Google Drive Found Leaking Private Data

http://collaboristablog.com/2014/07/google-drive-found-leaking-private-data-warning-shared-links/

by srikar • 12 years ago

156 72 12 years ago

eli4• 12 years ago

I'm glad Google fixed this, but if something is important you really shouldn't be securing it merely by giving it an obscure URL.

Google Drive makes it very easy to say "only these named people" should have access, or "only people who have the link AND a google account for your company"

benihana• 12 years ago

"only people who have the link AND a google account for your company"

I'm not on my work computer, but I can't remember there ever being an option for only let people with a company google account see this. If that was the case, why wouldn't that just be on by default (which I would argue is everyone's expected behavior on corporate google drive).

sharth• 12 years ago

So, if I attempt to share a document, I have these options available to me: http://imgur.com/efTUXgY

They include:

     Public on the Web
     Anyone with the link
     lynch.us
     People at lynch.us with the link
     Specific people

Additionally, if I goto https://admin.google.com/AdminHome#AppDetails:service=Drive+..., I have the abilitiy to the set the domain-wide default sharing settings. As seen here: http://imgur.com/RL0eUhZ

eli4• 12 years ago

At least for me, the default sharing option is only "specific people" named as being able to view it can view it. (Though, by default, they can also add other people.) Having the link is irrelevant.

tiglionabbit3• 12 years ago

It shows up if you are on a Google Apps account.

onion2k2• 12 years ago

That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the document, there's always the possibility that someone could accidentally send a link to the file to someone, or that someone could shoulder surf it, or even guess it is if it's simple enough.

travisp• 12 years ago

I don't know if that's quite fair. Infeasible to guess urls do have a level of security that's significantly higher than implied by "Remove privacy settings - allow anyone to download".

Yes, someone could shoulder surf it, but we don't tell you that your bank account has no security because someone could shoulder surf you entering your password.

onion2k2• 12 years ago

My bank account has 2 factor authentication for that very reason.

msh• 12 years ago

there's always the possibility that someone could accidentally send a link to the file to someone

I think that would be implied when the setting says anyone with the link.

It would be the same if I attached the document to a email, someone could still forward the email.

Pxtl• 12 years ago

Yes, but it's reasonable to assume that if I keep a URL secret and it's a very long and complex URL, that nobody will be able to guess it and find the document.

I mean after all, we assume that's true for passwords.

freehunter• 12 years ago

But we're more accepting of someone crawling our site trying random URLs than we are of people trying hundreds of passwords.

fixermark4• 12 years ago

I've always thought of 'Anyone with the link' as functionally equivalent to 'Anyone.' I will continue to think so after this referrer-header change.

The first time you email that link out, you have technologically released your ability to predict who will view the document (was the e-mail sent over secure channels end-to-end? Did it go to a trusted party who won't reshare it? Did you typo the e-mail address and send it to an undesired party? Did a recipient print it out and leave a printed copy lying around in an accessible conference room? Was the printout shredded after use? Was the shredding functionally irreversible? Is the shredding being done by a third-party that might lose some loads of documents on the way to the shred facility? Did you leave the link in your local machine's pastebuffer then walk away without locking your terminal? Etc., etc., etc.).

Even when the link is functionally unguessable, allowing non-authenticated access is just "security through obscurity."

timothya4• 12 years ago

It provides as much security as you have trust in the people you share it with. If I set one of my documents to "anyone with the link" just so that I can access it when I'm not logged in, and I'm careful to not share the link with anyone else, then I'd argue that it's still provides some security because I trust myself.

If I shared a document with only you (directly, not using the "anyone with the link" permission), I couldn't stop you from taking a screenshot and sending that to whomever you pleased (or printing them out and leaving them in a conference room, like you suggested). Sharing documents online in general can be troubling if you don't trust the people you send them to. It's easier to share a link than share a screenshot, though, and a link would provide continued access going forward, and could remove deniability that the screenshot was faked.

wutbrodo• 12 years ago

Seriously, I'm not surprised that the average user might not grasp this concept (which is why it's good that Google dealt with this referrer issue), but it's bizarre that so many people on this thread don't. When it comes to pictures etc, it's generally prudent to assume "If you post it on Facebook, it's effectively public"; if anything this is even more true for the "anyone with the link" sharing setting.

lazersharks292• 12 years ago

"The security hole, which has now been patched by Google"

This has only been fixed for new links. All existing links are still vulnerable.

From Google's Blog:

"Today’s update to Drive takes extra precaution by ensuring that newly shared documents with hyperlinks to third-party HTTPS websites will not inadvertently relay the original document’s URL."

timothya4• 12 years ago

To clarify, I think what they mean is that it's possible that those old links have already been compromised, even though none of the documents (new or old) are vulnerable anymore.

The bug has been patched so that any document with the "anyone with the link" permission will no longer leak its location in the referrer when someone clicks an HTTPS link in it. But it's possible that that happened in the past and the link was already leaked (and unfortunately, they can't exactly fix that). So if you have an old document, it's not vulnerable anymore, but it may at one time have been vulnerable so you might want to update it to have a new link (following the instructions in the Google blog post).

lazersharks292• 12 years ago

That's still pretty bad, there could be millions of leaked document URL's in the logs of severs all over the internet and users haven't been notified.

It looks like Microsoft Onedrive did a similar thing too:

https://blog.onedrive.com/update-for-shared-links/ >"We chose not to disable all previously shared links, because the change only applies to a small fraction of shared files. If customers disable and then re-share a document, this will prevent further access to a document that might have been accessed."

f-• 12 years ago

I helped draft the original blog post :-) To clarify a bit more and help folks evaluate their individual risk, it's worth noting that the impact is limited to a fairly specific scenario.

In essence, you needed to have a non-native document format uploaded to Drive without converting it (PDF is a good example); explicitly share this document with others using a particular setting ("anyone with the link"); and then preview it in the web UI and follow an outgoing HTTPS link (HTTP wouldn't be a problem).

Zigurd• 12 years ago

Google is correct to say this is a relatively obscure issue, and a relatively small increment in loss of security. Who would consider sharing a Drive link to be "secure" by any definition of the word? It can leak all over the place by numerous means. For starters, and email recipient of the link might be using an unencrypted connection for downloading the link over wifi.

nly• 12 years ago

HTTP referers are evil. I've been using RefControl[0] to block 3rd party referers for years now.

[0] http://www.stardrifter.org/refcontrol/

The web wasn't built with privacy in mind. 3rd party cookies and HTTP Referers are just the low hanging fruit.

eli4• 12 years ago

Becomes less and less of an issue as sites switch to HTTPS though, right?

andreyf• 12 years ago

Referrers are still sent if you're clicking an https link on an https site, iirc.

unreal372• 12 years ago

This "vulnerability" only affected HTTPS links, the article said.

grannyg00se3• 12 years ago

Why do you consider them evil? It's useful for a destination server to be given insight into the previous url and it doesn't expose any private information.

I suppose one might consider their previous url private information, but if that's the case you've go a lot more to worry about than http referers.

Dylan168074• 12 years ago

More to worry about, such as?

URLs aren't protected any less than cookies are, and cookies are the standard way of securing login tokens.

Heck with URLs you get the 'secure flag' cookie option for free!

hnha• 12 years ago

It's a violation of browsing privacy. It's noone's business how or why I arrived at a webpage.

tiglionabbit3• 12 years ago

Perhaps this is a good reason to make referers subject to the same origin policy?

sp3324• 12 years ago

How does the fix work? Does it prevent the browser from sending the referrer URL? Or maybe load all documents from the same URL with the document ID in a POST request instead or GET?

aiiane• 12 years ago

Normally most outgoing links that are meant to be private are bounced through a redirection that results in the referrer being a generic Google redirection page. That's probably the solution that was applied here.

sp3324• 12 years ago

But it says this was only a problem for documents that were not converted to Google Sheets etc. I don't think editing everyone's PDFs and every other kind of document that has clickable URLs is the easiest way to solve this.

msutherl• 12 years ago

Thousands of people working in enterprise are being banned from using Google Drive right now.

rishabhsagar• 12 years ago

I didn't think "Anyone with link..." setting promised any kind of security. Honestly, I don't think this was a 'security hole', more like a digital equivalent of a home owner hiding house keys under the carpet, hoping no one will look.

bradleybuda• 12 years ago

That's not the issue. Let's say Alice shares a link to a Drive doc with Bob, https://drive/secretlink. If that document has an embedded link to Eve's website, http://some/thirdparty, and Bob clicks the link, then Eve (as the administrator of the third-party site) will see the HTTP Referer as https://drive/secretlink, and she will be able to access Alice's document.

fixermark4• 12 years ago

Correct, which violates least surprise and is almost certainly not intended behavior.

However, the meta-point rishabhsagar touches on is that with an authentication-free access model, this is but one of possibly many potential failure modes. The risk surface is undefined size, but probably larger than your IT professionals are comfortable with.

macwarlock• 12 years ago

I think rishabhsagar's metaphor of security through obscurity is indeed the issue. If the secretlink protected only by the difficulty in guessing the URL, and not an additional layer authentication for the person you are sharing it with, then it amounts to hiding something (a key) in plain sight and hoping for the best. Granted, I'm unsure if Google has a mechanism to throttle/block attempts at guessing Drive URLs.

wfjackson• 12 years ago

Regardless of this particular issue, it's ironic that people think their Google docs are private.

Doesn't Google already have the right to parse your documents in Drive to show you ads?

They just recently pledged to stop parsing the paid Google Apps for Business emails to build ad preferences to show on other Google properties like YouTube.

I wonder if they're already scanning documents, and if we'd even know unless they were forced to stop making misleading statements acknowledge it in a court case like in the lawsuit over ad profiling students email in Google Apps for Education.

Not to mention that Schidmt or Nadella could have read your email or seen your company docs this morning and traded stocks based on them and Google/Microsoft are not even legally obliged to inform you that it happened.

ntakasaki• 12 years ago

This incident comes to mind.

http://gawker.com/5637234/gcreep-google-engineer-stalked-tee...

Hope they have better controls now so that snooping on your data is not so easy for a Google employee now. But they're under no legal obligation since you sign away your rights when you upload data to their server. No one in that case would have a legitimate case against Google in court.

Dylan168074• 12 years ago

If you had 2^64 carpets then the key would be pretty safe.

gumby• 12 years ago

I didn't think "Anyone with link..." setting promised any kind of security

I think it is reasonable for someone to assume it is a capability, and to be surprised by the cascading vulnerability.

tanglesome• 12 years ago

This is news? Come on! You give anyone a link to your data and you expect security! Hello! If I gave folk a key to my house I doubt I'll have any my A/V equipment or computers when I come back after a long weekend. Why should I expect my data to be any safer!?

coldtea• 12 years ago

This is news? Come on! You give anyone a link to your data and you expect security!

Yes. I expect security from my bank, from my insurance company, from state agencies, from my email provider, etc. I surely don't expect them to leak my data, and if they do, cause of a bug or incompetence, I want them to fix it.

And I want to be informed when they have breaches or fail to secure my data.

Hello! If I gave folk a key to my house I doubt I'll have any my A/V equipment or computers when I come back after a long weekend.

People hire babysitters, cleaning stuff etc, give them the key to their house, and expect to have their A/V equipment when the come back.

If a cleaning person is reckless, and e.g leaves the door unlocked when he leaves, or a babysitter brings her pals over and have a party with my stuff, they get fired and/or sued, and people hire a more trusty person. Businesses that want to keep our private data should be kept to the same, or actually much higher, standards.

The "helloooo, is this news, of course it's unsafe, whaddaya expected" etc attitude doesn't help raise the bar on data safety.

jpetersonmn• 12 years ago

The "helloooo, is this news, of course it's unsafe, whaddaya expected" etc attitude doesn't help raise the bar on data safety.

I would think just the opposite is true. Perpetuating the idea that "Anyone with a link" means anything other than "Anyone" doesn't help raise the bar on data safety.

I'm glad Google made the enhancement to this, but wouldn't classify it as a security issue.

burstworks• 12 years ago

Maybe I'm misunderstanding, but if the document in Google Drive is served over HTTPS, then the referrer when a user visits a linked site should only show the hostname (ie drive.google.com) not the full URL, right?

meritt• 12 years ago

https://www.facebook.com/notes/facebook-engineering/protecti...

Facebook Engineering's entry on various methods of hiding referrers. This was 4 years ago, so some of these techniques might not still work.

retroencabulato• 12 years ago

Wow, don't read the comments on that blog.

Synergyse• 12 years ago

Anyone with the link could also share the link publicly. I think if your document contains sensitive information you should be restricting the access anyway.

jflowers45• 12 years ago

I've always wondered what percentage of people understood what "anyone with the link" meant as a security setting.

logn• 12 years ago

I think the referrer info itself is a security hole. Browsers should disable it. Or, you can use a plugin for now.

me_myself_and_I• 12 years ago

How is this different than DropBox? Maybe dropbox is more obscure and google more open, hence finding this vulnerability is actually a good thing. Just thinking aloud.

pacaro• 12 years ago

Dropbox posted a blog article about their approach to this issue in May — https://blog.dropbox.com/2014/05/web-vulnerability-affecting...

Disclaimer: I work for Dropbox

Google Drive Found Leaking Private Data

Related Stories