The Hacker News — Cyber Security, Hacking, Technology News

Google Drive is the new home for Google Docs, that users can access everywhere for Storing files safely. In a recent demonstration hacker successfully performed an attack on Google Docs to trick users to grab their Facebook, Gmail, Yahoo credentials with Credit Card Information.

Security researcher Christy Philip Mathew came up with combination of Clickjacking and CSRF vulnerabilities in Google's Docs that can allow a hacker to create a document in victim's Drive for further phishing attack.

For those who are not aware about Clickjacking, It is a technique where an attacker tricks a user into performing certain actions on a website by hiding clickable elements inside an invisible iframe.

He explain how this technique can be executed to pwn a Google user to steal victim's all type of credentials with a phishing attack. Here attacker need to send a Malicious URL to the victim, where victim needs to interact with some buttons only.

Vulnerability allow hacker to trick Google user to create an document in victim's drive, which is actually owned by attacker and the victim. To perform a successful phishing attack, an attacker can carefully craft that document maliciously.

POC uploaded here and Demonstration Video as shown below:

After analyzing the possible threats of this vulnerability, I prepare an example for THN readers, where attacker can rename the document to something "Google GooPass" (imaginary service for storing passwords and important information secretly in Google drive) and crafted a simple design that can phish users to enter their Credit card information, Google, Facebook username password etc, as shown below:

Victim can be led to believe that it's a Google default file or Service to save all type of personal information secretly at one location. Because attacker and victim, both are the owner of this new file, where attacker can make the document public for further access after removing himself from ownership of that document.

At the end, victim is only owner of the document (which is now public) and if phishing attempt works, hacker will be able to see all updates remotely, anytime - anywhere!

Note : 

1. Vulnerability is not fixed yet, we urge Google to fix this as soon as possible to assure maximum security to Google users.
2. There is no Google service called 'Google GooPass', the term is just used to trick victim for phishing purpose.

Mohit Kumar - Founder and Editor-in-Chief of 'The Hacker News'. Cyber Security Analyst, Information Security Researcher, Developer and Part-Time Hacker. (Google+ Profile)

Follow @unix_root

The Hacker News always motivates hackers to first Disclose vulnerabilities to vendors, because we take SECURITY IN A SERIOUS WAY. But what inspire hackers to sell stuff to underground market or to do PUBLIC DISCLOSURE is an irresponsible response of the Administrators.

Thousands of sites, programs and servers are today still vulnerable to hackers and there were researchers who contributed to the security of same companies even before the bounty program began.

One more thing, I want to mention here that - If we look Bug Bounty White Hat Hackers Lists, you will find 50% of reward hackers who even don't know how to code a website in PHP or ASP , but they are a hacker !  (Note: Rest 50% are much good in knowledge and I respect most of them like My other friend Avram Marius - known for Hunting hundreds of Bugs). 

At least I would like to suggest big companies to make a transparent Bug Bounty Panel where hackers can at least see that, before them someone really submit similar bug and companies should at least fix/restrict the venerable pages as soon as possible.

Note : Today we also report about a Cross Site scripting bug in Apple.com and reported the Apple Security Team, Reply was,"We already aware about the issue, Thank you" - Question is still same, then Why you didn't take any quick action ? And Even if I was the second person to inform about that, then why the bug is exploitable till now ?