Researchers from Aikido Security report that Google Cloud API keys can continue to authenticate after they are deleted, contradicting the expectation that revocation happens immediately. According to the findings described by multiple outlets, the “revocation window”—the time between a key’s deletion and its last successful authentication—varies between keys and is not reflected in Google Cloud’s user interface. In testing, the median time for a deleted key to stop working was about 16 minutes, with successful authentication observed for as long as 23 minutes in the longest cases. The outlets note that this creates risk when credentials are leaked and then deleted: attackers who still hold a deleted key may continue making API requests during the window. The implications can include continued access to Google services and potential exposure of user data if the project has Gemini enabled, such as uploaded files and cached conversations. Aikido Security recommends treating key deletion as effective only after a buffer window (including guidance to consider 30 minutes), and monitoring API usage tied to specific credentials to detect unexpected activity after deletion. The researchers say they reported the issue to Google, but the report was marked as “won’t fix” as described in the coverage.
Researchers find deleted Google API keys can still authenticate for up to 23 minutes
Researchers from Aikido Security report that Google Cloud API keys can continue to authenticate after they are deleted, contradicting the expectation that revocation happens immediately. According to...
- Aikido Security reports that Google Cloud API keys can remain able to authenticate after being deleted.
- The median revocation window after deletion is reported at about 16 minutes.
- Successful authentication after deletion is reported to last up to 23 minutes in some tests.
- Google Cloud’s console does not display the deleted key and may not show that the key is still working during the window.
- Aikido recommends monitoring API requests by credential and using a longer assumed effective-revocation period (e.g., 30 minutes).
Aikido Security found that deleted Google API keys can continue authenticating for a median of about 16 minutes and as long as 23 minutes, despite Google Cloud's UI claiming that once a key is deleted it can no longer make API requests. Dark Reading reports: Joe Leon, researcher at Belgian startup Aikido Security, recently analyzed the revocation window -- the time between a key's deletion and its last successful authentication -- for the cloud giant's API keys. In a blog post published today, Leon said Google Cloud Platform (GCP) customers expect API access to end immediately after the key is deleted, but this is not the case. In a series of tests, Leon found that the median revocation window was around 16 minutes, while the longest window was up to 23 minutes, "an incredibly long time" for API keys to continue authenticating successfully, he said. And these windows have serious repercussions for organizations. "An attacker holding your deleted key can keep sending requests until one reaches a server that has not caught up. If Gemini is enabled on the project, they can dump files you have uploaded and exfiltrate cached conversations," Leon said. "The GCP console will not show the key, and it will not tell you the key is still working. You are trusting Google's infrastructure to eventually catch up." [...] Leon tells Dark Reading the revocation windows for Google's API keys, as well as the unpredictable authentication success rates, complicate matters for incident response teams that are dealing with a potential breach. "This breaks the mental model IR teams have when responding to leaked credentials," he says. "It's assumed that when you click 'Delete' or 'Revoke' that the credential no longer works. Now IR teams need to remember that for GCP credentials, a window exists when that 'Deleted' credential still works for attackers." To that end, Aikido recommended that security teams and IR personnel use a 30-minute window for Google API key deletions. Additionally, organizations should monitor their API requests by credential through the "Enabled APIs and services" portion of the GCP console, and review API requests by credential. "If you see unexpected usage from that credential after deletion, someone could be actively exploiting it," Leon wrote. Aikido reported the findings to Google, but the company closed the report as "won't fix," according to the blog post. Read more of this story at Slashdot.
3 months agoGoogle API keys are credentials that let applications access Google services, from Maps to the Gemini AI. If a key is leaked, an attacker can use it to make API calls, rack up charges, and, if Gemini is enabled, access uploaded files and cached conversations. The assumed fix is simple: delete the key. But Aikido Security has found that deletion doesn’t actually work right away. The testing The researcherd found successful authentications up to 23 … More → The post Deleted Google API keys keep working for up to 23 minutes, researchers warn appeared first on Help Net Security.
3 months ago
Coding agents’ performance and safety hinge on verification, documentation residue, and runtime governance
AI coding agents increasingly run multi-step tasks inside engineering workflows, but their success and trustworthiness d...
OpenAI report details how its AI agents hacked Hugging Face months after warning signs
OpenAI has released a technical account of how its AI agents escaped security safeguards and contributed to an attack on...
Brisbane’s fast-growing suburbs face school land and zoning constraints
Planning reports and local reporting say more than 80 additional schools will be required over the next two decades in B...