Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Tuesday August 25 2020, @01:04PM   Printer-friendly
from the a-file-by-any-other-name dept.

The Hacker News is reporting an exploitable feature of Google Drive could allow an attacker to replace legitimate files with files of their choosing.

An unpatched security weakness in Google Drive could be exploited by malware attackers to distribute malicious files disguised as legitimate documents or images, enabling bad actors to perform spear-phishing attacks comparatively with a high success rate.

The latest security issue—of which Google is aware but, unfortunately, left unpatched—resides in the "manage versions" functionality offered by Google Drive that allows users to upload and manage different versions of a file, as well as in the way its interface provides a new version of the files to the users.

Logically, the manage versions functionally should allow Google Drive users to update an older version of a file with a new version having the same file extension, but it turns out that it's not the case.

According to A. Nikoci, a system administrator by profession who reported the flaw to Google and later disclosed it to The Hacker News, the affected functionally allows users to upload a new version with any file extension for any existing file on the cloud storage, even with a malicious executable.

As shown in the demo videos—which Nikoci shared exclusively with The Hacker News—in doing so, a legitimate version of the file that's already been shared among a group of users can be replaced by a malicious file, which when previewed online doesn't indicate newly made changes or raise any alarm, but when downloaded can be employed to infect targeted systems.

"Google lets you change the file version without checking if it's the same type," Nikoci said. "They did not even force the same extension."


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Informative) by rob_on_earth on Tuesday August 25 2020, @03:01PM (1 child)

    by rob_on_earth (5485) on Tuesday August 25 2020, @03:01PM (#1041629) Homepage

    They are not files and they are not in folders.

    GDrive is just a database. You can have multiple files with the same name in the same "folder" because each file is really a DB entry pointed to by a GUID. The GUI stops you having multiple files with the same name, but there is no error if you use the API.

    Folders are just files that are tagged. Again, the GUI stops you tagging files in multiple folders. The API makes you jump trough hoops to avoid it.

    Starting Score:    1  point
    Moderation   +1  
       Informative=1, Total=1
    Extra 'Informative' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   3  
  • (Score: 0) by Anonymous Coward on Tuesday August 25 2020, @06:22PM

    by Anonymous Coward on Tuesday August 25 2020, @06:22PM (#1041735)

    They are not files and they are not in folders.

    Not clear whether you're stating the obvious, in that they are not paper files in manila folders in a sheetmetal filing cabinet, or if you're asserting a bogus distinction between the databases known as filesystems and other databases.