No IP, No Problem: Exfiltrating Data Behind IAP

The talk introduces Google Cloud's Identity-Aware Proxy, which sits in front of an application and blocks unauthenticated requests unless the caller has a valid identity and the right role. The speaker starts with two common misconfigurations: granting access to the all-users or all-authenticated-users member types, which effectively disables the gate, and leaving one endpoint out of IAP protection so it can be reached directly while the rest stays locked.

The central section covers CORS and preflight OPTIONS requests, which browsers send without credentials by design. It then examines an IAP setting called allow HTTP options that lets unauthenticated preflight requests reach the backend. Because the backend's response to such a request can be shaped by whoever deploys the app, an insider with a deploy-only role can encode a secret into a response header. An outside machine with no token then sends an OPTIONS request and reads the secret back. Repeating this with new versions, the speaker moved about 15 megabytes in one day during testing.

For defenders, the only visible step is the repeated deployment of new App Engine versions, which shows up as a sharp spike in create-version events at a fixed interval. The speaker notes that the App Engine Deployer role is commonly given to developers, which makes it a broader risk. Google acknowledged the issue and chose to update its documentation instead of changing the behavior for now. Practitioners should audit all-users bindings, verify IAP coverage on every endpoint, and review whether the preflight setting is needed.