3 ms·

The complaint is about documents exported from Google Docs.

by nemetroid 3y ago

londons_explore 3y ago
But thats still a malware vector right?, especially if you can get the victim to export it themselves?
- deleted 3y ago
  [deleted]
- wslh 3y ago
  The malware vector still exists because you can just edit the file exported and change the links... bad actors laugh out loud at these issues.
  - ceejayoz 3y ago
    The person doing the export isn't necessarily the bad actor.
    - wslh 3y ago
      That's for sure, but what attack vectors do you imagine? If the bad actor, for example, is the owner of the document it can easily put a link to a malware that Google will not detect.
- negus 3y ago
  It is not. There is no sense at all: you could use manually crafted HTML page with malicious links, there is no benefit in using Google Docs export for this.
  - judge2020 3y ago
    The benefit is as OP said: it bypasses corporate firewalls because it's a google doc. Although I can only reproduce this redirect page in a published doc page[0], not in a pdf export (unless there's another way to download pdf via url trickery) 0: https://docs.google.com/document/d/e/2PACX-1vR4O-8LwvUPNOcwH55jmSWk32fQqV4z2u-3GvFzcaZO-HYY5PlEfMp_tHWdl9y-HKaunyxKUI3nZAe-/pub https://docs.google.com/document/d/e/2PACX-1vR4O-8LwvUPNOcwH...
    - crtasm 3y ago
      A HTML file exported from google docs is not a google doc and I don't see how or why a firewall would see it as one? The URL to download the export can't be shared as far as I can tell. edit: you can reuse the URL to download the export. tested on another network. it expires fairly quickly though, within a couple minutes it seems.
      - darkwater 3y ago
        > edit: you can reuse the URL to download the export. tested on another network. it expires fairly quickly though, within a couple minutes it seems. (thanks for the test) So it's clearly not a possible real vector, and actually they thought about it being a possible vector, otherwise they would not have put the expiration.
    - afandian 3y ago
      I could reproduce on HTML ZIP export but not PDF.
- cosmojg 3y ago
  Oh, you're right! And by that logic, Hacker News is a malware vector, too, with all these random links hanging around. Maybe we should petition the moderators to integrate Google's tracking links here as well!
- cryptonector 3y ago
  You can write HTML (or Word, or whatever) yourself w/o Google's help. This "feature" isn't going to stop malware links on exported google docs.
Chabsff 3y ago
Expecting an exported document to behave as close as possible as the hosted version is not exactly unreasonable in general.
- bobbylarrybobby 3y ago
  When I paste a link in Google Docs, the UI tells me that it's preserving the link I pasted. Now, if it converted http://example.com http://example.com to a google redirect link in the doc, then I probably would not be surprised to see it show up the same way in my export.

The complaint is about documents exported from Google Docs.

londons_explore 3y ago

But thats still a malware vector right?, especially if you can get the victim to export it themselves?

deleted 3y ago
[deleted]
wslh 3y ago
The malware vector still exists because you can just edit the file exported and change the links... bad actors laugh out loud at these issues.
- ceejayoz 3y ago
  The person doing the export isn't necessarily the bad actor.
  - wslh 3y ago
    That's for sure, but what attack vectors do you imagine? If the bad actor, for example, is the owner of the document it can easily put a link to a malware that Google will not detect.
negus 3y ago
It is not. There is no sense at all: you could use manually crafted HTML page with malicious links, there is no benefit in using Google Docs export for this.
- judge2020 3y ago
  The benefit is as OP said: it bypasses corporate firewalls because it's a google doc. Although I can only reproduce this redirect page in a published doc page[0], not in a pdf export (unless there's another way to download pdf via url trickery) 0: https://docs.google.com/document/d/e/2PACX-1vR4O-8LwvUPNOcwH55jmSWk32fQqV4z2u-3GvFzcaZO-HYY5PlEfMp_tHWdl9y-HKaunyxKUI3nZAe-/pub https://docs.google.com/document/d/e/2PACX-1vR4O-8LwvUPNOcwH...
  - crtasm 3y ago
    A HTML file exported from google docs is not a google doc and I don't see how or why a firewall would see it as one? The URL to download the export can't be shared as far as I can tell. edit: you can reuse the URL to download the export. tested on another network. it expires fairly quickly though, within a couple minutes it seems.
    - darkwater 3y ago
      > edit: you can reuse the URL to download the export. tested on another network. it expires fairly quickly though, within a couple minutes it seems. (thanks for the test) So it's clearly not a possible real vector, and actually they thought about it being a possible vector, otherwise they would not have put the expiration.
  - afandian 3y ago
    I could reproduce on HTML ZIP export but not PDF.
cosmojg 3y ago
Oh, you're right! And by that logic, Hacker News is a malware vector, too, with all these random links hanging around. Maybe we should petition the moderators to integrate Google's tracking links here as well!
cryptonector 3y ago
You can write HTML (or Word, or whatever) yourself w/o Google's help. This "feature" isn't going to stop malware links on exported google docs.

Chabsff 3y ago

Expecting an exported document to behave as close as possible as the hosted version is not exactly unreasonable in general.

bobbylarrybobby 3y ago
When I paste a link in Google Docs, the UI tells me that it's preserving the link I pasted. Now, if it converted http://example.com http://example.com to a google redirect link in the doc, then I probably would not be surprised to see it show up the same way in my export.