CloudSEK, a threat intelligence company, publishes research on data breaches, malware, ransomware, and exploited vulnerabilities.
HN commenters cite its reports on Google cookie regeneration and the disputed Oracle Cloud breach, noting CloudSEK stood by its claims with more evidence.
> Last October 2023, a user known by the pseudonym PRISMA revealed on his Telegram channel that he had managed to restore expired Google authentication cookies. This allowed him to access Gmail accounts, even if the user had changed the password, and generate new session cookies with which to continue entering them in an unauthorized manner.
> Specifically, what they do is take advantage of an endpoint called MultiLogin from Google OAuth to log into user accounts without having to follow the authentication process. This was revealed in a publication on his official blog
The blog (https://www.cloudsek.com/blog/compromising-google-accounts-malwares-exploiting-undocumented-oauth2-functionality-for-session-hijacking) goes into a lot more detail. In particular is this point:
> While we await a comprehensive solution from Google, users can take immediate action to safeguard against this exploit. If you suspect your account may have been compromised, or as a general precaution, sign out of all browser profiles to invalidate the current session tokens. Following this, reset your password and sign back in to generate new tokens. This is especially crucial for users whose tokens and GAIA IDs might have been exfiltrated. Resetting your password effectively disrupts unauthorized access by invalidating the old tokens which the infostealers rely on, thus providing a crucial barrier to the continuation of their exploit.
I'm confused on how and why the exploit and "safeguard" (not even…
CloudSEK | REMOTE | https://cloudsek.com
CloudSEK's XVigil is an AI-driven Digital Risk Management platform. XVigil monitors millions of internet sources across the Surface Web, Deep Web and Dark Web to detect cyber threats, data leaks, brand infringements, and identity thefts.
CloudSEK XVigil has been helping organizations by providing timely, specific and actionable intelligence, thereby providing and attackers perspective about your organization.
* Threat Intelligence Lead - https://cloudsek.com/job/senior-threat-intel-lead-manager-bangalore/
* DevOps Engineer - https://cloudsek.com/job/devops-engineer/
* Senior PHP developer - https://cloudsek.com/job/php-developer/
* Cybersecurity Analyst - https://cloudsek.com/job/cybersecurity-analyst/
See further details in postings.
More jobs here: https://cloudsek.com/jobs
No wonder that explains the amount of ransomware garbage on Android devices out there: [0] and it is more prevalent on Android than iOS. [1]
[0] https://www.cloudsek.com/threatintelligence/copy-of-malware-intelligence-analysis-of-daam-android-malware
[1] https://www.helpnetsecurity.com/2023/09/22/apps-attack-risk
This would be a better link; the blog post on which the Bleeping Computer article is primarily based. They refer to it but never link to it:
https://www.cloudsek.com/blog/compromising-google-accounts-malwares-exploiting-undocumented-oauth2-functionality-for-session-hijacking
Here's a real-world example: https://cloudsek.com/security-flaw-in-atlassian-products-jira-confluencetrello-bitbucket-affecting-multiple-companies/
"... cookie validity is 30 days. They only expire when the user logs out, or after 30 days."
The original reporter (CloudSek) is doubling down in his claims and now they put some evidence that contradicts Oracle https://www.cloudsek.com/blog/part-2-validating-the-breach-oracle-cloud-denied-cloudseks-follow-up-analysis