Google Accounts Attacked and Taken Over by This Unauthorized Security Flaw

[ad_1]

Google’s Cloud Platform (GCP) was vulnerable to a zero-day flaw that allowed attackers to access user accounts and all data there, including Gmail, Drive, Documents and Photos, researchers say. .

Experts at Astrix Security have discovered that attackers can create malicious Google Cloud Platform apps and advertise them through Google Marketplace or third-party providers.

Once the user installs the app, authorizes it, and links it to an OAuth token, the attacker gains access to their Google account.

Hide apps from victims

The attacker could then hide the app and hide it from Google’s application management page, making it impossible for the victim to address the vulnerability. The way to “hide” apps is where zero-days reside. By deleting the linked GCP project, the attacker puts the app in a “pending deletion” state and hides it from the application management page.

“This is the only place Google users can view their application and revoke access, so exploits are not malicious. (opens in new tab) You can’t remove apps from your Google account,” said the researchers.

The attacker can then restore the project at any time, obtain new tokens, and retrieve data from the victim’s account. Moreover, they may be able to do this indefinitely. “On the other hand, the attacker can unhide the application at will, use the token to gain access to the victim’s account, and immediately unhide the application again, making it undeletable. In other words, the attacker has a “ghost”. A token to the victim’s account. ”

Astrix called this flaw GhostToken.

Also note that the impact of this vulnerability is highly dependent on the permissions the victim grants to the malicious app.

This vulnerability was discovered in the summer of 2022 and addressed in April of this year.GCP OAuth applications currently pending deletion remain[アカウントにアクセスできるアプリ]displayed on the page.