990 --> 00:27:34,833
inside of an organization, and
then you remain persistent.

581
00:27:36,869 --> 00:27:37,702
Here's how it works.

582
00:27:37,702 --> 00:27:39,750
I have a single endpoint,
the HTTP endpoint,

583
00:27:39,750 --> 00:27:42,660
and instead of running a specific payload,

584
00:27:42,660 --> 00:27:45,879
it's running a payload that
creating a new payload.

585
00:27:45,879 --> 00:27:49,230
So I'm passing through the
definition of the automation,

586
00:27:49,230 --> 00:27:51,000
which connections they should use.

587
00:27:51,000 --> 00:27:55,243
And then what this automation does

588
00:27:55,243 --> 00:27:58,323
is creates that new
automation and triggers it.

589
00:28:00,124 --> 00:28:01,500
I actually need more than that.

590
00:28:01,500 --> 00:28:06,500
So there are three different
things that this covers.

591
00:28:06,660 --> 00:28:08,250
One is creating the automation.

592
00:28:08,250 --> 00:28:10,110
The other is deleting the automation.

593
00:28:10,110 --> 00:28:14,229
And another crucial piece is
just listing those credentials,

594
00:28:14,229 --> 00:28:16,016
those connections that
are laying out there.

595
00:28:16,016 --> 00:28:18,090
So we'll always be able to use fresh ones.

596
00:28:18,090 --> 00:28:22,847
And of course, this completely
covers the general payload.

597
00:28:24,364 --> 00:28:25,943
So I can just run whatever I want now.

598
00:28:27,870 --> 00:28:30,003
The, sorry,

599
00:28:33,575 --> 00:28:35,640
one more thing that's covered here,

600
00:28:36,500 --> 00:28:38,490
And I haven't actually
specifically described it

601
00:28:38,490 --> 00:28:42,633
is because I can delete
the flow after I run it,

602
00:28:43,974 --> 00:28:45,870
all of the logs get deleted as well.

603
00:28:45,870 --> 00:28:48,897
So the logs are actually maintained

604
00:28:48,897 --> 00:28:50,708
as part of the flow itself.

605
00:28:50,708 --> 00:28:53,463
And so by executing the
flow and then deleting it,

606
00:28:56,254 --> 00:28:58,840
I leave completely no logs behind.

607
00:28:58,840 --> 00:29:00,240
So the only logs that are left

608
00:29:00,240 --> 00:29:03,030
are the fact that these flow is running

609
00:29:03,030 --> 00:29:06,303
and this can be hidden
by basically saying,

610
00:29:07,183 --> 00:29:09,933
okay, this flow don't
remember anything about it.

611
00:29:11,906 --> 00:29:14,370
Here's the entire flow,
the entire automation.

612
00:29:14,370 --> 00:29:19,322
So again, one HTTP endpoint,
three main commands

613
00:29:19,322 --> 00:29:23,447
create automation and
trigger it, get connections.

614
00:29:23,447 --> 00:29:26,190
So I can create new automations
with that new connection

615
00:29:26,190 --> 00:29:27,590
and deleting the automation.

616
00:29:30,111 --> 00:29:32,490
Here's the same thing with a
Python that makes it easier

617
00:29:32,490 --> 00:29:35,590
for you to use it without
going through the UI

618
00:29:36,493 --> 00:29:37,697
for Microsoft.

619
00:29:37,697 --> 00:29:41,769
So this is kind of small,
so let me make sure

620
00:29:41,769 --> 00:29:42,602
that you understand what's going on here.

621
00:29:42,602 --> 00:29:45,000
I plug in the Webhook that I got

622
00:29:45,000 --> 00:29:49,140
from installing this
backdoor on power platform.

623
00:29:49,140 --> 00:29:53,160
And then I create a flow, I
trigger it, and I delete it

624
00:29:53,160 --> 00:29:57,090
all within the comfort of my Python CLI.

625
00:29:57,090 --> 00:29:57,923
And this of course,

626
00:29:57,923 --> 00:30:00,570
is all available for you to use right now.

627
00:30:00,570 --> 00:30:05,386
So, I'll describe briefly
what you need to do

628
00:30:05,386 --> 00:30:06,219
in order to use this.

629
00:30:06,219 --> 00:30:09,333
Basically, once you have
access to power platform,

630
00:30:11,376 --> 00:30:13,656
you follow a small
guide that I have there.

631
00:30:13,656 --> 00:30:16,468
That's about installing that vector.

632
00:30:16,468 --> 00:30:20,774
That's basically uploading that automation

633
00:30:20,774 --> 00:30:23,100
that you just see here
and you get in response,

634
00:30:23,100 --> 00:30:24,950
the Webhook, and then you can use it.

635
00:30:27,638 --> 00:30:28,920
And again, keep in mind,

636
00:30:28,920 --> 00:30:32,906
this is far more advanced
than what we've seen

637
00:30:32,906 --> 00:30:34,080
the threat actually do.

638
00:30:34,080 --> 00:30:37,680
And the basic thing that
the threat actually did,

639
00:30:37,680 --> 00:30:42,570
took defenders, took six months to find.

640
00:30:42,570 --> 00:30:44,523
So I wonder how much this could take.

641
00:30:46,530 --> 00:30:47,640
Okay.

642
00:30:47,640 --> 00:30:52,276
So we've seen two subsections right now.

643
00:30:52,276 --> 00:30:54,480
We've seen how hackers are
living off the land of low code

644
00:30:56,444 --> 00:30:59,220
to run their own malicious operations

645
00:30:59,220 --> 00:31:01,350
based on the low code
platforms themselves.

646
00:31:01,350 --> 00:31:04,975
We've seen how you can stay
within this low code platforms

647
00:31:04,975 --> 00:31:06,194
remain persistent.

648
00:31:06,194 --> 00:31:07,440
The last thing I want to cover

649
00:31:08,593 --> 00:31:11,073
is how does this look
like from the outside?

650
00:31:11,073 --> 00:31:11,973
So, sorry.

651
00:31:15,884 --> 00:31:18,490
So both of the sections before started off

652
00:31:19,339 --> 00:31:21,859
when I have some sort of
access to the platform,

653
00:31:21,859 --> 00:31:24,090
but actually there's more going on here

654
00:31:24,090 --> 00:31:27,630
because business users are
creating these applications.

655
00:31:27,630 --> 00:31:31,992
There are common
misconfigurations that we can find

656
00:31:31,992 --> 00:31:33,750
that we can look for,
and that are predictable,

657
00:31:33,750 --> 00:31:37,020
that expose business data
outside of the organization.

658
00:31:37,020 --> 00:31:40,440
And actually we've seen
this with AWS S3 buckets,

659
00:31:40,440 --> 00:31:41,940
S3 buckets, right.

660
00:31:41,940 --> 00:31:44,250
So the default was insecure.

661
00:31:44,250 --> 00:31:46,140
Every new bucket was public.

662
00:31:46,140 --> 00:31:50,790
And then even though
they changed the default,

663
00:31:50,790 --> 00:31:54,150
we are still finding these
public S3 buckets today.

664
00:31:54,150 --> 00:31:56,640
And so the same thing applies here,

665
00:31:56,640 --> 00:32:01,113
but the key difference is that
these are not only developers

666
00:32:01,113 --> 00:32:03,427
that are building this,
these are business users.

667
00:32:03,427 --> 00:32:04,433
So there's a lot more of it.

668
00:32:05,865 --> 00:32:06,698
We'll see a couple of examples.

669
00:32:06,698 --> 00:32:11,025
The first example is
Microsoft's power pages,

670
00:32:11,025 --> 00:32:12,475
which is basically a website.

671
00:32:17,356 --> 00:32:21,184
It allows unauthenticated
users to observe the website.

672
00:32:21,184 --> 00:32:23,610
So this is being used
for vendor management,

673
00:32:23,610 --> 00:32:25,860
contractors that come into your office.

674
00:32:25,860 --> 00:32:28,200
And that's an entire
application that you create

675
00:32:28,200 --> 00:32:29,783
with drag and drop.

676
00:32:29,783 --> 00:32:31,410
Of course there's database behind it.

677
00:32:31,410 --> 00:32:33,670
There's a bunch of information there

678
00:32:33,670 --> 00:32:35,224
that should not be
available to the vendors

679
00:32:35,224 --> 00:32:36,057
and the contractors.

680
00:32:36,057 --> 00:32:39,551
Actually, about a year ago,

681
00:32:39,551 --> 00:32:40,590
the team at UpGuard

682
00:32:40,590 --> 00:32:43,293
found that there was an insecurity folder

683
00:32:43,293 --> 00:32:48,293
that basically meant
that the entire database

684
00:32:48,672 --> 00:32:51,598
behind that application was
available to anonymous users.

685
00:32:51,598 --> 00:32:52,920
And this was the default configuration

686
00:32:52,920 --> 00:32:55,140
for about a couple of years.

687
00:32:55,140 --> 00:32:57,900
Now, this was a major thing,

688
00:32:57,900 --> 00:33:01,494
about 40 million records were exposed

689
00:33:01,494 --> 00:33:03,000
by UpGuard's estimation.

690
00:33:03,000 --> 00:33:06,300
And Microsoft has actually been very quick

691
00:33:06,300 --> 00:33:07,800
to change the default,

692
00:33:07,800 --> 00:33:11,578
but of course, the
default is not everything.

693
00:33:11,578 --> 00:33:13,132
So there are still these applications

694
00:33:13,132 --> 00:33:13,965
that were created beforehand

695
00:33:13,965 --> 00:33:15,513
and users can always make mistakes.

696
00:33:16,530 --> 00:33:19,170
What we wanted to do here
is to try and find out

697
00:33:19,170 --> 00:33:21,390
how many of these mistakes we can find.

698
00:33:21,390 --> 00:33:23,703
So how do we do it?

699
00:33:24,540 --> 00:33:27,040
Basically, we're going
to scan the internet,

700
00:33:27,040 --> 00:33:30,090
looking for portals, these
kinds of applications

701
00:33:30,090 --> 00:33:32,906
that are exposing business sensitive data

702
00:33:32,906 --> 00:33:34,620
without any authentication,
and here's example.

703
00:33:34,620 --> 00:33:36,370
And this is actually a real example

704
00:33:37,260 --> 00:33:39,600
from a large financial services company.

705
00:33:39,600 --> 00:33:42,982
You can see that by querying the API,

706
00:33:42,982 --> 00:33:45,360
I get three different
objects that I can query.

707
00:33:45,360 --> 00:33:47,700
One is the default object
it's not very interesting.

708
00:33:47,700 --> 00:33:48,840
It has nothing there.

709
00:33:48,840 --> 00:33:50,940
The second thing is an entity form set,

710
00:33:50,940 --> 00:33:55,338
which is basically the way
to store form submission.

711
00:33:55,338 --> 00:33:56,580
So again, not very interesting,

712
00:33:56,580 --> 00:34:00,423
but the third part, global
variables is kind of interesting.

713
00:34:02,240 --> 00:34:04,621
And of course, when we look
into these global variables

714
00:34:04,621 --> 00:34:07,071
what we found was
authentication tokens for Azure

715
00:34:08,413 --> 00:34:10,538
and for power platform
that were being used

716
00:34:10,538 --> 00:34:11,816
by the application itself.

717
00:34:11,816 --> 00:34:14,430
And again, this is available
to anonymous users.

718
00:34:14,430 --> 00:34:18,750
We browse it through
though, so very, very, very,

719
00:34:18,750 --> 00:34:22,233
and the crucial part here is
that it's very easy to find.

720
00:34:23,155 --> 00:34:24,210
So why it easy to find?

721
00:34:24,210 --> 00:34:26,210
Because it's all in the same sub domain.

722
00:34:27,411 --> 00:34:30,810
So every one of those applications
is in this sub domain.

723
00:34:30,810 --> 00:34:32,910
And the endpoint, the API endpoint

724
00:34:32,910 --> 00:34:34,590
is always the same as well.

725
00:34:34,590 --> 00:34:35,670
So of course,

726
00:34:35,670 --> 00:34:37,740
we can do kind of sub
domain illumination here.

727
00:34:37,740 --> 00:34:41,130
Here's a lazy way to do
sub domain illumination.

728
00:34:41,130 --> 00:34:44,163
We'll just use Bing, and Bing
because this is Microsoft.

729
00:34:45,000 --> 00:34:45,929
So it works.

730
00:34:45,929 --> 00:34:49,188
You are seeing about
60,000 different portals

731
00:34:49,188 --> 00:34:50,500
that are available out there.

732
00:34:50,500 --> 00:34:54,533
And we have actually
been going out to people

733
00:34:55,469 --> 00:34:56,302
and trying to help them

734
00:34:56,302 --> 00:35:00,480
make sure that they are
able to solve this issue.

735
00:35:00,480 --> 00:35:02,430
Here are the examples of what we found.

736
00:35:02,430 --> 00:35:07,430
So a lots of... nice.

737
00:35:07,440 --> 00:35:12,213
Lots of PII secrets, API
keys, authentication tokens,

738
00:35:14,194 --> 00:35:15,525
and lots of business data.

739
00:35:15,525 --> 00:35:19,623
So PDFs, pictures of recipes or receipts.

740
00:35:20,745 --> 00:35:21,833
So a whole bunch of business data.

741
00:35:22,756 --> 00:35:26,760
So again, this was a case where
there was a misconfiguration

742
00:35:26,760 --> 00:35:30,753
that is very predictable and
it's very easy to scan for it.

743
00:35:31,797 --> 00:35:33,120
Let's see another example.

744
00:35:33,120 --> 00:35:35,220
This time we'll focus on Zapier.

745
00:35:35,220 --> 00:35:38,320
Zapier is a tool that business users

746
00:35:39,340 --> 00:35:40,860
are bringing into the
enterprise themselves.

747
00:35:40,860 --> 00:35:42,510
And Zapier is again, an automation tool,

748
00:35:42,510 --> 00:35:45,270
you can drag and drop and
you create automations.

749
00:35:45,270 --> 00:35:48,993
Zapier has a nice feature
called storage by Zapier.

750
00:35:50,921 --> 00:35:52,110
Basically, what this means

751
00:35:52,110 --> 00:35:56,342
is that if you need to
store some store of state

752
00:35:56,342 --> 00:35:59,106
for your automation, or
you need to store secrets

753
00:35:59,106 --> 00:36:02,151
for it to operate, then
you can use this storage.

754
00:36:02,151 --> 00:36:03,000
And the way that it's protected

755
00:36:03,000 --> 00:36:07,020
is that you need to choose
a GUID, some sort of GUID.

756
00:36:07,020 --> 00:36:10,404
And then once you plug it
in, that's a key value store.

757
00:36:10,404 --> 00:36:11,910
You get your secret back.

758
00:36:11,910 --> 00:36:16,288
Now, as you can see, I mean,
GUIDs are not the best,

759
00:36:16,288 --> 00:36:18,388
but it's still kind of difficult to guess.

760
00:36:19,579 --> 00:36:22,470
When we've observed the kind
of the API documentation,

761
00:36:22,470 --> 00:36:26,400
you can actually see that
the example that they provide

762
00:36:26,400 --> 00:36:28,863
is secret equals 1, 2, 3, 4, 5.

763
00:36:29,850 --> 00:36:34,850
This is definitely not a
GUID, so we are curious.

764
00:36:35,640 --> 00:36:37,937
The first thing that we try to do

765
00:36:37,937 --> 00:36:39,480
is kind of just try a random secret.

766
00:36:39,480 --> 00:36:42,240
And that's the L that you are
getting if that's not a GUID,

767
00:36:42,240 --> 00:36:45,880
but actually once you go
to what we actually did

768
00:36:46,979 --> 00:36:49,260
is we iterate through a
list of known passwords.

769
00:36:49,260 --> 00:36:52,950
And what we got was that
many of those passwords

770
00:36:52,950 --> 00:36:53,883
actually worked.

771
00:36:55,081 --> 00:36:57,306
So we are seeing here examples
of things that we found

772
00:36:57,306 --> 00:36:59,970
again, authentication,
tokens, API keys, emails,

773
00:36:59,970 --> 00:37:03,300
phone numbers, and
actually what happened here

774
00:37:03,300 --> 00:37:04,460
was that...

775
00:37:05,994 --> 00:37:09,679
So up until about two years ago,

776
00:37:09,679 --> 00:37:10,830
Zapier was not really making sure

777
00:37:10,830 --> 00:37:12,630
that users were using GUIDs,

778
00:37:12,630 --> 00:37:15,090
they could use whatever they want,

779
00:37:15,090 --> 00:37:16,710
and then they started doing it,

780
00:37:16,710 --> 00:37:20,113
but they didn't block the old secrets.

781
00:37:20,113 --> 00:37:21,870
So you can still use them
and they are still available.

782
00:37:21,870 --> 00:37:23,430
I mean, some of them are available today.

783
00:37:23,430 --> 00:37:27,134
We have been working with Zapier team

784
00:37:27,134 --> 00:37:28,708
to make sure that this is covered

785
00:37:28,708 --> 00:37:31,193
and actually the vast majority
have already been cleaned up.

786
00:37:32,428 --> 00:37:33,261
Okay.

787
00:37:33,261 --> 00:37:34,710
So we've seen two examples

788
00:37:34,710 --> 00:37:38,280
where platforms allow
predictable misconfiguration

789
00:37:38,280 --> 00:37:40,823
and how from the outside looking in

790
00:37:40,823 --> 00:37:41,656
without having any access,

791
00:37:41,656 --> 00:37:43,540
we can go ahead and access business data.

792
00:37:44,820 --> 00:37:48,780
Here's a summary of everything
that we've seen up until now.

793
00:37:48,780 --> 00:37:52,440
So we discussed low code.

794
00:37:52,440 --> 00:37:56,130
We understand how it's
pervasive in any enterprise.

795
00:37:56,130 --> 00:37:58,770
And the fact that it's
built around business data,

796
00:37:58,770 --> 00:38:01,510
when the standard is kind of underrated

797
00:38:01,510 --> 00:38:02,896
by IT and security teams,

798
00:38:02,896 --> 00:38:04,770
which make it a great
target for attackers.

799
00:38:04,770 --> 00:38:07,350
We are seeing our hackers
are taking advantage of it

800
00:38:07,350 --> 00:38:09,093
really kind of all around.

801
00:38:10,015 --> 00:38:11,880
So living of the end of low
code for lateral movement,

802
00:38:11,880 --> 00:38:14,916
for putting discretion,
we've seen everything.

803
00:38:14,916 --> 00:38:16,650
We've seen how you can hide
within those low code platforms

804
00:38:16,650 --> 00:38:19,560
and use that as a way to
persist within an organization.

805
00:38:19,560 --> 00:38:23,100
And we've seen how you can
use those same platforms

806
00:38:23,100 --> 00:38:26,173
and the predictable
misconfigurations that they create

807
00:38:26,173 --> 00:38:27,510
in order to find business data.

808
00:38:27,510 --> 00:38:29,162
There are two things,

809
00:38:29,162 --> 00:38:31,750
and actually we've also seen two tools

810
00:38:32,640 --> 00:38:33,570
that we've released today.

811
00:38:33,570 --> 00:38:37,500
One is for Zapier that allows
you to find those connections,

812
00:38:37,500 --> 00:38:38,880
those shared connections,

813
00:38:38,880 --> 00:38:40,660
and the other is that backdoor

814
00:38:41,555 --> 00:38:43,296
that you can install a power platform.

815
00:38:43,296 --> 00:38:46,597
So the last thing I want to
do is leave you with some tips

816
00:38:48,530 --> 00:38:50,025
on how you can secure your organization,

817
00:38:50,025 --> 00:38:51,203
how you can protect yourself.

818
00:38:53,617 --> 00:38:56,190
So, here are specific things

819
00:38:56,190 --> 00:38:58,893
that I really recommend you do quickly.

820
00:38:59,771 --> 00:39:01,920
The first thing is that you
need to review configuration,

821
00:39:01,920 --> 00:39:06,581
for example, thr bypass
consent flag for Microsoft,

822
00:39:06,581 --> 00:39:07,954
make sure that's off.

823
00:39:07,954 --> 00:39:10,233
There's also the usage
of those connectors.

824
00:39:11,131 --> 00:39:14,017
So make sure that connectors
that are administrative,

825
00:39:14,017 --> 00:39:16,080
for example, could not be
shared in a default environment.

826
00:39:16,080 --> 00:39:19,503
I recommend that you view those endpoints,

827
00:39:19,503 --> 00:39:20,708
those external endpoints,

828
00:39:20,708 --> 00:39:22,080
that those platforms are creating for you.

829
00:39:22,080 --> 00:39:26,321
So again, you don't have
to be fully aware of it,

830
00:39:26,321 --> 00:39:27,542
but it's already there.

831
00:39:27,542 --> 00:39:30,137
The platforms are exposing
those endpoints for you

832
00:39:30,137 --> 00:39:32,943
and you have no easy way to monitor them.

833
00:39:33,900 --> 00:39:37,479
The number one thing that you
should take out of this talk

834
00:39:37,479 --> 00:39:39,345
is go through those shared connections,

835
00:39:39,345 --> 00:39:40,178
go to those default environments,

836
00:39:40,178 --> 00:39:41,703
see what users have built.

837
00:39:43,607 --> 00:39:46,809
You'll be surprised, and there's
a bunch of more information

838
00:39:46,809 --> 00:39:48,330
that you can use here.

839
00:39:48,330 --> 00:39:50,103
There's an always (indistinct)

840
00:39:50,103 --> 00:39:50,936
that is dedicated to low-code/no-code

841
00:39:50,936 --> 00:39:52,170
that would help you figure out

842
00:39:53,347 --> 00:39:55,110
what are the different risks
that are around this space.

843
00:39:55,110 --> 00:39:57,180
And there's a whole
bunch of articles there

844
00:39:57,180 --> 00:39:58,180
that could help you.

845
00:39:59,057 --> 00:40:02,163
So, thank you everyone, thank
you very much for your time.

846
00:40:03,533 --> 00:40:04,472
It's been fun.

847
00:40:04,472 --> 00:40:07,472
(audience clapping)