Security Flaw in Google Apps Script can Let Hackers Deliver Malware via SaaS Platform

Security researchers reported a security flaw in Google Apps Script that can enable hackers and cybercriminals to deliver Google Drive-hosted malware when abused and exploited. Since the attack happens within a software-as-a-service (SaaS) environment, detecting the malicious activity can be difficult, and the attack may be carried out without user interaction or awareness.

Google Apps Script is a JavaScript-based development platform that programmers can use to develop web applications and extensions for Google’s SaaS ecosystem, such as Google Docs, Sheets, Slides, Forms, Calendar, and Gmail.

According to the researchers, the flaw is related to the sharing capabilities and automatic download features of Google Apps. The attack chain is quite different from how Google Drive is typically abused to host and distribute malware.

In this scenario, the attack happens within Google’s services: Attackers send a socially engineered Google Doc to the would-be victim. The file, when opened, will prompt the user to run a Google Apps Script that would then retrieve the malware hosted on Google Drive. The infection chain bears a resemblance to macro malware normally embedded in malicious Office documents.

[From TrendLabs Security Intelligence Blog: qkG Filecoder — self-replicating, document-encrypting macro ransomware]

The findings highlight the security risks in the SaaS platform that’s increasingly adopted by enterprises. In fact, SaaS, along with infrastructure as a service (IaaS), drove the growth of public cloud services in 2017, reaching a $58.6-billion revenue. When implemented properly, SaaS provides enterprises flexible, purpose-built, and scalable solutions that can optimize business processes and operations.

And like with many nascent technologies and alternative platforms that enterprises use, SaaS is likely to draw more cybercriminal attention as it gains more traction. It further exemplifies the trend in today’s threat landscape: Abusing legitimate services to stay under the radar. This underscores the significance of installing multilayered safeguards — from gateways, endpoints, networks, and servers — to better mitigate an organization’s attack surface.  Nurturing a cybersecurity-aware workforce is also important.

The researchers disclosed their findings to Google, who in turn set up countermeasures against Google Apps Script’s abuse. They include preventing installable and simple triggers that let customizable or fixed functions run automatically when an event occurs, such as opening a document.