Credential Sharing as a Service: The Dark Side of No Code
summary
Demonstrates how low‑code platforms collect OAuth refresh tokens into reusable connections that users can share, effectively becoming a credential sharing as a service; attackers find default environments full of shared credentials, build ransomware and exfiltration workflows that run with victims’ identities, and use RPA agents as trusted C2. Shows concrete abuses, an open tool (ZapCreds) to enumerate risky connections, and actionable controls like turning off tenant‑wide auto‑consent and inventorying apps against the OWASP Low‑Code/No‑Code Top 10.
AI-written summary · about
chapters (9)
- 0:00Introduction and overview
- 3:22What is low-code/no-code?
- 10:51Why this is a security problem
- 18:51SDLC for low-code apps
- 23:27Attacker perspective on low-code
- 35:56Credential sharing as a service
- 41:51Live demo of credential theft
- 47:22Defense strategies and resources
- 50:34Q&A and closing
related talks
54mCredential Sharing As A Service: The Dark Side Of No Code
47mHacking OAuth
45mGoodbye Credential Leaks: Securing Code Together
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
37mCustomer Identity for Modern Apps and APIs
31mLog In Through the Front Door: Automating Defense Against...
51mDefensive Coding Bootcamp
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research