Skip to content

Google Chat Webhook

Service Name: Google Chat

Service Description: Google Chat is a communication platform developed by Google as part of Google Workspace. It provides direct messaging, group conversations, and integrations with other Google Workspace applications, allowing teams to collaborate efficiently.

Service Address: https://chat.google.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the Google Workspace organization level through context-aware access rules.

Secret Access Scope: Grants the ability to post messages to a specific Google Chat space or room via webhook integration.

Secret Revokement URL: https://chat.google.com/ (Navigate to the space settings to manage webhooks)

Secret Example: https://chat.googleapis.com/v1/spaces/AAAABBBCCC/messages?key=AIzaSyDdI0hCZtE6vySjMm-WEfRq3CPzqKqqsHI&token=ABCDEF123456

Suspicious Activity Investigation Instructions:

  • Review Google Workspace audit logs for webhook creation or modification events.
  • Check the Google Chat space for unexpected or unauthorized messages.
  • Examine the content and frequency of messages sent through the webhook.
  • Verify if the webhook is being used from unexpected IP addresses or locations.
  • Review Google Workspace admin console for any suspicious activity related to Chat settings.

Mitigation Instructions:

  • Delete the compromised webhook in the Google Chat space settings.
  • Create a new webhook with a different URL if the integration is still needed.
  • Review and update access permissions for the Google Chat space.
  • Enable additional security controls like context-aware access if available.
  • Consider implementing approval workflows for webhook creation in your organization.
  • Update your Google Workspace security settings to monitor webhook activities.
  • Educate users about the proper handling of webhook URLs and the risks of exposing them.