Credential_Sharing_as_a_Service

Credential Sharing as a Service: the Dark Side of No Code

View on SANS Cybersecurity Leadership UK Summit agenda

Recommended pre-reading materials

• Store by Zapier vulnerability

• Power Platform data leakage

• Living-of-the-land of Office365

• Gaining persistency on AWS Lambda

Mentioned in the talk

Tools and Demos

• ZapCreds - scan Zapier for shared credentials ready for exploit

• Powerful - install a backdoor on Power Platform enabling creating, triggering and deleting any arbitrary flow

• Power Platform account takeover demo, YouTube

Articles

• Low-Code / No-Code Security, Dark Reading

• Hackers Abuse Low-Code Platforms And Turn Them Against Their Owners, Zenity blog

• The Microsoft Power Apps Portal Data Leak Revisited: Are You Safe Now?, Zenity blog

• Zapier Storage Exposes Sensitive Customer Data Due to Poor User Choices, Zenity blog

• Connectors overview, Microsoft Docs

• Set-AdminPowerAppApisToBypassConsent, Microsoft Docs

• Power Automate Management, Microsoft Docs

Talk materials

• Slides