Exploitation of Google Authentication Vulnerability Raises Security Concerns

A recently identified vulnerability in Google’s authentication process, characterized by some as a zero-day, has become a target for threat actors employing information-stealing tactics. Cybersecurity firm CloudSEK reports that this vulnerability allows threat actors to regenerate persistent Google cookies, providing ongoing access to Google services. The issue is linked to the undocumented MultiLogin endpoint, designed for synchronizing accounts across various Google services when combined with account ID and tokens obtained from Chrome.

The vulnerability involves extracting the Google Accounts and ID Administration (GAIA) IDs and encrypted tokens from logged-in accounts in Chrome. The attackers decrypt the tokens using an encryption key stored in Chrome’s Local State within the UserData directory. This process enables threat actors to generate Google cookies persistently, leading to prolonged access to Google services.

Initially highlighted by a malware developer in October, the vulnerability gained traction, with the Lumma infostealer family implementing the technique by mid-November. Despite Lumma encrypting the token-GAIA ID pair with its own keys, other infostealer groups adopted the method by the end of December.

The widespread adoption of this technique raises concerns about potential cyberattacks, with corporate email addresses vulnerable to ransomware attacks and other malicious activities. The exploit remains effective even after users reset their passwords, allowing for prolonged and potentially unnoticed exploitation of user accounts and data.

Google was alerted about the vulnerability over a month ago, and the company has taken action to secure any compromised accounts detected. However, the persistence of access and potential for prolonged exploitation has prompted concerns about the need for enhanced security measures. CloudSEK emphasizes the importance of users continuously removing malware from their computers and recommends enabling Enhanced Safe Browsing in Chrome to guard against phishing and malware downloads.

SecurityWeek has reached out to Google for a statement on the matter, and updates will be provided as soon as a response is received. Google has acknowledged recent reports of a malware family stealing session tokens and emphasizes its routine efforts to upgrade defenses against such techniques. The company assures users that compromised accounts are addressed promptly, and stolen sessions can be invalidated by signing out of the affected browser or remotely revoking them via the user’s devices page. Google will continue monitoring the situation and provide updates as needed, encouraging users to take steps to remove malware and enhance browser security.

Stay updated with supply chain news at The Supply Chain Report. Learn more about international trade at ADAMftd.com with free tools.

#GoogleVulnerability #ZeroDay #Cybersecurity #CloudSEK #InformationStealing #LummaInfostealer #CyberAttacks #MalwarePrevention #EnhancedSafeBrowsing #DataProtection