Googledocs security problem

Do you use Google Docs? Do you collaborate? What setting do you use to collaborate - named persons or anyone with the (non-public) Web address?

If the last of those, think twice. It might be easy to post a link to just those in the know, safe that its a non-public URL. However, as one of my competitors has found out, it's not that safe.

Note: This is not a Google / Googledocs speciific issue. It just happens that I found it via a GoogleDoc. Any online document that relies on Joe Public not knowing the URL is vulnerable.

He had a list of his competitors and their Web addresses, including my website. He then clicked on the link and my web traffic stats picked up on the link and I now have the page he came from and access to his spreadsheet.

You can test it by clicking a test page here:
http://www.pulsecorp.co.uk/google/

The only code on that page is:

   <html>
   <head>
   </head>
   <body>
   <div style='margin: 20px;padding: 20px;background-color:#ccc;border: 1 solid #cc0000;height: 200px;'>
   <?php
     echo "You came from ";
     echo	isset($_SERVER['HTTP_REFERER']) ? "<a href='".$_SERVER['HTTP_REFERER']."'>" .
		$_SERVER['HTTP_REFERER'] . "</a>" : 'an unknown location';
     ?>
   </div>
   </body>
   </html>

Now insert the link into a Google doc and set access rights to 'anyone with the link' and click on it. By all means test it on your own Server by cutting & pasting the above rather than trusting mine.

OK, so it requires links in a Google doc and 'anyone who has the link' to be set but, as my experience shows, the odds of that happening are not zero. I've picked out Google Docs, but any online page that is publicly accessible if you know the URL can be vulnerable. My competitor just had a list of his competition, but it could have been sensitive (pricing) information accessible by the road-based Sales team for instance.

Oh, and yes I did tell him (eventually ;-) )

If you find this useful, then please click here to see what else we do!

Article List:-

Microsoft XP SP3 stops printers from printing
Wireless Network reliability / PC locks up
How to get rid of toadstools
Googledocs Security problem
Sage Software update on Windows 7 error