This #defcon is going to be spoooooky~

In a little over 3 weeks, I'm going to deep dive into the #GhostToken 0-day vulnerability at @defcon, and the faults in the #OAuth protocol that led to it.

Hope to you see there, Aug 11, 12pm!

GhostToken: tutti gli account Google possono essere compromessi con un nuovo bug 0-day

Una società di sicurezza #informatica israeliana, ha scoperto una #vulnerabilità di #0day nella piattaforma cloud di #Google (GCP) soprannominata #Ghosttoken il 19 giugno 2022, che ha un impatto su tutti gli utenti di #Google.

La #vulnerabilità “GhostToken” potrebbe consentire agli attori delle #minacce di rendere un’#applicazione dannosa “#invisibile e #inamovibile”, rendendo l’#account #Google della vittima permanentemente infettato da un’app trojan.

#redhotcyber #informationsecurity #ethicalhacking #dataprotection #hacking #cybersecurity #cybercrime #cybersecurityawareness #cybersecuritytraining #cybersecuritynews #privacy #infosecurity

https://www.redhotcyber.com/post/ghosttoken-tutti-gli-account-google-possono-essere-compromessi-con-un-nuovo-bug-0-day/

GhostToken ließ Hacker in Deinem Google-Konto schnüffeln
#ITSicherheit #GhostToken #GMail #GoogleCloudPlatform #GoogleDrive #GoogleFotos #GoogleKalender #GoogleMaps #OAuth #Phishing #Sicherheitslücke https://tarnkappe.info/artikel/it-sicherheit/ghosttoken-liess-hacker-in-deinem-google-konto-schnueffeln-273327.html

The research team in Astrix uncovered #GhostToken - a 0-day #vulnerability in Google Cloud Platform (#GCP) allowing malicious #OAuth apps to become unremovable for Google users who installed them.

We had disclosed the vulnerability to Google who recently rolled out a patch for all users.
I've written a technical blog where you can read how we found the vulnerability and exploited it:
https://astrix.security/ghosttoken-exploiting-gcp-application-infrastructure-to-create-invisible-unremovable-trojan-app-on-google-accounts/

For those who are tight on time, the issue resides in the fact that any Google OAuth application is forcibly tied to a single GCP project. This supposedly makes easier to use any of GCP's services to develop OAuth apps.
However, we discovered that when the project associated with an OAuth app is deleted, the app enters a "limbo" state, being hidden from the user's management page (and thus unremovable), while its OAuth tokens are not revoked.

This primitive can be turned into an attack flow (as described in the blog), where an attacker controlling a malicious app can access the user's data without the user being able to revoke the access.