Hacking G Suite: The Power of Dark Apps Script Magic
Matthew Bryant delves into Google Workspace exploitation, weaponizing Google Apps Script to bypass enterprise security perimeters and establish persistent cloud backdoors.
Summary
Google Workspace as an Overlooked Attack Surface
While Google Cloud Platform (GCP) receives extensive security focus, Google Workspace (formerly G Suite) contains powerful, interconnected automation scripting capabilities.
Weaponizing Google Apps Script for Post-Exploitation
Matthew Bryant demonstrates how Apps Script can be weaponized to interact with Gmail, Google Drive, Docs, and Admin APIs on behalf of authenticated enterprise users.
Crafting Stealthy Cloud C2 and Data Exfiltration Channels
Using Apps Script triggers and web apps, an attacker establishes persistent, domain-fronted command and control channels running entirely within Google's cloud infrastructure.
Auditing and Securing Google Workspace Environments
Bryant provides security teams with automated auditing tools and OAuth token governance policies to detect malicious Apps Script projects.
Related talks
Live Presentations·43 min
Matthew Bryant
Matthew Bryant demonstrates post-exploitation magic in Google Workspace (G Suite), abusing Google Apps Script triggers to harvest credentials and pivot.
Main Stage·46 min
Bill Demirkapi
Demonstrates cross-tenant attacks and persistent firmware backdooring in major bare-metal cloud providers by exploiting legacy Baseboard Management Controllers.
Main Stage·39 min
David Cash · Rich Warren
Discloses a critical vulnerability in cloud-managed enterprise VPN platforms that allowed unauthenticated administrative takeover across thousands of corporate networks.