Conference:  Defcon 31

Authors: Tal Skverer Security Research Team Lead, Astrix Security

2023-08-01

In this talk, we will present a 0-day vulnerability found in the Google Cloud Platform (GCP) affecting all Google users, which allowed a malicious app to become invisible and unremovable, effectively leaving a Google user’s account infected with a backdoor app forever. The talk will start by reviewing the world of 3rd-party apps in Cloud platforms: the OAuth 2.0 standard, consent, scoped authorization, the types of tokens, and how data is accessed. Shifting the focus on Google, as one of the biggest cloud service providers supporting OAuth 2.0, we will show how 3rd-party apps are created, developed, and managed in Google (you will even get to manage yours in real time). We will discuss how Google relatively recently moved from the standard registration model, to forcibly linking the creation apps to Google Cloud Platform (GCP), hoping to push developers into using one of the GCP services for app development. We will then give a complete technical overview of a 0-day vulnerability found in GCP, dubbed 'GhostToken': The research of the aforementioned connection between apps in Google and GCP, which culminated in finding the ability to force an app to go into a limbo-like, “pending deletion” state, during which the app’s tokens are mishandled. We will show an exploitation of the vulnerability which enables an attacker to hide their authorized app from the user’s management page, causing it to become invisible and unremovable, while still having access to the user’s data. Finally, we will share how Google Workspace’s administrators could detect apps that potentially exploited the GhostToken vulnerability, as well as actions organization implementing 3rd-party access to their users' data can take to avoid making such mistakes. The talk will close with a discussion about the common abuse of and deviation from the OAuth standard by large providers, and propose a possible solution for supporting and implementing apps for large cloud providers. Familiarity with GCP and different OAuth 2.0 flows will help understand the concepts, but it is not required as the talk is self-contained.

Conference:  Global AppSec San Francisco 2022

Authors: Jenko Hwong

2022-11-18

Supply chain identity attacks are not new, for example the Golden SAML attack (Cyberark, 11/2017), which used stolen certificates to spoof SAML responses. Recently, new POC identity attacks have been published such as gaining access to a Facebook account that uses Gmail as the identity provider via OAuth 2.0 (Sammouda, 5/2022), utilizing the chaining of traditional web vulnerabilities such as XSS with the design of the OAuth protocol in order to steal OAuth session tokens. These new attacks pose new challenges for security operations: remotely-enabled attacks by design without need for endpoint compromise, near-permanent access, no need to go through MFA challenges, and incomplete controls for security operations in preventing, detecting, and responding to these attacks.This presentation looks underneath the hood at these more recent attacks that are combining attacks against peculiarities in today's ubiquitous OAuth 2.0 protocol along with traditional web vulnerabilities. We will cover how these attacks work, what's different about them, how OAuth 2.0 is used and abused, and how we must incorporate new controls specific to the protocols involved in order to defend against these attacks.We'll look at what controls or measures are provided by identity vendors such as Microsoft and Google and popular SaaS apps, and look at the cost-benefit of implementing your own controls.This presentation will focus on hands-on demos to illustrate the new attacks as well as efficacy of defensive measures. Slides will focus on security architectures and flows to convey fundamental concepts. Any useful tools or demonstrations will be made available in an open-source repository under 3-Clause BSD licensing.