Cloud

1/4/2018
04:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Google Apps Script Vulnerability Exposes SaaS to URL-based Threats

A new means of exploiting Google Apps Script lets attackers deliver malware using URLs.

Google Apps Script is vulnerable to exploits that could allow malware to be delivered via URLs. Attackers could automatically download arbitrary malware hosted in Google Drive to a machine -- and the victim would have no idea it was happening.

Researchers at Proofpoint discovered the vulnerability earlier this year while exploring the potential for abuse of Google services. Ryan Kalember, senior vice president of cybersecurity strategy at Proofpoint, points to Carbanak's use of Google for C&C as a public example of this.

Google Apps Script is a development platform based on JavaScript that lets developers build standalone web apps and extensions for various parts of the Google Apps ecosystem. Researchers learned this platform, as well as document sharing capabilities in Google Apps, support automatic malware downloads and advanced social engineering attacks designed to manipulate victims into executing malware once it's on their machine.

"What we're seeing is [changes in] the style of attack -- normally a phishing email followed by social engineering a user to click on something," Kalember says. "Attackers are infinitely varying that."

This type of attack is different from phishing and malware distribution via links to Google Drive URLs, which are fairly common. These normally involve sending a Microsoft Office doc, which is enabled to run macros when the user gives permission.

In this case, all the activity happens in Google: a victim opens a link to edit a Google Doc and is prompted to run a Google Apps Script, which is embedded in the document. Most people say yes and deliver the malware, which can be hosted somewhere else within Google Drive, Kalember explains. It's a variation of what we see with Office macros; the Doc itself is simply a way for someone to run code when it's opened.

"It would be very, very difficult to detect anything malicious," Kalember says. "Someone could do this in a direct way: craft the URL and send the script to the victim. The Google domain is basically a trust vehicle in that case."

To explore this vulnerability, researchers began by uploading malicious files to Google Drive. Attackers could create a public link to these executables, and share an arbitrary Google Doc to use as a lure and vehicle for a Google Apps Script designed to deliver the shared malware.

"What we're seeing on the Google Docs side is these little scripts can be in the Doc itself, or they can be downloaded and the user can be socially engineered into running them," says Kalember.

The ability for attackers to use extensible SaaS platforms for delivering malware is comparatively more powerful than the ability to use Microsoft Office macros for distribution, researchers report. Companies don't have many options for defensive tools to protect against this type of threat, increasing the likelihood attackers will exploit SaaS platforms.

"This is really, really powerful stuff that Google builds from a scripting perspective, so you can do almost anything with it," says Kalember of Google Apps Scripts. Further, most of this activity bypasses traditional security defense mechanisms.

Proofpoint disclosed this vulnerability to Google in the fall of 2017; since then, the company has added restrictions on Google Apps Script events that could be exploited. It blocked installable triggers, or customizable events causing events to automatically occur. It also blocked simple triggers from presenting custom interfaces in Docs editors in other users' sessions.

These restrictions block phishing and malware delivery attempts that are triggered by opening a document, meaning exploits can no longer be leveraged for mass infections. This could have been possible before Google introduced these changes, says Kalember.

This exploit demonstrates how software-as-a-service (SaaS) applications are increasingly threatened by attackers looking for new opportunities to distribute malware and steal data.

"SaaS platforms remain something of a 'Wild West' for threat actors and defenders alike," says Maor Bin, Proofpoint's security research lead for threat systems products, in a statement. Capabilities like Google Apps Script are creating opportunities for threat actors who can leverage vulnerabilities for good or bad, using legitimate features for nefarious purposes.

Because victims in these scenarios receive legitimate links to edit Google Docs, as many people do, the same rules of email security apply. Users should also use caution when clicking links to Google Docs, unless they know or can verify the sender. Businesses using G Suite have access to tools which tell them which scripts are out there, which can help awareness.

"In the future it might be useful for Google to try and ascertain whether a script is malicious or not before allowing a user to run it, or even host it on G Suite," says Kalember. "Now, it's challenging to tell whether a script is malicious or not."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-2607
PUBLISHED: 2018-05-21
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users...
CVE-2018-1108
PUBLISHED: 2018-05-21
kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
CVE-2018-11330
PUBLISHED: 2018-05-21
An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted.
CVE-2018-11331
PUBLISHED: 2018-05-21
An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.
CVE-2018-7687
PUBLISHED: 2018-05-21
The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys.