Tirsdag – 1 · Frimurerlosjen, rom 2
Security Specialist at Binary Security
Christian is a security specialist at Binary Security and has worked in the security industry for over ten years as a penetration tester and application security engineer. At work he likes to write security tools and find cool security bugs. Off work he likes to spend time with his family, play racket sports or enjoy a casual game of Worms Armageddon.
APIs are everywhere, exposing both data and actions. Many organizations, including many Fortune 500 companies and even banking authorities, utilize cloud API gateways to provide a uniform method for exposing APIs. These gateways often provide centralized authentication and authorization. But what happens when the gateways themselves leak secrets, keys, and credentials, or expose sensitive information about backend services?
Credentials grant access. Sometimes a staggering amount of it. This access can often be exploited from anywhere in the world, with only an IP address providing a hint as to who is abusing it. This talk tells the story of a bug discovered in an Azure component in 2025 that leaked passwords and keys, illustrating the potential for disaster when core infrastructure is compromised. We will reflect on how to detect credential exposure, minimize the blast radius, and effectively plan for compromise.
Programmet er oppdatert.