The $2 Million Permission You Forgot You Granted
A recent security breach at Vercel highlights the risks associated with OAuth permissions granted to third-party applications. Attackers exploited forgotten permissions to access internal environment variables, leading to a $2 million ransom demand. This incident underscores the importance of regularly auditing app permissions to prevent unauthorized access.
- ▪The breach occurred due to a forgotten permission granted to a third-party app via OAuth.
- ▪Attackers accessed internal environment variables and demanded a ransom of $2 million.
- ▪The breach was linked to an earlier infection of an employee at an AI company by Lumma Stealer malware.
Opening excerpt (first ~120 words) tap to expand
try { if(localStorage) { let currentUser = localStorage.getItem('current_user'); if (currentUser) { currentUser = JSON.parse(currentUser); if (currentUser.id === 3882479) { document.getElementById('article-show-container').classList.add('current-user-is-article-author'); } } } } catch (e) { console.error(e); } Bulut Caner Posted on May 18 The $2 Million Permission You Forgot You Granted #hack #cybersecurity #security At some point you clicked login with Google or another account on a third-party app because it was faster and it was the easiest way to get what you wanted from the site. You clicked and forgot about it. Well, so did a Vercel employee.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at DEV.to (Top).
Discussion
0 commentsMore from DEV.to (Top)
