Google Hacking Becomes More Important

published: November 27th, 2007

Ok, what I actually meant is that Hacking Google Becomes More Important, however the first title sounds a lot better, doesn’t it? Anyway, unless you are not following the cutting edge stuff that are happening around you, you probably don’t know that some Google folks have confirmed the release of the next in line killer on-line product known as GDrive or Platypus, as some like to refer to.

What does that mean? To answer that let’s have a brief look at what GDrive might actually be. As the name suggests, it is a drive mounted under G: on Window$. This is obvious. But the important bit, which you probably missed noticing after my extraordinary explanation, is that users will be able to store files on-line. This is very interesting. Given the fact that Google users are almost as fanatic about Google products as Apple user to Apple products, a massive number of the entire online population will start using the service without any second thoughts. How dangerous it could be when Google is so secure? And for the most of it Google is indeed quite secure, although given enough motivation everyone can find a bug or two. I think that the security community has proved that already more then once.

So, will hacking Google become more important? I think so! Evolution is the solution!

» more | » comments | » comments rss | posted by pdp | syndication and integration ( )

Comments

Luca responds:

i think we might see a virus/worm named GDrive first :)

random responds:

Its insanely scary to consider everyone putting their files out on the internet in such a casual manner. The next big exploit (just a little bug somewhere) leads to a direct access to everyone’s files. The person who has their files ransacked might not ever know that it happened if the attack is careful not to modify anything in an obvious manner.

Lucky enough we have full drive encryption tools such as Truecrypt (windows and linux yay!) which will provide just a slight bit extra security. Just add the g: drive and then make a happy little encrypted drive inside of it. Sure if your computer is comprised, it doesnt matter but any failures on Google’s side won’t mean any real problems for you.

pdp responds:

random, you are right! though, I must say that this wont work for most of the people out there. if you encrypt them then you won’t be able to access them from any location. then what’s the purpose of having them online of first place? it just defeats the purpose. don’t you think?

Joe responds:

I really think GDrive is a bad idea, one bug/exploit would be enough to find a lot of private/important documents. Remember that exploit by Andrew which would uncover all private pictures on Photobucket… Imagine what would happen if a bad person would have access to all your private information. I’d rather stay safe and keep my data to myself.

pdp responds:

there are interesting alternatives which could provide the level of granular security all need. though, these services are not that user friendly!

Awesome AnDrEw responds:

I don’t generally keep up on the workings of Google as the only real service I use from them is their search engine. Judging from the insane “Proof of Concepts” that Nate McFeters and Billy Rios came up with for both Google’s Picasa and Google Documents I am sure this new service will be no different other than there being a lot more for consumers to lose. After doing about a minute of research I see that the service comes with a price (which is different depending on the size of storage).

Without having actually used the service, but basing the idea around the flaws already found within their other services I believe it would more than likely be possible to use CSRF in some manner to cause a user to upload arbitrary files from Windows. Next thing you know there will be SAM and PWL files being cracked left and right along with stolen registry keys containing saved passwords and what-not. Just a prediction, but wouldn’t be surprised to see such things happening.

pdp responds:

I see that the service comes with a price (which is different depending on the size of storage)

we don’t know that yet :)

…user to upload arbitrary files from Windows.

I’ve got it. This is what I was thinking as well. And the reverse too. What if the attacker is able to upload a file into the storage, which eventually gets on the desktop? Isn’t that a massively huge problem! But again, for now, it is all speculations folks.

Chris responds:

pdb, with regards to your response to random’s comment about encryption.. I wonder how feasible it would be for google to automatically encrypt the data based on the user’s unhashed password and use a strict password policy that actually requires a fully passphrase or something instead of just a password. That would at least add another layer of security or at least another obstacle for an attacker even if its not impervious.

It would be tricky to implement to protect against XSS stuff and to make it secure, I can see that but is that something feasible or just a horrible idea?

pdp responds:

Chris, I am not sure what exactly you mean but yes, it is possible for Google to encrypt the data based on your password although I believe that this may have some horrible implications. Though, it is possible to come up with hacks. If, for example, it is allowed to put some HTML onto the server, you can code up a tiny script that will encrypt your stuff with Blowfish before posting. You can add this support through Greasemonkey as well. So, for the most of the people, data encryption wont be available, IMHO. After all, from Google’s prospective, why do you need encryption when you can mark your stuff as public or private? For hackers and alike, well we can always come up with a solution, can’t we?

Nathan McFeters responds:

PDP et al,

It actually goes further. I had the same thoughts you are having about Mac’s already implemented iDrive. Just go watch the product demo vid. Now that Santa came early and gave me my MacBook, you can bet your life I’ll be looking at it soon.

~Nate

Technocrat responds:

Why not use GDrive with TrueCrypt? Store your files on Google’s space but keep them safe in a encrypted filesystem.

This has been possible for quite sometime using Gmail Drive and TrueCrypt, but I personally have never set it up.

Awesome AnDrEw responds:

How many consumers and Google users do you actually believe to be using TrueCrypt, and other hard-drive encryption tools though? While I’m sure there is a percentage of people who use these applications in conjunction with Google services I believe the majority of users pay no mind to it. What about those other people who know it’s possible to set up, but also don’t bother?

random responds:

@pdp:

Yeah I cant see anyone (not computer savvy) actually doing all the hard work of walking through each step of setting truecrypt on remote boxes. However it wont take much to grab the portable version of truecrypt (or any of the other crypto programs) and setting up a nice script to do the setup for you. This might be done with a nice usb drive with a copy of truecrypt setup in a similar manner to this http://www.ericsprojects.com/?p=102 for windows users. You just have your encrypted key on the usb drive and have it ask for the key on mount. If your daring enough, you could put truecrypt on your gdrive and install it on demand. Depending on your crypto type, you can store your encrypted private key (for public key crypto) on there.

This of course doesn’t work on public computers, but if your willing to put your important files on a public computer and type your passwords in to them, then you don’t get much benefit from encryption in the first place. The public computers must also have the gdrive drivers, which means the admins will be well aware of gdrive and the possiblity of people using crypto. Its as simple as a key logger on the computer and every protection you worked so hard on getting is broken by you entering in the passwords.

I of course happen to very paranoid and love encrypted backups. The gdrive will work out great for such purposes. Public computers are for public data and any expectation of privacy should be quickly corrected.

If your not using public computers, then you can just install truecrypt on every box and there is no problem beyond the difficulty of setup which a nice script can solve for most people.

@Chris:

The whole point of using encryption is to avoid letting google or any one else see what your files are. Having google do the encryption on their side wont add any safety to the system as we are expecting their side to be compromised.

The best solution might be putting the encryption right on the gdrive driver. That way your password is never sent to google (if the driver sends your pass, whats the use for crypto again?) and you have a portable system because its required that their driver will be installed where you planned on using the gdrive already.

A problem down the road will eventually arise from the strength of your crypto. If your passwords are under 8 letters, then your crypto will only be effective against attackers with low resources. The protection of 1024+ bit keys are generally required and its unreasonable to expect any one to haul those around in their heads. Remember, everything posted to gdrive goes to the internet and the internet never forgets. Remember the AACS key leaks? Yeah your data is gonna need some good protection unless you expect it to be public eventaully.

If google continues with their gmail model, its likely that they will to deep inspections of your files. This is a privacy problem and encryption protects against that. We just have to make sure the the crypto protects our files from google just as much as it does against some intruder in their systems. Since these files are publicly known, they are also ripe grounds for subpoenas too.

pdp responds:

This might be done with a nice usb drive with a copy of truecrypt setup

I agree but if you carry a USB drive with you, why do you need on line storage then? Today you can buy 2gig USBs for almost nothing. It just defeats the purpose.

random responds:

@pdp

Yeah, you can still throw the setup on the gdrive. Your crypto tools dont need to be encrypted, although hash checks are always a good thing.

All of this security makes using the gdrive quite the annoyance for using remotely.

RoscoeT responds:

Personally I feel that Google already knows too much about me and everything else. It gives me the creeps. Everyplace you go online has either adsense or Google analytics installed. Don’t believe me? Install the no-script extension and go surfing…
Then consider the phishing filter which checks Google’s DB every time you visit a site.

Many browser setups when you type a url into the address bar do not take you there directly. They submit this to your default search engine (often, you guessed it, Google) and then direct you to the appropriate site. Like some kind of master DNS server. The more I think about it the more I figure that Google is the worlds biggest online spy.
If you hack that, you’re golden.

pdp responds:

I totally agree, Google knows too much about everybody. I try to avoid surfing the Web with the same browser which is used for my GMail login. There are two reasons behind this. The first one is related to security, I certainly don’t want to get hacked and there are plenty of XSS vectors for Google to prove that this is absolutely possible. The second reasons is that I don’t want Google know that I’ve visited certain resources. Virtually every Google add, every Analytics, every addon, is a bug, snooping on your cookies and successfully identifying you through your gmail.

And you are right. If you hack Google, you are golden. And I don’t think that this is hard to be done. Like every organization, Google has its weaknesses. It is dedication that is required. Once you are in, the information that you can get will be unbelievable.

Gary responds:

I want to do whatever i can for people on this website. Also i want to do anything on this website.

GNUCITIZEN

Navigation

Google Hacking Becomes More Important

Comments

Respond

The Others

External Projects

Recent Posts

Random Posts

From The Cutting-edge Network