Hacking G Suite: The Power of Dark Apps Script Magic (Live)
Matthew Bryant demonstrates post-exploitation magic in Google Workspace (G Suite), abusing Google Apps Script triggers to harvest credentials and pivot.
Summary
Google Workspace as an Under-Audited Enterprise Target
While Google Cloud Platform (GCP) receives extensive security scrutiny, Google Workspace (formerly G Suite) contains powerful embedded scripting engines that remain overlooked.
Weaponizing Google Apps Script for Post-Exploitation
Matthew Bryant demonstrates how attackers abuse Google Apps Script triggers, Gmail add-ons, and Docs macros to execute serverless payloads inside Google's infrastructure.
Silent Data Exfiltration and Lateral Movement
By leveraging Apps Script's native permissions, an implant can read all corporate emails, clone private Drive documents, and exfiltrate secrets without generating endpoint EDR telemetry.
Hardening Google Workspace Environments
Bryant provides Workspace administrators with API restriction policies, third-party app allowlists, and logging strategies to detect malicious script executions.
Related talks
Main Stage·44 min
Matthew Bryant
Matthew Bryant delves into Google Workspace exploitation, weaponizing Google Apps Script to bypass enterprise security perimeters and establish persistent cloud backdoors.
Cloud Village·27 min
Leo Tsaousis
Exploiting AWS Cognito misconfigurations to achieve privilege escalation and account takeover.
Main Stage·46 min
Bill Demirkapi
Demonstrates cross-tenant attacks and persistent firmware backdooring in major bare-metal cloud providers by exploiting legacy Baseboard Management Controllers.