8 ms·

Google Drive Found Leaking Private Data

156 points by srikar 12y ago

msutherl 12y ago
Thousands of people working in enterprise are being banned from using Google Drive right now.
eli 12y ago
I'm glad Google fixed this, but if something is important you really shouldn't be securing it merely by giving it an obscure URL. Google Drive makes it very easy to say "only these named people" should have access, or "only people who have the link AND a google account for your company"
- benihana 12y ago
  >"only people who have the link AND a google account for your company" I'm not on my work computer, but I can't remember there ever being an option for only let people with a company google account see this. If that was the case, why wouldn't that just be on by default (which I would argue is everyone's expected behavior on corporate google drive).
  - sharth 12y ago
    So, if I attempt to share a document, I have these options available to me: http://imgur.com/efTUXgY http://imgur.com/efTUXgY They include: Public on the Web Anyone with the link lynch.us People at lynch.us with the link Specific people Additionally, if I goto https://admin.google.com/AdminHome#AppDetails:service=Drive+and+Docs&flyout=sharing https://admin.google.com/AdminHome#AppDetails:service=Drive+..., I have the abilitiy to the set the domain-wide default sharing settings. As seen here: http://imgur.com/RL0eUhZ http://imgur.com/RL0eUhZ
  - eli 12y ago
    At least for me, the default sharing option is only "specific people" named as being able to view it can view it. (Though, by default, they can also add other people.) Having the link is irrelevant.
  - tiglionabbit 12y ago
    It shows up if you are on a Google Apps account.
onion2k 12y ago
That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the document, there's always the possibility that someone could accidentally send a link to the file to someone, or that someone could shoulder surf it, or even guess it is if it's simple enough.
- travisp 12y ago
  I don't know if that's quite fair. Infeasible to guess urls do have a level of security that's significantly higher than implied by "Remove privacy settings - allow anyone to download". Yes, someone could shoulder surf it, but we don't tell you that your bank account has no security because someone could shoulder surf you entering your password.
  - onion2k 12y ago
    My bank account has 2 factor authentication for that very reason.
    - sp332 12y ago
      If I know your bank's routing number (not a secret) and your account number, I can create a demand draft to take money out of your account. https://en.wikipedia.org/wiki/Demand_draft https://en.wikipedia.org/wiki/Demand_draft
      - ak217 12y ago
        What does that have to do with anything? If you issue fraudulent demand drafts, the bank will trace the destination account and send lawyers after you. If you trace referrers and open the origin URL, it's doubtful whether anyone will trace it or have legal recourse against you.
lazersharks29 12y ago
> "The security hole, which has now been patched by Google" This has only been fixed for new links. All existing links are still vulnerable. From Google's Blog: >"Today’s update to Drive takes extra precaution by ensuring that newly shared documents with hyperlinks to third-party HTTPS websites will not inadvertently relay the original document’s URL."
- timothya 12y ago
  To clarify, I think what they mean is that it's possible that those old links have already been compromised, even though none of the documents (new or old) are vulnerable anymore. The bug has been patched so that any document with the "anyone with the link" permission will no longer leak its location in the referrer when someone clicks an HTTPS link in it. But it's possible that that happened in the past and the link was already leaked (and unfortunately, they can't exactly fix that). So if you have an old document, it's not vulnerable anymore, but it may at one time have been vulnerable so you might want to update it to have a new link (following the instructions in the Google blog post).
  - lazersharks29 12y ago
    That's still pretty bad, there could be millions of leaked document URL's in the logs of severs all over the internet and users haven't been notified. It looks like Microsoft Onedrive did a similar thing too: https://blog.onedrive.com/update-for-shared-links/ https://blog.onedrive.com/update-for-shared-links/ >"We chose not to disable all previously shared links, because the change only applies to a small fraction of shared files. If customers disable and then re-share a document, this will prevent further access to a document that might have been accessed."
    - unreal37 12y ago
      Highly doubt it's millions. You have to upload a non-native format into Drive, modify the default security settings, and be linking to another HTTPS site and someone has to follow that link. AND the information in the original document has to be sensitive. The odds of that are very, very low.
Zigurd 12y ago
Google is correct to say this is a relatively obscure issue, and a relatively small increment in loss of security. Who would consider sharing a Drive link to be "secure" by any definition of the word? It can leak all over the place by numerous means. For starters, and email recipient of the link might be using an unencrypted connection for downloading the link over wifi.
nly 12y ago
HTTP referers are evil. I've been using RefControl[0] to block 3rd party referers for years now. [0] http://www.stardrifter.org/refcontrol/ http://www.stardrifter.org/refcontrol/ The web wasn't built with privacy in mind. 3rd party cookies and HTTP Referers are just the low hanging fruit.
- eli 12y ago
  Becomes less and less of an issue as sites switch to HTTPS though, right?
  - andreyf 12y ago
    Referrers are still sent if you're clicking an https link on an https site, iirc.
    - esrauch 12y ago
      This never made sense to me, why was this behavior defined this way and why has no browser challenged it? A more rational rule would be something like "only send header if the referer url is http, or if the referer and destination have exact match hosts"
      - nucleardog 12y ago
        Because the spec and implementations came along well before we started putting HTTPS on everything, or even most/many things. Given the number of HTTPS->HTTPS links you would have run across in regular practice the spec and your proposal were probably more or less identical in practice. As for why it's still that way... I'm sure no one has bothered to really think about it since.
    - jimktrains2 12y ago
      Yes > Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol. https://tools.ietf.org/html/rfc2616#section-15.1.3 https://tools.ietf.org/html/rfc2616#section-15.1.3
sp332 12y ago
How does the fix work? Does it prevent the browser from sending the referrer URL? Or maybe load all documents from the same URL with the document ID in a POST request instead or GET?
- aiiane 12y ago
  Normally most outgoing links that are meant to be private are bounced through a redirection that results in the referrer being a generic Google redirection page. That's probably the solution that was applied here.
  - sp332 12y ago
    But it says this was only a problem for documents that were not converted to Google Sheets etc. I don't think editing everyone's PDFs and every other kind of document that has clickable URLs is the easiest way to solve this.
    - dlgeek 12y ago
      Looks like it only applies to a "Preview" feature, so I imagine they're already parsing the contents to render the preview and are either adding a redirect or a no-follow attribute. Native-native docs wouldn't have a referrer because they wouldn't be rendered by the browser, so links would be a direct hop.
rishabhsagar 12y ago
I didn't think "Anyone with link..." setting promised any kind of security. Honestly, I don't think this was a 'security hole', more like a digital equivalent of a home owner hiding house keys under the carpet, hoping no one will look.
- bradleybuda 12y ago
  That's not the issue. Let's say Alice shares a link to a Drive doc with Bob, https://drive/secretlink https://drive/secretlink. If that document has an embedded link to Eve's website, http://some/thirdparty http://some/thirdparty, and Bob clicks the link, then Eve (as the administrator of the third-party site) will see the HTTP Referer as https://drive/secretlink https://drive/secretlink, and she will be able to access Alice's document.
  - fixermark 12y ago
    Correct, which violates least surprise and is almost certainly not intended behavior. However, the meta-point rishabhsagar touches on is that with an authentication-free access model, this is but one of possibly many potential failure modes. The risk surface is undefined size, but probably larger than your IT professionals are comfortable with.
    - jimktrains2 12y ago
      I guess it depends on what you're expecting. I expect Refer headers to be sent when I click a link or load a resource (ssl restrictions withstanding https://tools.ietf.org/html/rfc2616#section-15.1.3 https://tools.ietf.org/html/rfc2616#section-15.1.3).
  - macwarlock 12y ago
    I think rishabhsagar's metaphor of security through obscurity is indeed the issue. If the secretlink protected only by the difficulty in guessing the URL, and not an additional layer authentication for the person you are sharing it with, then it amounts to hiding something (a key) in plain sight and hoping for the best. Granted, I'm unsure if Google has a mechanism to throttle/block attempts at guessing Drive URLs.
deleted 12y ago
[deleted]
- unreal37 12y ago
  Did you read the article?
tanglesome 12y ago
This is news? Come on! You give anyone a link to your data and you expect security! Hello! If I gave folk a key to my house I doubt I'll have any my A/V equipment or computers when I come back after a long weekend. Why should I expect my data to be any safer!?
- coldtea 12y ago
  >This is news? Come on! You give anyone a link to your data and you expect security! Yes. I expect security from my bank, from my insurance company, from state agencies, from my email provider, etc. I surely don't expect them to leak my data, and if they do, cause of a bug or incompetence, I want them to fix it. And I want to be informed when they have breaches or fail to secure my data. >Hello! If I gave folk a key to my house I doubt I'll have any my A/V equipment or computers when I come back after a long weekend. People hire babysitters, cleaning stuff etc, give them the key to their house, and expect to have their A/V equipment when the come back. If a cleaning person is reckless, and e.g leaves the door unlocked when he leaves, or a babysitter brings her pals over and have a party with my stuff, they get fired and/or sued, and people hire a more trusty person. Businesses that want to keep our private data should be kept to the same, or actually much higher, standards. The "helloooo, is this news, of course it's unsafe, whaddaya expected" etc attitude doesn't help raise the bar on data safety.
  - jpetersonmn 12y ago
    > The "helloooo, is this news, of course it's unsafe, whaddaya expected" etc attitude doesn't help raise the bar on data safety. I would think just the opposite is true. Perpetuating the idea that "Anyone with a link" means anything other than "Anyone" doesn't help raise the bar on data safety. I'm glad Google made the enhancement to this, but wouldn't classify it as a security issue.
burstworks 12y ago
Maybe I'm misunderstanding, but if the document in Google Drive is served over HTTPS, then the referrer when a user visits a linked site should only show the hostname (ie drive.google.com) not the full URL, right?
- deleted 12y ago
  [deleted]
meritt 12y ago
https://www.facebook.com/notes/facebook-engineering/protecting-privacy-with-referrers/392382738919 https://www.facebook.com/notes/facebook-engineering/protecti... Facebook Engineering's entry on various methods of hiding referrers. This was 4 years ago, so some of these techniques might not still work.
- retroencabulato 12y ago
  Wow, don't read the comments on that blog.
Synergyse 12y ago
Anyone with the link could also share the link publicly. I think if your document contains sensitive information you should be restricting the access anyway.
jflowers45 12y ago
I've always wondered what percentage of people understood what "anyone with the link" meant as a security setting.
logn 12y ago
I think the referrer info itself is a security hole. Browsers should disable it. Or, you can use a plugin for now.
me_myself_and_I 12y ago
How is this different than DropBox? Maybe dropbox is more obscure and google more open, hence finding this vulnerability is actually a good thing. Just thinking aloud.
- pacaro 12y ago
  Dropbox posted a blog article about their approach to this issue in May — https://blog.dropbox.com/2014/05/web-vulnerability-affecting-shared-links/ https://blog.dropbox.com/2014/05/web-vulnerability-affecting... Disclaimer: I work for Dropbox

156 points by srikar 12y ago

Thousands of people working in enterprise are being banned from using Google Drive right now.

eli 12y ago

I'm glad Google fixed this, but if something is important you really shouldn't be securing it merely by giving it an obscure URL. Google Drive makes it very easy to say "only these named people" should have access, or "only people who have the link AND a google account for your company"

benihana 12y ago
>"only people who have the link AND a google account for your company" I'm not on my work computer, but I can't remember there ever being an option for only let people with a company google account see this. If that was the case, why wouldn't that just be on by default (which I would argue is everyone's expected behavior on corporate google drive).
- sharth 12y ago
  So, if I attempt to share a document, I have these options available to me: http://imgur.com/efTUXgY http://imgur.com/efTUXgY They include: Public on the Web Anyone with the link lynch.us People at lynch.us with the link Specific people Additionally, if I goto https://admin.google.com/AdminHome#AppDetails:service=Drive+and+Docs&flyout=sharing https://admin.google.com/AdminHome#AppDetails:service=Drive+..., I have the abilitiy to the set the domain-wide default sharing settings. As seen here: http://imgur.com/RL0eUhZ http://imgur.com/RL0eUhZ
- eli 12y ago
  At least for me, the default sharing option is only "specific people" named as being able to view it can view it. (Though, by default, they can also add other people.) Having the link is irrelevant.
- tiglionabbit 12y ago
  It shows up if you are on a Google Apps account.

onion2k 12y ago

That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the document, there's always the possibility that someone could accidentally send a link to the file to someone, or that someone could shoulder surf it, or even guess it is if it's simple enough.

travisp 12y ago
I don't know if that's quite fair. Infeasible to guess urls do have a level of security that's significantly higher than implied by "Remove privacy settings - allow anyone to download". Yes, someone could shoulder surf it, but we don't tell you that your bank account has no security because someone could shoulder surf you entering your password.
- onion2k 12y ago
  My bank account has 2 factor authentication for that very reason.
  - sp332 12y ago
    If I know your bank's routing number (not a secret) and your account number, I can create a demand draft to take money out of your account. https://en.wikipedia.org/wiki/Demand_draft https://en.wikipedia.org/wiki/Demand_draft
    - ak217 12y ago
      What does that have to do with anything? If you issue fraudulent demand drafts, the bank will trace the destination account and send lawyers after you. If you trace referrers and open the origin URL, it's doubtful whether anyone will trace it or have legal recourse against you.

lazersharks29 12y ago

> "The security hole, which has now been patched by Google" This has only been fixed for new links. All existing links are still vulnerable. From Google's Blog: >"Today’s update to Drive takes extra precaution by ensuring that newly shared documents with hyperlinks to third-party HTTPS websites will not inadvertently relay the original document’s URL."

timothya 12y ago
To clarify, I think what they mean is that it's possible that those old links have already been compromised, even though none of the documents (new or old) are vulnerable anymore. The bug has been patched so that any document with the "anyone with the link" permission will no longer leak its location in the referrer when someone clicks an HTTPS link in it. But it's possible that that happened in the past and the link was already leaked (and unfortunately, they can't exactly fix that). So if you have an old document, it's not vulnerable anymore, but it may at one time have been vulnerable so you might want to update it to have a new link (following the instructions in the Google blog post).
- lazersharks29 12y ago
  That's still pretty bad, there could be millions of leaked document URL's in the logs of severs all over the internet and users haven't been notified. It looks like Microsoft Onedrive did a similar thing too: https://blog.onedrive.com/update-for-shared-links/ https://blog.onedrive.com/update-for-shared-links/ >"We chose not to disable all previously shared links, because the change only applies to a small fraction of shared files. If customers disable and then re-share a document, this will prevent further access to a document that might have been accessed."
  - unreal37 12y ago
    Highly doubt it's millions. You have to upload a non-native format into Drive, modify the default security settings, and be linking to another HTTPS site and someone has to follow that link. AND the information in the original document has to be sensitive. The odds of that are very, very low.

Zigurd 12y ago

Google is correct to say this is a relatively obscure issue, and a relatively small increment in loss of security. Who would consider sharing a Drive link to be "secure" by any definition of the word? It can leak all over the place by numerous means. For starters, and email recipient of the link might be using an unencrypted connection for downloading the link over wifi.

nly 12y ago

HTTP referers are evil. I've been using RefControl[0] to block 3rd party referers for years now. [0] http://www.stardrifter.org/refcontrol/ http://www.stardrifter.org/refcontrol/ The web wasn't built with privacy in mind. 3rd party cookies and HTTP Referers are just the low hanging fruit.

eli 12y ago
Becomes less and less of an issue as sites switch to HTTPS though, right?
- andreyf 12y ago
  Referrers are still sent if you're clicking an https link on an https site, iirc.
  - esrauch 12y ago
    This never made sense to me, why was this behavior defined this way and why has no browser challenged it? A more rational rule would be something like "only send header if the referer url is http, or if the referer and destination have exact match hosts"
    - nucleardog 12y ago
      Because the spec and implementations came along well before we started putting HTTPS on everything, or even most/many things. Given the number of HTTPS->HTTPS links you would have run across in regular practice the spec and your proposal were probably more or less identical in practice. As for why it's still that way... I'm sure no one has bothered to really think about it since.
  - jimktrains2 12y ago
    Yes > Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol. https://tools.ietf.org/html/rfc2616#section-15.1.3 https://tools.ietf.org/html/rfc2616#section-15.1.3

sp332 12y ago

How does the fix work? Does it prevent the browser from sending the referrer URL? Or maybe load all documents from the same URL with the document ID in a POST request instead or GET?

aiiane 12y ago
Normally most outgoing links that are meant to be private are bounced through a redirection that results in the referrer being a generic Google redirection page. That's probably the solution that was applied here.
- sp332 12y ago
  But it says this was only a problem for documents that were not converted to Google Sheets etc. I don't think editing everyone's PDFs and every other kind of document that has clickable URLs is the easiest way to solve this.
  - dlgeek 12y ago
    Looks like it only applies to a "Preview" feature, so I imagine they're already parsing the contents to render the preview and are either adding a redirect or a no-follow attribute. Native-native docs wouldn't have a referrer because they wouldn't be rendered by the browser, so links would be a direct hop.

rishabhsagar 12y ago

I didn't think "Anyone with link..." setting promised any kind of security. Honestly, I don't think this was a 'security hole', more like a digital equivalent of a home owner hiding house keys under the carpet, hoping no one will look.

bradleybuda 12y ago
That's not the issue. Let's say Alice shares a link to a Drive doc with Bob, https://drive/secretlink https://drive/secretlink. If that document has an embedded link to Eve's website, http://some/thirdparty http://some/thirdparty, and Bob clicks the link, then Eve (as the administrator of the third-party site) will see the HTTP Referer as https://drive/secretlink https://drive/secretlink, and she will be able to access Alice's document.
- fixermark 12y ago
  Correct, which violates least surprise and is almost certainly not intended behavior. However, the meta-point rishabhsagar touches on is that with an authentication-free access model, this is but one of possibly many potential failure modes. The risk surface is undefined size, but probably larger than your IT professionals are comfortable with.
  - jimktrains2 12y ago
    I guess it depends on what you're expecting. I expect Refer headers to be sent when I click a link or load a resource (ssl restrictions withstanding https://tools.ietf.org/html/rfc2616#section-15.1.3 https://tools.ietf.org/html/rfc2616#section-15.1.3).
- macwarlock 12y ago
  I think rishabhsagar's metaphor of security through obscurity is indeed the issue. If the secretlink protected only by the difficulty in guessing the URL, and not an additional layer authentication for the person you are sharing it with, then it amounts to hiding something (a key) in plain sight and hoping for the best. Granted, I'm unsure if Google has a mechanism to throttle/block attempts at guessing Drive URLs.

deleted 12y ago

[deleted]

unreal37 12y ago
Did you read the article?

tanglesome 12y ago

This is news? Come on! You give anyone a link to your data and you expect security! Hello! If I gave folk a key to my house I doubt I'll have any my A/V equipment or computers when I come back after a long weekend. Why should I expect my data to be any safer!?

coldtea 12y ago
>This is news? Come on! You give anyone a link to your data and you expect security! Yes. I expect security from my bank, from my insurance company, from state agencies, from my email provider, etc. I surely don't expect them to leak my data, and if they do, cause of a bug or incompetence, I want them to fix it. And I want to be informed when they have breaches or fail to secure my data. >Hello! If I gave folk a key to my house I doubt I'll have any my A/V equipment or computers when I come back after a long weekend. People hire babysitters, cleaning stuff etc, give them the key to their house, and expect to have their A/V equipment when the come back. If a cleaning person is reckless, and e.g leaves the door unlocked when he leaves, or a babysitter brings her pals over and have a party with my stuff, they get fired and/or sued, and people hire a more trusty person. Businesses that want to keep our private data should be kept to the same, or actually much higher, standards. The "helloooo, is this news, of course it's unsafe, whaddaya expected" etc attitude doesn't help raise the bar on data safety.
- jpetersonmn 12y ago
  > The "helloooo, is this news, of course it's unsafe, whaddaya expected" etc attitude doesn't help raise the bar on data safety. I would think just the opposite is true. Perpetuating the idea that "Anyone with a link" means anything other than "Anyone" doesn't help raise the bar on data safety. I'm glad Google made the enhancement to this, but wouldn't classify it as a security issue.

burstworks 12y ago

Maybe I'm misunderstanding, but if the document in Google Drive is served over HTTPS, then the referrer when a user visits a linked site should only show the hostname (ie drive.google.com) not the full URL, right?

deleted 12y ago
[deleted]

meritt 12y ago

https://www.facebook.com/notes/facebook-engineering/protecting-privacy-with-referrers/392382738919 https://www.facebook.com/notes/facebook-engineering/protecti... Facebook Engineering's entry on various methods of hiding referrers. This was 4 years ago, so some of these techniques might not still work.

retroencabulato 12y ago
Wow, don't read the comments on that blog.

Synergyse 12y ago

Anyone with the link could also share the link publicly. I think if your document contains sensitive information you should be restricting the access anyway.

jflowers45 12y ago

I've always wondered what percentage of people understood what "anyone with the link" meant as a security setting.

logn 12y ago

I think the referrer info itself is a security hole. Browsers should disable it. Or, you can use a plugin for now.

me_myself_and_I 12y ago

How is this different than DropBox? Maybe dropbox is more obscure and google more open, hence finding this vulnerability is actually a good thing. Just thinking aloud.

pacaro 12y ago
Dropbox posted a blog article about their approach to this issue in May — https://blog.dropbox.com/2014/05/web-vulnerability-affecting-shared-links/ https://blog.dropbox.com/2014/05/web-vulnerability-affecting... Disclaimer: I work for Dropbox