The Accidental Discovery of a New Vulnerability in Google's OAuth Implementation
summary
Early 2021 discovery shows a client impersonation vulnerability in Google first‑party apps: stolen client IDs and secrets let an attacker present as Chrome or Cloud SDK, complete the OAuth code exchange (manual copy step), and list Google Drive files. A demo site reproduces the exploit; it works against enterprise ACLs and logs, and refresh tokens persist past password resets. Google removes the problematic out‑of‑band URI and other fixes largely mitigate it; Pixie/PKCE is suggested for remaining native‑app risks.
AI-written summary · about
chapters (10)
- 0:00Introduction and backstory
- 2:04OAuth case study overview
- 6:16Demonstrating the exploit
- 10:04Understanding OAuth mechanics
- 12:29Security controls and redirects
- 16:39Analyzing the OOB URI issue
- 19:20Token exchange and trust
- 20:59Client secret vulnerabilities
- 23:05Enterprise risks and remediation
- 39:16Q&A and concluding thoughts
related talks
37mHacking OAuth Pitfalls and Remedies
22mThe Silent Breach: Security Threats in Google Workspace
18mHow to Hack OAuth
36mHow To Hack OAuth｜
47mTop X OAuth 2 Hacks
52mThe Dark Underbelly of 3rd-Party Application Access to Corporate Data
23mUniversal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in...
47mHacking OAuth