OWASP Low-Code/No-Code @OWASPNoCode

Security risks, hacking stories and ways to protect low-code/no-code apps #infosec #appsec #lowcode #nocode owasp.org/www-project-to… Top 10 security risks: Joined April 2022

Tweets

862
Followers

223
Following

7
Likes

846

Michael Bargury @mbrg0

4 months ago

incredible vibes at openai's security conf last week I came out both humbled and excited and with a greater conviction -- you can just do things!

2 1 6 893 3

Download Image

Had great fun Wednesday with Michael Bargury (@mbrg0 ) at Microsoft's BlueHat (#Bluehat) security conference on Wednesday. Our talk focused on risk reduction in Low-Code/No-Code platforms (x.com/MSFTBlueHat/st…).

Microsoft BlueHat @MSFTBlueHat

11 months ago

2 0 8 2K 2

Download Image

1 2 4 639 0

Download Image

Michael Bargury @mbrg0

10 months ago

really really excited to be sharing this insider today together with microsoft's @DonWillits66 at #bluehat see you in 30m

0 1 9 484 0

Download Image

Michael Bargury @mbrg0

11 months ago

modifying salesforce einstein is a privileged operation saved for admins unless einstein uses flows then flow makers can implicitly modify too

0 2 3 456 0

Tamir Ishay Sharbat @tamirishaysh

11 months ago

First Vulnerability in Salesforce AI Apparently you can edit edit EVERYONE’s Einstein Copilot without admin permissions? Here’s exactly how labs.zenity.io/p/over-permiss…

0 4 5 391 1

OWASP Low-Code/No-Code @OWASPNoCode

a year ago

Join us in a couple of hours for awesome talks on attacking and defending low-code/no-code apps 🚀 by @wyattDaveDev @ZivDanielHagbi

Ziv Daniel Hagbi @ZivDanielHagbi

a year ago

Join us in a couple of hours for awesome talks on attacking and defending low-code/no-code apps 🚀 by @wyattDaveDev @ZivDanielHagbi

0 1 2 150 1

Download Image

0 0 0 73 0

NoCodeOps (acquired by Zapier) @nocodeops

a year ago

@nocodeops is joining @zapier, the leader in no-code automation! More here 👉 nocodeops.com/zapier

14 3 27 3K 3

IAM!ERICA @EricaZelic

a year ago

Pancakes have been had, now back to Power Automate. This tool is so powerful. As we all know, with great power comes .... This one will be a tough one to secure. Will need many layers of defense

4 1 23 2K 1

Michael Bargury @mbrg0

a year ago

tool drop time. enjoy! *powerpwn* v3 is out and its feature packed abusing m365 copilot collect full dumps of sensitive data across email, teams, sharepoint, calendar automated spear phishing scour the internet for copilot studio bots leaking sensitive data #DEFCON #BHUSA

7 137 543 64K 476

Download Image

WIRED Science @WIREDScience

a year ago

Attacks on Microsoft’s Copilot AI allow for answers to be manipulated, data extracted, and security protections bypassed, new research shows. wired.com/story/microsof…

2 21 40 27K 11

WIRED @WIRED

a year ago

Attacks on Microsoft’s Copilot AI allow for answers to be manipulated, data extracted, and security protections bypassed, new research shows. wired.trib.al/vULHXIm

1 20 32 26K 10

Assembly Man @avishai_efrat

a year ago

I found a publicly exposed confidential document belonging to a fortune 500 company using copilot studio 🤖 The first step in finding it was discovering over 1K unauthenticated copilot studio bots

4 9 75 13K 60

Download Image

Tamir Ishay Sharbat @tamirishaysh

a year ago

When I ask Copilot about bank details it starts talking about Satya Nadella?? This is ~RCE - Remote Copilot Execution. Making YOUR Copilot obey to ME. Asked about: -Emails? here's a link to the summary 😈 -Bank info? Here are the wrong details -And more... DIY guide: #RCE #BH

2 5 17 3K 9

Download Image

Lana Salameh @lana__salameh

a year ago

Wired magazine featuring #powerpwn Copilot spearphishing!! wired.com/story/microsof… youtube.com/watch?v=8qo42i…

0 5 8 1K 2

Gal Malka @GalMalka6

a year ago

Ever tried to navigate your way between the dozens of Microsoft admin portals? Just ask M365 Copilot, right? At your own risk. We got an ~RCE (Remote Copilot Execution) that can lead to phishing attacks just by sending a mail. #BHUSA #defcon32

1 7 15 3K 10

Download Video

Michael Bargury @mbrg0

a year ago

we got an ~RCE on M365 Copilot by sending an email by ~RCE I mean full remote control over its actions - search for sensitive content (sharepoint, email, calendar, teams), execute plugins and outputs - bypass DLP controls, manipulate references, social engineer its users on our…

24 345 1K 228K 874

Download Video

Michael Bargury @mbrg0

a year ago

an attacker wants to get sensitive data you have access to here's how they get YOUR copilot to find and analyze that data, and lure you to a malicious site to exfiltrate it #DEFCON

0 44 174 17K 162

Download Video

Michael Bargury @mbrg0

2 years ago

while msft docs say this is not possible, copilot studio can leak High Restricted SharePoint files to any user on the Internet, no auth required #copilot #dataleak

9 66 308 98K 140

Download Image

OWASP® Foundation @owasp

2 years ago

The 2023 OWASP Global Board election has been finalized. First, congratulations to all the candidates. Directors elected in the 2023 Election are: Steve Springett Sam Stepanyan Kevin Johnson Avi Douglen The term for the Directors will begin on January 1, 2024.