The Integration Token Nobody Was Watching
In late August, Google’s Threat Intelligence Group published details of a campaign it tracks as UNC6395. Between roughly August 8 and August 18, the actor used OAuth tokens associated with the Salesloft Drift integration to connect to customers’ Salesforce instances and run large data exports. Salesloft and Salesforce revoked the tokens on August 20. Google later reported that tokens for the Drift email integration had also been used to access a small number of Google Workspace accounts.
The list of affected organizations is long and includes many security companies, several of which published their own notifications. What the victims had in common wasn’t weak security. Many had MFA, conditional access and single sign-on in place. The attackers never logged in as a user. They arrived as a trusted application that had been granted access months or years earlier.
Why integration tokens are different
When an employee connects a SaaS application to another, for example letting a chat tool create leads in the CRM, the platforms exchange OAuth tokens. Those tokens:
- represent an application, not a person, so MFA and sign-in risk policies usually don’t apply to them
- often carry broad scopes, because broad scopes make integrations easier to set up
- can last a long time, through refresh tokens that keep access alive without user involvement
- are stored by the integration vendor, so their security depends on that vendor’s environment
In this campaign, the actor reportedly searched exported data for further secrets: cloud access keys, passwords and tokens for other platforms that had been pasted into support cases and records. A CRM holds more sensitive operational data than most organizations realize, because people use it to collaborate.
What to do now
Inventory connected applications. Each major SaaS platform can list the third-party applications holding OAuth grants, with their scopes and last use. For the CRM, collaboration suite and code repositories, review that list with the business owners. Remove integrations nobody uses, and question any that have far broader access than their purpose requires.
Restrict who can authorize new integrations. Many platforms let any user grant an application access to their data. Requiring administrator approval for new integrations, or for high-risk scopes, puts a review step in front of the decision.
Constrain integration access where the platform allows. Options vary by platform, but may include restricting the IP ranges an integration can connect from, limiting the API operations it can perform, and setting session and refresh token lifetimes.
Monitor API activity by application. Large exports, unusual query patterns and access from unfamiliar infrastructure are detectable in platform event logs, where those logs are licensed and retained. Confirm you have them and that someone is looking.
Search your SaaS data for secrets. If credentials were pasted into support cases or notes, assume they could be exposed one day. Search for them, rotate anything you find, and give people a better place to share secrets.
A vendor question worth adding
This incident adds a question to vendor reviews for any product that integrates with your core SaaS platforms: how do you store and protect the OAuth tokens you hold for our tenants, and how quickly could you revoke them if your environment were compromised? Salesloft’s later reporting traced the intrusion back to unauthorized access to its source code environment months earlier. Integration vendors are high-value targets precisely because they hold keys to many customers at once.
Where the perimeter actually is
For most organizations, the data that matters lives in a few SaaS platforms, and those platforms are connected to dozens of other services. Identity programs have focused, rightly, on the people who log in. The applications that connect on their behalf need the same attention: an inventory, an owner, the least access that works, and monitoring that would notice if one of them started behaving differently.