Organizations using Google’s G-Suite can not only add the company’s business productivity tools such as Docs, Sheets and Slides. They can also buy third-party apps for enhancing those tools through Google Marketplace.
However, an analysis from researchers at Texas security firm Two Six Labs concluded a large number of apps in the Marketplace pose a risk.
“We found that nearly half of those apps (studied) are able to communicate with outside services, whose identities aren’t reliably disclosed to users,” said the report by Irwin Reyes and Michael Lack. “Additionally, our data suggest that app auditing measures meant to protect users from potential API misuse may fall short: a new-user limit placed on potentially risky unverified apps is not rigidly enforced, and thousands of users will nonetheless authorize risky apps if allowed.”
Third-party G-Suite apps offer a wide range of productivity plug-ins that appeal to organizations for invoicing and accounting, shortcuts to Dropbox, creating flow charts, managing Chromebooks, highlighting text and more. Some come from established sources, like Cisco Systems’ WebEx, but most are from independent developers. All leverage G-Suite’s application programming interface (API). Some can’t be installed by users without a G-Suite administrator’s OK.
All of the apps studied asked for user permission to connect to an outside service but no details about what those external services are, or for what purpose a given app is using those APIs. “While some developers do elaborate on this in their apps’ Marketplace listings or external privacy policies,” the report says. “A cursory spot check on a selection of these 481 apps shows this is not always the case.”
CISOs have to understand the risks these apps pose because they may access personal data of users and possibly enterprise data if they send information to outside services.
The goal of the study was to examine the third-party uses of the Google API to identify potential risks to consumer data, as well as how developers and Google communicate those risks. Of the 987 apps listed on the G Suite Marketplace, half were able to communicate with undisclosed external services. A portion of those apps also held permission to access users’ Google Drive files, emails, or contacts.
The report notes that Google recognizes risks in giving unrestricted access to user data via API, so it enforces certain limits on the use of API scopes deemed “sensitive” and “restricted.” For example, apps that request sensitive scopes must verify that they follow Google’s API Services User Data Policy.
Google requires developers to submit apps for review if they use “sensitive” API functions. However, those apps may still be listed on the Marketplace as “unverified” until the review is finished. Depending on the category, a review can take up to eight weeks. In the meantime, an unverified app is limited to 100 new users.
But the researchers found that the restriction on unverified apps gaining new users is not rigidly enforced. “Unverified apps will continue to draw many new users—on the order of thousands in our 16-day observation period— despite warnings to do otherwise.”
“We believe that even after a major scandal stemming from the abuse of an API provided by a competitor” (a reference to the Cambridge Analytica scandal) “our results show that there is still substantial risk in these systems,” the report concludes, “and recognize broad opportunities for improvement in how online services such as Google expose user data for programmatic use by third-parties.”
In a statement to ITWorldCanada, Google said “We have a rigorous process of verification for every application that is submitted to the G Suite Marketplace, and we continue to work with our developers to ensure compliance with our policies. The conclusions in this report do not accurately reflect the stringent third-party data access and privacy protections we have in place to protect our users. For our G Suite customers, we provide admins full visibility and comprehensive controls to manage app access.”
(This article was updated from the original by adding comment from Google.)
