Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

1/4/2018
04:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Google Apps Script Vulnerability Exposes SaaS to URL-based Threats

A new means of exploiting Google Apps Script lets attackers deliver malware using URLs.

Google Apps Script is vulnerable to exploits that could allow malware to be delivered via URLs. Attackers could automatically download arbitrary malware hosted in Google Drive to a machine -- and the victim would have no idea it was happening.

Researchers at Proofpoint discovered the vulnerability earlier this year while exploring the potential for abuse of Google services. Ryan Kalember, senior vice president of cybersecurity strategy at Proofpoint, points to Carbanak's use of Google for C&C as a public example of this.

Google Apps Script is a development platform based on JavaScript that lets developers build standalone web apps and extensions for various parts of the Google Apps ecosystem. Researchers learned this platform, as well as document sharing capabilities in Google Apps, support automatic malware downloads and advanced social engineering attacks designed to manipulate victims into executing malware once it's on their machine.

"What we're seeing is [changes in] the style of attack -- normally a phishing email followed by social engineering a user to click on something," Kalember says. "Attackers are infinitely varying that."

This type of attack is different from phishing and malware distribution via links to Google Drive URLs, which are fairly common. These normally involve sending a Microsoft Office doc, which is enabled to run macros when the user gives permission.

In this case, all the activity happens in Google: a victim opens a link to edit a Google Doc and is prompted to run a Google Apps Script, which is embedded in the document. Most people say yes and deliver the malware, which can be hosted somewhere else within Google Drive, Kalember explains. It's a variation of what we see with Office macros; the Doc itself is simply a way for someone to run code when it's opened.

"It would be very, very difficult to detect anything malicious," Kalember says. "Someone could do this in a direct way: craft the URL and send the script to the victim. The Google domain is basically a trust vehicle in that case."

To explore this vulnerability, researchers began by uploading malicious files to Google Drive. Attackers could create a public link to these executables, and share an arbitrary Google Doc to use as a lure and vehicle for a Google Apps Script designed to deliver the shared malware.

"What we're seeing on the Google Docs side is these little scripts can be in the Doc itself, or they can be downloaded and the user can be socially engineered into running them," says Kalember.

The ability for attackers to use extensible SaaS platforms for delivering malware is comparatively more powerful than the ability to use Microsoft Office macros for distribution, researchers report. Companies don't have many options for defensive tools to protect against this type of threat, increasing the likelihood attackers will exploit SaaS platforms.

"This is really, really powerful stuff that Google builds from a scripting perspective, so you can do almost anything with it," says Kalember of Google Apps Scripts. Further, most of this activity bypasses traditional security defense mechanisms.

Proofpoint disclosed this vulnerability to Google in the fall of 2017; since then, the company has added restrictions on Google Apps Script events that could be exploited. It blocked installable triggers, or customizable events causing events to automatically occur. It also blocked simple triggers from presenting custom interfaces in Docs editors in other users' sessions.

These restrictions block phishing and malware delivery attempts that are triggered by opening a document, meaning exploits can no longer be leveraged for mass infections. This could have been possible before Google introduced these changes, says Kalember.

This exploit demonstrates how software-as-a-service (SaaS) applications are increasingly threatened by attackers looking for new opportunities to distribute malware and steal data.

"SaaS platforms remain something of a 'Wild West' for threat actors and defenders alike," says Maor Bin, Proofpoint's security research lead for threat systems products, in a statement. Capabilities like Google Apps Script are creating opportunities for threat actors who can leverage vulnerabilities for good or bad, using legitimate features for nefarious purposes.

Because victims in these scenarios receive legitimate links to edit Google Docs, as many people do, the same rules of email security apply. Users should also use caution when clicking links to Google Docs, unless they know or can verify the sender. Businesses using G Suite have access to tools which tell them which scripts are out there, which can help awareness.

"In the future it might be useful for Google to try and ascertain whether a script is malicious or not before allowing a user to run it, or even host it on G Suite," says Kalember. "Now, it's challenging to tell whether a script is malicious or not."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19668
PUBLISHED: 2020-02-27
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-17963. Reason: This candidate is a reservation duplicate of CVE-2018-17963. Notes: All CVE users should reference CVE-2018-17963 instead of this candidate. All references and descriptions in this candidate have been removed to preve...
CVE-2019-12882
PUBLISHED: 2020-02-27
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2017-6363
PUBLISHED: 2020-02-27
** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for...
CVE-2017-6371
PUBLISHED: 2020-02-27
Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer header.
CVE-2017-5861
PUBLISHED: 2020-02-27
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-1000020. Reason: This candidate is a reservation duplicate of CVE-2017-1000020. Notes: All CVE users should reference CVE-2017-1000020 instead of this candidate. All references and descriptions in this candidate have been removed to...