G Suite Marketplace primed for a privacy scandal, researchers warn

guest · Jun 2, 2020

G Suite Marketplace primed for a privacy scandal, researchers warn
G Suite apps that have access to Drive and Gmail data found communicating with undisclosed external services
June 2, 2020
https://www.zdnet.com/article/g-suite-marketplace-primed-for-a-privacy-scandal-researchers-warn/

In research presented last month, security researchers said that many of the apps listed on the G Suite Marketplace have access to users' Gmail and Drive accounts, but also communicate with undisclosed external services, creating the opportunity for secret data exfiltration from Google accounts.

The research, carried out by Irwin Reyes and Michael Lack of Two Six Labs, analyzed the permissions requested by third-party Google apps listed on the G Suite Marketplace.
Reyes and Lack said they used an automated script to install all the 1,392 apps listed on the G Suite Marketplace on January 2, 2020, on a test Google account and then record the permissions each app requested.

The research team says that of these 481 apps that could bridge to with the outside world, 103 (21% of 481) could access and interact with Google Drive files, 81 (17%) could access and interact with email inboxes, and 15 (3.0%) could access and interact with calendar data.
Click to expand...

RESEARCHERS RECOMMEND MOVING TO INSTALL-TIME PERMISSIONS
The Two Six Labs team argues that many of the same issues that plagued Facebook's third-party app ecosystem now impact Google's G Suite Marketplace, which may soon result in malicious apps being uploaded on the store for the sole purpose of collecting data from Google users (most of which are enterprise users of Google's G Suite package).

Reyes and Lack say that one way to address this issue is if Google moves from prompting users for permissions when the app is installed to when the app is first used.
Click to expand...

Research paper: "API Privacy: A Look at G Suite Marketplace Permissions and Policies"
(PDF - 51.5 KB): https://www.ieee-security.org/TC/SPW2020/ConPro/papers/reyes-conpro20-talk.pdf
(PDF - 232 KB): https://www.twosixlabs.com/wp-content/uploads/2020-conpro-apis-draft.pdf

This work is a preliminary investigation into analogous risks to consumer data posed by Google’s API and the various disclosure mechanisms surrounding it. Like Facebook, Google has an active user base in the billions, competes with Facebook in the social media and advertising space, and allows third- party apps to integrate with Google functionality and user data via an API.

Unlike Facebook, Google has not been subjected to the same level of criticism prompted by the
Cambridge Analytica scandal.
This work intends to motivate further examinations into how online services as a whole give third-party apps programmatic access to user data, as well as how consumers are informed of those privileges.
Click to expand...

Rasheed187 · Jun 6, 2020

Guys, just stay away from these dumb cloud services.

Log in or Sign up

G Suite Marketplace primed for a privacy scandal, researchers warn

guest Guest

Rasheed187 Registered Member

Log in or Sign up

G Suite Marketplace primed for a privacy scandal, researchers warn

guest Guest

Rasheed187 Registered Member

Useful Searches