Google Drive flaw could allow hackers to trick users into downloading malware

Google Drive currently has a flaw that could allow hackers to trick users into downloading malware posing as legitimate files.

The flaw is reportedly in the service’s ‘manage versions’ feature. The Hacker News reports that a legitimate version of a file that’s already been shared can be replaced with a malicious file. This is possible because the service doesn’t check the file type or enforce the same extension.

However, when the file is previewed online, there’s no indication that any changes have been made. Once the file has been downloaded, it could potentially be used to infect targeted systems.

This flaw could be used for spear phishing attacks that fool users into compromising their systems. For instance, a user may get a notification of an updated document and then download the file without knowing the threat it contains.

Google has yet to comment on the flaw. The best way to prevent any issues is to be cautious of Google Drive file update notifications, especially if you aren’t expecting one.

Source: The Hacker News Via: Engadget