First Party Problems in a Zero Trust World: The Accidental Discovery of a New Vulnerability in Google's OAuth Implementation

No ratings

Presented at BlackHat USA 2023 by

Brian Smith-Sweeney

Beware, dear friends, the cautionary tale of the cloud provider that broke its own security model. Ignoring RFCs! Putting plaintext passwords in scripts - and printing them in books! It's a crazy story, but one that may nonetheless resonate with enterprise security practitioners everywhere.In early 2021, I identified a client impersonation vulnerability in a series of Google "first-party" applications. This vulnerability allows an attacker to present themselves both to a user and to Google as one of these applications, and enjoy all the privileges therein. These privileges include subverting Google's app verification process to access sensitive scopes, bypassing enterprise app controls, leveraging Google's infrastructure to execute OAuth phishing attacks, and obfuscating attacker activities to maintain account access. For all intents and purposes, the attacker's application becomes a Google application. While the vulnerability itself is interesting, the story of how it came to be is even more so. I will take you on a 40-minute walk through a year's worth of work - from identifying inexplicable behavior, to trawling RFCs and SDKs, to standing up a functional demo - to tell that story. You will see how decisions made across disparate teams, in different decades, can end up breaking core tenets of a security model.This will be the first public disclosure of this vulnerability.