SoylentNews is people
SoylentNews
The Hacker News is reporting an exploitable feature of Google Drive could allow an attacker to replace legitimate files with files of their choosing.
An unpatched security weakness in Google Drive could be exploited by malware attackers to distribute malicious files disguised as legitimate documents or images, enabling bad actors to perform spear-phishing attacks comparatively with a high success rate.
The latest security issue—of which Google is aware but, unfortunately, left unpatched—resides in the "manage versions" functionality offered by Google Drive that allows users to upload and manage different versions of a file, as well as in the way its interface provides a new version of the files to the users.
Logically, the manage versions functionally should allow Google Drive users to update an older version of a file with a new version having the same file extension, but it turns out that it's not the case.
According to A. Nikoci, a system administrator by profession who reported the flaw to Google and later disclosed it to The Hacker News, the affected functionally allows users to upload a new version with any file extension for any existing file on the cloud storage, even with a malicious executable.
As shown in the demo videos—which Nikoci shared exclusively with The Hacker News—in doing so, a legitimate version of the file that's already been shared among a group of users can be replaced by a malicious file, which when previewed online doesn't indicate newly made changes or raise any alarm, but when downloaded can be employed to infect targeted systems.
"Google lets you change the file version without checking if it's the same type," Nikoci said. "They did not even force the same extension."
(Score: 1, Interesting) by Anonymous Coward on Tuesday August 25 2020, @02:14PM (1 child)
> Logically, the manage versions functionally should allow Google Drive users to update an older version of a file with a new version having [exactly] the same file extension...
Is it illogical to change a file's extension? Consider a document we've been working with for years saved in an old .doc format and we want to upvert it to a more current .docx (or, even better, .odt). I would say that changing the extension is the logical course. The other option would be upload as a new file and break the versioning chain: would that not be illogical since the entire point of versioning is to maintain that chain?
(Score: 2) by Booga1 on Tuesday August 25 2020, @06:03PM
In the same vein of thought, there's no inconsistency if you replace a file's contents entirely. So what if the doc you're writing is completely rewritten? If that's the next revision, so be it.
I suspect there will not be a patch for this because it's working as intended.
If people expected a file that was once "safe" to always be safe, well that's never been how things have worked. Any old Word doc or Excel file could be infected at any point. That's why we have antivirus programs.
The only real difference in this exploit is a bypass of the initial distrust we give a file. When the graphics design department updates a file and marketing goes to use it, they'll have to treat it the same as a random file from the internet. It kinda sucks to have to do it that way, but it's the most sensible. We all know "the cloud" is just "someone else's computer."