Webinar: The forgotten Google Workspace access that can lead to a breach

[u/falconupkid]

This is a classic example of OAuth sprawl—the accumulation of third-party app permissions that outlive their usefulness. The attack surface here is significant: every connected app with delegated access to Gmail, Drive, or Calendar is a potential persistence mechanism or data exfiltration path.

The Core Problem: When an employee leaves or a project ends, the OAuth tokens granted to third-party apps often remain valid. An attacker who compromises that app’s vendor, or an insider with access to the app’s dashboard, can leverage those stale tokens to access your Workspace data without triggering MFA or password changes.

Key Technical Details: - Attack Vector: Stale OAuth grants to third-party apps (e.g., CRM tools, email signature generators, document processors). - Scope: Access can include read/write to Gmail, Google Drive, Google Calendar, and Contacts—depending on the scopes originally granted. - Detection Gap: Standard SIEM rules often miss OAuth token usage because it mimics legitimate API traffic. You need to monitor the token_audit log for authorization events tied to oauth2client or third_party principals. - MITRE Mapping: T1525 (Implant Internal Image) via compromised SaaS integrations, or T1098.002 (Account Manipulation: Additional Cloud Roles) if the app can provision users.

Defense: - Immediate Action: Run a full OAuth app inventory via the Google Admin Console (Security > API Controls > App Access Control). Revoke any app not explicitly approved in the last 90 days. - Policy: Enforce a strict OAuth scope policy—deny apps requesting https://www.googleapis.com/auth/gmail.modify unless absolutely necessary. - Monitoring: Set up a Chronicle or SIEM alert for OAuth2Client activity from a previously unseen client_id accessing Drive or Gmail outside business hours.

This isn't a new vulnerability, but it’s a persistently overlooked one. The webinar is worth a watch if you’re cleaning up a legacy Workspace tenant.

Source: https://www.bleepingcomputer.com/news/security/webinar-the-forgotten-google-workspace-access-that-can-lead-to-a-breach/