Shadow IT Battlefield: The CyberHaven Breach and...
summary
A vendor breach lets attackers upload a poisoned Chrome extension by abusing OAuth; that campaign hits ~30 other extensions but a preexisting allowlist for OAuth apps plus browser extension allowlisting and spam filters prevent impact to Grammarly’s 40M+ users. Discovery uses Google Workspace APIs and CrowdStrike telemetry to inventory ~1,000 extensions (later pruned to ~400), automation + GPT drafts reviews, and a prototype ChromaWatch with tree-sitter static analysis pulls new versions and flags suspicious source→sink flows; preventive controls prove effective so far.
AI-written summary · about
chapters (13)
- 0:00Introduction and setup
- 1:28Incident overview and context
- 3:16CyberHaven breach details
- 5:48Grammarly’s targeted attack
- 7:37Preventive controls validation
- 8:19Risk reduction framework pillars
- 10:27Communication strategy importance
- 12:14Implementation technical choices
- 16:52Maturity and continuous refinement
- 17:20Demo of extension request process
- 20:10ChromaWatch monitoring project
- 24:00Key takeaways and wrap-up
- 24:46Q&A session
related talks
45mThe evil friend in your browser
29mUnraveling the Threat of Chrome Based Malware
25mExtension Breakdown...
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
48mA Weakness In Chrome & A New Hacking Technique
44mWhen you can't afford 0days: Client-side exploitation for the masses
35mBreaking Endpoint Anti-Ransomware: Going... (Nishant Sharma, Vivek Ramachandran)
55mCall To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering