Using YouTube to steal your files

[breakingcups]

https://lyra.horse/blog/2024/09/using-youtube-to-steal-your-files/

[rozab]

Would like to highlight that this webpage, interactive 'screenshots' and all, is 31kb

[altbdoor → rozab]

Ah I see, it makes sense now that they aren't screenshots, and are instead interactive HTML/CSS/JS(?) bits.

Was suspicious of how high quality the screenshots were in mobile, but didn't bother to click on them. Neat!

[rebane2001 → altbdoor]

No JS on the page, only HTML/CSS :)

[pcthrowaway]

Weird to see so little traction on this novel attack.

Honestly, considering this allows anyone to access anyone else's private drive files, I would have expected the payout to be much higher

[echoangle → pcthrowaway]

You have to trick someone into opening your presentation and clicking a specific button, that’s not something a random person knowing my email could easily do. It’s a problem but I wouldn’t exactly say it allows anyone to access anyone else’s private drive files.

[a012 → echoangle]

My company IT sec person sent a presentation and asked everybody to follow a link inside the slide to go to the training website. So never underestimate a attack vector, also security is just a joke.

[az226 → echoangle]

One click is all it takes. That’s the lowest on the totem pole of social engineering.

[dredmorbius → echoangle]

It is the sort of direct targeted attack one might expect a motivated adversary to undertake.

And perhaps those who are cultivating botnets or other widespread attacks.

[fragmede → echoangle]

A random person knowing your email isn't totally random though. a normal person's email address is enough to track down some known associates. Spoof the email as coming from a business partner as the new deck for a side hustle, and the target has been phished. Multiply across every email leaked in recent mega leaks and it's a good thing it was patched!

[0dayz]

One major reason I either only watch Youtube on no account or dedicated Youtube Google account.

[sushid → 0dayz]

This specific security vulnerability was the main reason you watched Youtube on a dedicated account?

[rebane2001 → 0dayz]

I'm not sure how that'd save you here unless you go out of your way to block the youtube domain entirely.

[spatterl1ght]

this is awesome! loved the read

[nullc]

How can you tell if your root folder has been shared this way? Doesn't look like the root folder's sharing settings are accessible via the normal UI.

[rebane2001 → nullc]

You cannot share your Root folder, I just threw it in there as a fun bit of unrelated trivia about Drive :). If you attempt to share it (you can try!) you'll just get an error.