CLOUD VILLAGE @BSidesNYC 2026

Sponsored by: AWS

Speaker: Nivas Durairaj

Abstract:

Your developers are already using AI — the question is whether you can see it. In this hands-on session we'll show how to surface shadow AI across an AWS Organization, fingerprint which models and services are being used against policy, and turn that signal into enforceable controls. Expect a live walkthrough: from zero visibility to an AI usage report and a concrete set of guardrails in a handful of clicks. We'll also touch on how AWS Config and Security Hub's AI inventory round out continuous compliance.

Speaker Bio:

Nivas Durairaj is a Worldwide Governance Specialist at AWS, where he helps customers design well-governed cloud environments and navigate the fast-moving landscape of AI governance, compliance, and security. He guides organizations on building enterprise-grade AWS foundations — spanning AWS Organizations, Control Tower, Config, and Controls. Based in New York City, Nivas has spent 14+ years at Amazon and holds an MBA from the University of Chicago Booth School of Business.

Sponsored by: Varonis

Speakers: Lior Adar & Chen Levy Ben Aroy

Abstract:

Lior will describe how testing Snowflake, a cloud data platform used by more than 12,000 organizations worldwide, revealed a privilege-escalation vulnerability in its managed PostgreSQL offering. We will explain how we chained this vulnerability with additional PostgreSQL primitives to achieve full OS-level remote code execution.

At the heart of the chain is a novel technique involving PostgreSQL’s documented LANGUAGE internal mechanism. By reconnecting blocklisted functions to compiled C symbols that remained present in the server binary, we restored capabilities that had been intentionally removed from the SQL catalog.

We will explore how cloud-managed PostgreSQL services operate, how their security model differs from traditional deployments, and how we assessed a hardened database environment. We will also present the bypasses uncovered during the research, explain how defenders can detect similar activity across Snowflake, other cloud providers, and self-managed PostgreSQL instances, and share practical guidance for securing roles, sensitive functionality, and configuration files.

Format:

-Introduction: 

- Technical overview: What is PostgreSQL and managed PostgreSQL instances, why they are interesting to us, and how they test the shared responsibility model. 

- The Foothold: From CREATEROLE to Privilege Escalation

We mapped Snowflake’s PostgreSQL restrictions, tested which SQL primitives were removed, and discovered how a non-superuser with CREATEROLE could gain superuser privileges.

-The Hidden Door: LANGUAGE internal

Explain how PostgreSQL binds function definitions to compiled C symbols. Show how, following privilege escalation, removed functions could be reconstructed from symbols still present in the server binary, restoring capabilities removed from the SQL catalog.

- From File Write to OS-Level RCE

Explain how large-object export enabled modification of postgresql.auto.conf and the hijacking of archive_command, transforming a file-write primitive into command execution as the PostgreSQL operating-system user.

- Takeaways: Review how to look for vulnerabilities in managed databases and reconstruct catalog-level blocklists during assessments, our experience with coordinated vulnerability disclosure with Snowflake, detecting this and similar exploitation techniques, and setting up secure PostgreSQL role scoping (treating CREATEROLE as near-superuser, restricting LANGUAGE internal function creation, and protecting configuration files from arbitrary writes). 

- Finally, Summary and Questions. We'll recap the full chain from a single low-privilege role to OS-level RCE, tie it back to what it means for anyone trusting a managed database’s hardening layer, and leave time for audience questions. 

Speaker Bio(s):

Lior Adar

He is a Senior Security Researcher at Varonis. With roots in red teaming, penetration testing, and incident response, and advanced research experience at Palo Alto Networks and Team8, Lior is currently focused on the practical security challenges of the Cloud, SaaS, and AI. Lior is an active member of the offensive security community, having led a technical workshop at DEF CON 33, and uncovering critical vulnerabilities and contribute to the LOLBAS project. He's a firm believer in the “attacker's perspective. 

Chen Levy Ben Aroy 

He is a distinguished cybersecurity leader with a proven track record in cloud security, penetration testing, and red teaming. As a Manager of Cloud Security Research at Varonis, Chen spearheads cutting-edge security research and innovation across multiple cloud-providers and platforms. His previous roles at well-known enterprises, such as Prosche Digital and ABInbev, showcased his expertise in advanced malware development and strategic project management. With a robust background in a wide array of cybersecurity domains, Chen's visionary approach and technical acumen make him a sought-after expert in the industry.

Speaker: Sasan Padidar

Abstract:

AI is making it much cheaper and faster to turn published vulnerabilities into working exploits. In our research, we ran more than 3,000 CVEs through an autonomous exploitation pipeline and found that many could be validated in minutes for just a few dollars of inference cost.

In this talk, I’ll show how the pipeline works, from understanding a CVE and building the right environment to generating, testing, and verifying an exploit, and what we learned about where agents succeed, where they fail, and why deterministic verification matters.

I’ll also connect this to cloud security: how reachability, attack paths, and environment context can help teams focus on what is actually exploitable based on live data instead of treating every vulnerability the same theoretical prioritization.

Speaker Bio:

Sasan is a serial cybersecurity entrepreneur with successful exits and deep experience building and scaling enterprise security platforms. His first startup, FlawCheck, was acquired by Tenable. Since then he has held senior leadership roles at CrowdStrike and Tenable, where he helped build and grow cloud security, vulnerability management, and application security businesses at global scale.

Speaker: Mohammed Ilyas Ahmed

Abstract:

The code interpreter in Copilot Studio sits behind two security boundaries: a Python sandbox and an LLM guardrail that reviews generated code before execution. BeyondTrust researchers bypassed both in a single attack chain, starting from a stock Copilot Studio agent that any licensed maker can build with nothing but the code interpreter toggle enabled.

The LLM guardrail is the novel element. Rather than hiding malicious intent in syntax, the researchers encoded their payload as an XOR-encoded integer array. From the guardrail's perspective, the generated code contained nothing suspicious: a PromptExecutor, some boilerplate, and a list of numbers. Only after the code was approved and executing inside the container did it XOR the integers back into a string and execute. The output: command execution as ContainerUser, outside the Python sandbox. They walked away with the TLS private key, environment variables, a hardcoded list of 140 EU institutions, and a static Administrator credential that works across every Copilot Studio code interpreter sandbox.

A second vulnerability, disclosed by PromptArmor on 19 August 2026, allowed a compromised Copilot Cowork sandbox to establish a command-and-control loop with an attacker server, exfiltrating emails from Outlook, files from SharePoint, plugin data, and full session chat history. Clicking the stop button did not help.

This talk presents both attack chains in full technical detail: the AI guardrail bypass via semantic obfuscation, the Python sandbox escape mechanics, the C2 loop through a supposedly network-isolated container, and the cross-sandbox static credential that turns a single escape into a platform-wide compromise. The talk closes with a defensive framework covering output filtering architecture, container hardening, network egress controls, and the detection engineering gaps that allow both attacks to succeed silently.

Speaker Bio:

Mohammed is a security and DevSecOps professional with deep experience helping organizations strengthen their security posture across modern, cloud-native environments. His work centers on bridging security, engineering, and operations to enable scalable, resilient, and secure systems in complex enterprise ecosystems.

He is an active contributor to the global technology community and a frequent speaker at leading industry conferences and platforms, including DEF CON, Black Hat, KubeCon (Paris), ISACA, IANS, and Wallarm, among others. He is also regularly invited to serve as a technical session judge, where he brings practical insight and industry rigor to evaluating emerging ideas and innovations.

He maintains strong ties with academia and thought leadership. He contributes research associated with Harvard University, publishing work that advances discussions on modern security practices, governance, and risk management. He is a member of the Harvard Business Review Advisory Council, where he supports collaboration between industry and academia and promotes knowledge sharing and innovation.

His work has a global dimension through his role on the Global Advisory Board of VigiTrust Limited (Dublin, Ireland), where he contributes to international strategies in cybersecurity, data protection, and risk management. He holds numerous industry certifications that reflect the breadth and depth of his expertise in security and cloud technologies.

He is the author of Cloud-Native DevOps, a practical guide to building scalable, reliable, and secure cloud-native applications. The book draws on real-world experience to cover modern DevOps and DevSecOps practices, containers, CI/CD pipelines, and security integration in cloud-native architectures.

Speaker: Bleon Proko

Abstract:

Google Workspace Apps Script is a feature that allows any user with a Gmail account to automate business applications and enables the applications to interact with each other. Underneath, when an Apps Script app is deployed, a GCP Project is created on the GCP Organization the account is part of. Aside from the format of the Project ID, these projects are not very different from a normal GCP project. This means, an attacker can choose to use one of these projects to host resources and persist on the target. They can also create a GCP project with the same name format as an Apps Script project to impersonate a legitimate Apps Script Project and evade detection.

This talk will go through how Apps Script projects work and how an attacker can utilize the Apps Script projects to persist in a target’s environment. Then, we will look into how these techniques can be detected and prevented, so they will not be able to be maliciously utilized by attackers.

Speaker Bio:

Bleon is an Info-sec passionate about Infrastructure Penetration Testing and Security, including Active Directory, Cloud (AWS, Azure, GCP, Digital Ocean), Hybrid Infrastructures, as well as Defense, Detection and Thread Hunting. He has presented topics related to Cloud Penetration Testing and Security in conferences like BlackHat USA, Europe and Sector, DEF CON, SANS Pentest Hackfest Hollywood and Amsterdam, as well as several BSides on USA and Europe.

His research include Nebula, a Cloud Penetration Testing Framework (https://github.com/gl4ssesbo1/Nebula) and other blogs, which you can also find on his blog (blog.pepperclipp.com). He is also the author of YetiHunter, DetentionDodger and Ransomwhen (https://github.com/Permiso-io-tools/[DetentionDodger | YetiHunter | Ransomwhen]).