1

Not to be dramatic but at my level of inexperience, the title is what I'm left with. Hoping smarter people can point me in the right direction, so here goes...

A google account used in a school environment, on samsung chromebooks, has been compromised in an odd way. Documents that the student are working with on google drive/docs are being edited and "scary" pictures are inserted along with odd text.

So far, password changes and turning on 2 factor authorizations on the account have not stopped the edits from occurring. Some limited testing tells me that a password change invalidates all previously logged in sessions, so if this were another student or individual in real time editing and causing the issue, it should have kicked them out and solved it. The 2 factor authorization code that I tested is also only valid for a single login, with failed login attempts sending notices to the user. So I think I ruled out that someone is logging in with a repeatedly stolen username/password, like another person looking over a shoulder and copying the password.

Has anyone ever heard of a plugin/malware/extension that is meant to be a prank that would fit this? Or anything really, any other suggestions cause at this point I'm left with requesting that IT delete the account and start fresh...or that it's a ghost...

Thanks for any help.

  • 2
    Pretty spooky, have you checked if someone enabled an application-api access. It's provides a sign in token for applications and I think you could create as many as you want and it would remain accessible after a password change. – rudib May 4 '18 at 21:36
  • Someone may be using this or a similar api. There should be a list of the tokens somewhere in the security settings with an option to revoke access. developers.google.com/drive/v2/web/about-auth – rudib May 4 '18 at 21:40
  • 1
    Aplication password, application authorization to google drive, just plainly set up sharing of the document in question or even just malware on the PC itself. – Peter Harmann May 4 '18 at 21:41
  • 1
    Also, a malicious application may have been granted access to the account. You should be able to check that in the security settings too. – rudib May 4 '18 at 21:41
  • See this: support.google.com/accounts/answer/3466521?hl=en – rudib May 4 '18 at 21:42
2

To summarize the checks that can be done in order to assess wheather and how the account has been compromised:

  • First of all see if the files in question are shared with other users (which may be the cause of the problem). Someone who might have had full access to the account might have granted himself access and now is still able to modify the files after losing the login credentials thanks to your intervention. Also the user might have accidentally shared a folder or more with a wrong user.
  • See which applications have access to the account on the permissions page, look for suspicioius ones and, in the best case revoke access for all, for now at least.
  • See any API access tokens have been created or are currently active. A list of which should be in the Developers Console under: Developers Console/apis/credentials
  • In addition you can look at the security log
  • Finally, of course, the user's computer itself or one of those having access to a share might be compromised or the users themselves may be involved.
  • I got a chance to look at the account again today and following your suggestions along with the other comments and will have to wait and see if the documents are still being edited. I checked for rogue API keys and for odd authorized applications/logins and didn't find anything though so now I'm looking to see if google docs has more detailed logs of edits so that I can narrow the field some. Thanks again for everyone helping me trouble shoot this oddity. – Matt M May 7 '18 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.