New Google Cloud API Vulnerability Could Cost Businesses Big and Expose Data

Cybersecurity researchers have uncovered a serious security flaw that affects Google Cloud API keys. This vulnerability could allow attackers to access sensitive data through Gemini interfaces if a specific programming interface is enabled. According to The Hacker News, these keys, originally meant to identify projects for billing purposes, could now become a way for unauthorized parties to access private content and data without the owners' knowledge. Research findings show that around 2,863 API keys are currently exposed online, embedded within the code of websites offering various services, like Google Maps. If the Gemini API is active, anyone with these exposed keys could view uploaded files and cached data. They could also consume the project's AI resources, potentially leading to significant financial costs for the account owner, who would be completely unaware. The researchers noted that some new keys are created with "unrestricted" permissions by default. This means they can access all active programming interfaces within a project, including Gemini, even if they weren't specifically intended for that. This significantly increases the risk, making these keys easy targets for hackers to exploit. To illustrate the scale of the problem, one user on Reddit shared that they incurred over $82,000 in charges in just two days due to a stolen API key, while their usual monthly spending was around $180. This highlights the severe financial risk that this vulnerability poses. Cybersecurity experts emphasize that companies and developers must review all active API keys, especially those linked to AI services. They should replace any old keys that might have been publicly exposed and monitor for any unusual activity to prevent financial exploitation and the leakage of sensitive data. Specialists pointed out that the continuous expansion of API capabilities and their access to larger amounts of data increases the overall risk. This makes protecting digital keys a fundamental step, no longer just a traditional technical measure, but a necessity to avoid financial losses and the leakage of critical information that could threaten both companies and users.