Google's not being ghosted from vulnerabilities. [Research Saturday]

Aug 26, 2023

Listen in Apple Podcasts Pocket Casts Castro

This episode isn’t summarized yet

Create a free account and summarize it. In a few minutes you’ll have the key takeaways and a section-by-section summary.

Create a free account Sign in

Show notes

Tal Skverer from Astrix Security joins to discuss their work on "GhostToken – Exploiting GCP application infrastructure to create invisible, unremovable trojan app on Google accounts." Astrix’s Security Research Group revealed a 0-day flaw in Google’s Cloud Platform (GCP) on June 19, 2022, which was found to affect all Google users.
The research states "The vulnerability, dubbed “GhostToken”, could allow threat actors to change a malicious application to be invisible and unremovable, effectively leaving the victim’s Google account infected with a trojan app forever." Google issued a patch to this vulnerability in April of this year, but researchers explain why this can be severe.
The research can be found here:
GhostToken – Exploiting GCP application infrastructure to create invisible, unremovable trojan app on Google accounts

Learn more about your ad choices. Visit megaphone.fm/adchoices