GhostToken: Exploiting GCP to Create Unremovable Trojan Apps
Tal Skverer details GhostToken, a critical zero-day vulnerability in Google Cloud Platform allowing third-party OAuth apps to become invisible and unremovable.
Summary
OAuth 2.0 Integrations in Enterprise Cloud Platforms
Modern SaaS ecosystems rely heavily on third-party OAuth applications, where users grant scoped API tokens allowing external services to access email, documents, and cloud storage.
The Architectural Coupling of Google Accounts and GCP
Tal Skverer analyzes Google's migration requiring all third-party marketplace applications to be tethered to underlying Google Cloud Platform (GCP) developer projects.
Discovering the GhostToken Zero-Day Vulnerability
Manipulating GCP project deletion states places third-party OAuth applications into an unlisted 'pending deletion' limbo where valid access tokens persist indefinitely while disappearing from user management dashboards.
Creating Permanent, Invisible Backdoor Access
Exploiting GhostToken enabled an attacker to maintain persistent, unremovable access to a victim's Google Workspace data without any visible indicator in account security settings.
Related talks
Main Stage·40 min
Dylan Ayrey · Allison Donovan
Dylan Ayrey and Allison Donovan dissect Google Cloud Platform's security model, exploiting default service account permissions and `actAs` delegation to escalate privileges.
Main Stage·27 min
Dylan Ayrey · Allison Donovan
Dylan Ayrey and Allison Donovan answer questions regarding Google Cloud IAM nuances, default service accounts, and cloud lateral movement.
Main Stage·46 min
Bill Demirkapi
Demonstrates cross-tenant attacks and persistent firmware backdooring in major bare-metal cloud providers by exploiting legacy Baseboard Management Controllers.