The Dark Underbelly of 3rd-Party Application Access to Corporate Data
summary
Analyzes millions of production OAuth approvals and finds 400+ unique apps on average, one enterprise with 12,330 apps in one org, and about 44% of apps request sensitive scopes like full Google Drive or email read/write; flags odd apps (DoorDash, CamScanner) and tooling (Postman, Zapier) asking broad access. Shows how to pull Google Workspace OAuth token logs or CSV exports, prioritize by scope and user role, and the need to revoke refresh and access tokens correctly during incidents.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:07OAuth basics and problem setup
- 4:59User-driven access model risks
- 14:00Analyzing OAuth approval data
- 22:59Permission risk framework
- 31:14F framework for risk assessment
- 37:35Why we got into this mess
- 42:13Practical solutions and controls
- 44:45Prevention and detection measures
- 50:07Next steps and action plan
related talks
48mThe Accidental Discovery of a New Vulnerability in Google's OAuth Implementation
27mSecurity Issues In OAuth/OIDC Implementations
22mThe Silent Breach: Security Threats in Google Workspace
54mCredential Sharing As A Service: The Dark Side Of No Code
23mUniversal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in...
36mHow To Hack OAuth｜
20mOAuth 2: A closer look
37mHacking OAuth Pitfalls and Remedies