Ghosttoken Exploit Allows Hackers to Backdoor Google Accounts Through GCP Flaw

Astrix Security, an Israeli cybersecurity startup, has uncovered and disclosed details of a zero-day vulnerability in Google Cloud Platform (GCP) that could have allowed attackers to hide an unremovable, malicious application within a victim’s Google account.

This vulnerability, known as GhostToken, affected all Google accounts, including those in the enterprise-focused Workspace accounts. The discovery was reported to Google on June 2022, and after more than nine months of patch development, Google has finally deployed a global patch on April 2023. This flaw could have allowed cybercriminals to backdoor Google accounts and gain unauthorized access to sensitive information.

According to a report by Astrix Security, a new exploit has been discovered that allows a malicious app to be hidden from Google’s application management page. This is the only place where Google users can manage apps connected to their accounts.

The exploit makes the malicious app unremovable from the Google account since users cannot see it or revoke its access. The attacker has the ability to reveal their application at any time and utilize the token to gain entry into the victim’s account.

Once they are done, they can quickly hide the application again to restore its unremovable state. Essentially, the attacker holds a ‘ghost’ token to the victim’s account, making it difficult for users to remove the malicious app from their Google account. This new exploit highlights the importance of being vigilant about the apps connected to your Google account and regularly checking and revoking access to any suspicious apps.

Attackers can gain permanent and unremovable access to victims’ Google accounts by converting authorized third-party apps into malicious trojan apps, according to Astrix Security Research Group.

The vulnerability allows attackers to delete and restore a Google Cloud Platform project repeatedly, which can hide the malicious app and allow access to victims’ personal data. Google’s patch allows users to remove apps in a ‘pending deletion’ state and protect their accounts from hijack attempts. Astrix recommends checking all authorized third-party apps and ensuring they only have necessary permissions.