Bitdefender Labs has identified vulnerabilities in Google Workspace that could result in ransomware attacks, data exfiltration [1] [2] [3] [4] [5] [6], and password recovery attacks [2] [3] [4]. These vulnerabilities also enable unauthorized access to Google Cloud Platform (GCP) with custom permissions and facilitate lateral movement between machines [1].
Description
The exploits target the use of Google Credential Provider for Windows (GCPW) [1], which offers mobile device management (MDM) and single sign-on (SSO) capabilities [1] [2]. Specifically, the attacks focus on virtual machine (VM) deployments and exploit the cloning of VMs. It is important to note that executing these exploits requires compromising a local machine [1]. Bitdefender has alerted Google to these attack methods [6], but Google has chosen not to address them due to a misalignment with its threat model [6]. To support the security community [6], Bitdefender has incorporated detections for these attacks in GravityZone XDR [6].
Conclusion
These vulnerabilities pose significant risks [4], including the potential for ransomware attacks, data breaches, and unauthorized access to GCP. While Google has chosen not to address these vulnerabilities, it is crucial for organizations using Google Workspace to be aware of these risks and take appropriate measures to mitigate them. Bitdefender’s inclusion of detections for these attacks in GravityZone XDR provides valuable support to the security community. Moving forward, it is essential for organizations to remain vigilant and proactive in addressing potential security threats in their Google Workspace environments.
References
[1] https://ciso2ciso.com/google-workspace-weaknesses-allow-plaintext-password-theft-source-go-theregister-com/
[2] https://thehackernews.com/2023/11/hackers-could-exploit-google-workspace.html
[3] https://ciso2ciso.com/hackers-could-exploit-google-workspace-and-cloud-platform-for-ransomware-attacks-sourcethehackernews-com/
[4] https://vulners.com/thn/THN:D196A2E27B8C8308027F114EE56D63E5
[5] https://www.bitdefender.com/blog/businessinsights/the-chain-reaction-new-methods-for-extending-local-breaches-in-google-workspace/
[6] https://www.hackread.com/google-workspace-vulnerabilities-network-breaches/
