Squirer: GhostToken — Undeletable Trojan Apps in Google Cloud
A DEF CON 31 talk on a 0-day vulnerability in Google Cloud Platform that allowed malicious OAuth apps to be hidden from users, making them impossible to see or remove.
The researcher shows how a flaw in handling the “pending deletion” state caused apps to become invisible in the account while still retaining access to user data.
The talk also covers detection methods and highlights broader issues in OAuth implementations across major cloud providers.
The researcher shows how a flaw in handling the “pending deletion” state caused apps to become invisible in the account while still retaining access to user data.
The talk also covers detection methods and highlights broader issues in OAuth implementations across major cloud providers.