The Silent Breach: Security Threats in Google Workspace
summary
Google Workspace audit logs miss key forensic signals so attackers can escalate and persist: a Chrome Web Store OAuth phishing chain yields refresh tokens to publish malicious extensions (campaign hit 2.6 million users and >30 extensions, active Dec 25–26) by bypassing no MFA during OAuth; compromised GCP service account keys enable service account impersonation to enumerate mail and drive without distinct token-exchange logs; mailbox rules creation and device/session metadata are absent. Recommended fixes: scrape Web Store, tighten domain‑wide delegation scopes, use Gmail API polling and automated cross‑log correlation.
AI-written summary · about
chapters (8)
- 0:00Introduction and setup
- 1:06About the speaker and research
- 2:10Why audit logs matter
- 3:33Chrome extension backdoors
- 9:17Domainwide delegation attacks
- 14:42Business email compromise
- 17:15Takeaways and recommendations
- 19:22Q&A session
related talks
48mThe Accidental Discovery of a New Vulnerability in Google's OAuth Implementation
32mWhat We Can Learn from Google’s Fight with Phishing
52mThe Dark Underbelly of 3rd-Party Application Access to Corporate Data
37mHacking OAuth Pitfalls and Remedies
30mGoogle Give Me Vulnz
45mLive Hacking Cloud Architectures
36mHow To Hack OAuth｜
43mPrivilege Escalation via Impersonation