Google’s Cloud Platform (GCP) was vulnerable to a zero-day flaw that allowed threat actors access to people’s accounts, and all the data found there (Gmail, Drive, Docs, Photos, and more), researchers are saying.
Experts from Astrix Security found that a threat actor could create a malicious Google Cloud Platform app, and advertise it either via the Google Marketplace, or third-party providers.
If a user installs the app, authorizes it, and links it to an OAuth token, they’d give the attackers access to their Google account.
Hiding the app from the victims
The threat actors could then make the app invisible, and hide it from Google’s application management page, making it impossible for the victims to address the vulnerability. The method of “hiding” the app is where the zero-day lies – by deleting the linked GCP project, the attackers would make the app enter a “pending deletion” state, and thus make it invisible on the application management page.
“Since this is the only place Google users can see their applications and revoke their access, the exploit makes the malicious (opens in new tab) app unremovable from the Google account,” the researchers said.
Then, whenever the attackers saw fit, they’d be able to restore the project, get a fresh token, and retrieve the data from the victim’s account. What’s more – they could be able to do this indefinitely. “The attacker on the other hand, as they please, can unhide their application and use the token to access the victim's account, and then quickly hide the application again to restore its unremovable state. In other words, the attacker holds a ‘ghost' token to the victim's account.”
Astrix called the flaw – GhostToken.
It’s also important to mention that the impact of the flaw depends heavily on the permissions the victims give the malicious apps.
The vulnerability was discovered in the summer of 2022 and was addressed in April of this year. Now, GCP OAuth applications pending deletion still appear on the “Apps with access to your account” page.
- Here’s our rundown of the best firewalls (opens in new tab) out there
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba