Low Code, High Risk: Enterprise Domination via Low-Code Abuse
Michael Bargury explores enterprise domination through low-code shadow IT, abusing Microsoft Power Platform connectors and flows to exfiltrate corporate data.
Summary
The Rise of Low-Code and Citizen Developers
Enterprises increasingly encourage non-technical employees to build automated business workflows using low-code platforms like Microsoft Power Apps and Power Automate.
Analyzing Low-Code Shadow IT Attack Surfaces
Michael Bargury demonstrates how unmonitored user flows inherit broad enterprise API permissions, connecting SQL databases, email systems, and cloud storage.
Abusing Connectors for Covert Data Exfiltration and Escalation
Bargury showcases techniques for creating malicious connectors, exfiltrating sensitive tenant data, and establishing persistent administrative backdoors.
Enterprise Governance and Low-Code Security Tooling
The author provides security architects with Data Loss Prevention (DLP) policy templates, tenant isolation rules, and automated auditing scripts.
Related talks
Main Stage·39 min
Eran Segal
Eran Segal investigates Windows container isolation (Process Isolation & Hyper-V), demonstrating novel container escape techniques via Silo IPC mechanisms.
Main Stage·44 min
Billy Jheng · Muhammad Ramdhan
Billy Jheng and Muhammad Ramdhan demonstrate multiple novel container escape vectors in Google Kubernetes Engine (GKE) to achieve host node takeover.
DCGVR Village·30 min
Deconstructing AWS Instance Metadata Service (IMDS) exploitation, abusing SSRF to harvest temporary IAM credentials and escalate cloud permissions.