Coursera Flash Sale
40% Off Coursera Plus for 3 Months!
Grab it
Explore the security vulnerabilities in Microsoft's Python integration within Excel through this 41-minute Black Hat conference presentation. Examine how Microsoft's Windows build 2407 introduced embedded =PY() functions that execute Python code as Jupyter notebooks on Microsoft-managed servers in the cloud, with built-in connections to Excel data as pandas objects. Discover multiple attack surfaces created by this implementation, including the Microsoft Azure host environment, Jupyter servers, and shared runtime environments with third parties. Learn practical exploitation techniques that demonstrate how to upload and execute binaries like nmap and netcat, install rpm packages, execute shell scripts, poison the Python environment, and potentially exfiltrate third-party data despite heavy environmental restrictions. Follow step-by-step demonstrations of Python code, Excel definitions, and automation methods that can be replicated with any Excel spreadsheet, presented by security researchers Shalom Carmel and Ofir Carmel who reveal the significant security implications of combining Excel's data processing capabilities with Python execution in cloud environments.
