Threat hunters find Google API keys still usable 23 minutes after deletion

Attackers with a leaked Google API key can continue using the credential after the key is deleted because revocation propagates gradually across Google infrastructure. Some servers stop accepting the key within seconds, while others keep it valid for as long as 23 minutes. During this window, attackers can repeatedly send authenticated requests until they reach a server that has not yet rejected the key. If Gemini is enabled, attackers can access files uploaded to Gemini and exfiltrate cached conversation context. Researchers measured the behavior by creating keys, deleting them, and sending multiple requests per second across trials until responses ceased. A similar issue was previously reported for AWS keys with a shorter exploitation window.

"“We've identified a substantial window where an attacker with access to a leaked Google API key can continue to misuse that credential, after the user believes the key is revoked,” Joseph Leon, a security researcher with Aikido, told The Register. “In that window, an attacker could run up charges, pull sensitive files uploaded to Gemini, and exfiltrate cached context.”"

"Aikido tested the gap during 10 trials over two days. In each trial, researchers created an API key, deleted it, and then sent three to five authenticated requests per second until no valid response came back for several minutes. From the time a user deletes the Google API key to when it can no longer be used propagates gradually across Google's infrastructure, he said. Some servers reject the key within seconds while others keep accepting it for 23 minutes."

"What this means is that an attacker holding a deleted key can repeatedly send requests until one reaches a server that has not caught up, Leon said. If Gemini is enabled on the project, they can dump files that were uploaded and exfiltrate cached conversations. The paper cited a similar problem researchers disclosed in December involving AWS keys. In that case, after deletion, attackers had a four-second window to exploit, and researchers showed how they could create new credentials in that time."

"“Four seconds was enough to matter on AWS,” Leon wrote in the paper. “Given recent attention to Google API keys used to access Gemini, we set out to measure how long Google's API key revocation window remains open.”"

Read at theregister