3

I have a link to a file which is stored in cloud:

https://docs.google.com/file/d/0B8Tf19cw9c8SNnFPamhRWGFwaTq

(I have edited a character from the original for privacy)

So if the garbage string at the end is altered, what is the chance that a file stored in someone else's cloud gets accessed?

Is this possible?

  • 3
    In addition to what the answers suggest, remember that since you have to be logged in on an account to see files, that id could very well be user-dependant, and that same URL return a different file depending on who is logged in. Resulting on altering ZERO characters leading to another file. – frozenkoi May 23 '15 at 0:23
  • I don't think so. I could view this file without logging in. – Treko May 23 '15 at 2:28
  • Then we now know that IDs are universal and not per-user :) – frozenkoi May 23 '15 at 2:40
20

The chance is N in 153,803,885,110,405,674,678,434,597,293,100,547,399,764,930,461,696 where N is the number of files stored under /file/d with public view permissions set (TY @Mike Ounsworth).

So, there's a chance, but it's not a great one.

The "garbage string" is a 28-digit name which appears to consist of uppercase letters (26), lowercase letters (26), and numbers (10). So each digit can be one of 62 characters. The number of possible combinations for that string are therefore 62^28.

  • 9
    Assuming also that the file you stumble on has the appropriate public-view permissions. – Mike Ounsworth May 22 '15 at 15:32
  • ...So I guess you could build a crawler to grab all public google docs (and possibly count the number of private google docs). Since these documents are flagged 'public' anyway, it hardly seems like a vulnerability, just something to be aware of when making your doc public. – Mike Ounsworth May 22 '15 at 15:38
  • 9
    To find the OP's original file would take only 28 times 61 attempts though (he says one character was edited) – Hagen von Eitzen May 22 '15 at 17:12
  • 3
    @MikeOunsworth At 1 million tries per second (which would be really high considering you're sending an HTTP request per try), that's over 4.8*10^33 millenia to find all documents. – jpmc26 May 23 '15 at 0:54
  • 2
    @HagenvonEitzen The attacker might just try all one-character change possibilities, find no result, waste his/her time, and will think that I am lying. And that shall be true if people do so.Since I actually changed many more characters too ;) – Treko May 23 '15 at 2:24
4

It depends on how many files there are and how the links are assigned. A security conscious developer will make the ID random for each file. The difficulty of guessing someone else's random ID is based on the length of the ID and the number of characters that make up the alphabet.

How big is the keyspace?

The link you posted has 28 characters, but you said you deleted one, so we'll call it 29 characters. We can see characters from upper and lowercase ASCII and numbers. So lets also assume the alphabet consists only of those groups. This leaves us with an alphabet size of 62 characters. To calculate the size of the keyspace we use

keyspace = (alphabet size)**(length of ID)

thus

keyspace = (62)**(29) = 9.5358409e+51

Thats an insanely large number. So essentially you'd have to do 9.5e+51 guesses in order to find a particular file. Note that the above assumes an ID that is always 29 characters. If the ID is variable length (for example, between 29 and 50 characters), the numbers explode even more.

What is the chance I can get someone else's file?

The question becomes "If I pick a random ID what is the likely hood that I will return a file".

This question can only be answered if you know how many valid IDs there are. For the sake of simplicity, lets assume every person on the planet (7.1e+10) has uploaded a thousand files. This would mean there are 7.1e+12 valid IDs. Even if we assumed this number (and I think we can all agree that the number is much lower in reality), the likely hood of guessing a correct number would be

Likely hood of correct guess = (number of valid IDs)/(keyspace)
                             = 7.1e+12 / 9.5e+51
                             = 0.00000000000000000000000000000000000000074

In conclusion

So in order to be sufficiently protected the developer should ensure:

  • The keyspace of the ID is sufficiently large
  • The ID is generated in a securely random way.
1

Yes and no. That string is associated with the ID of the document, which lets Google know what data to retrieve. So if you change that string there's a possibility you'll find one that matches a different document. There are a lot of possible character combinations so the chances of randomly finding one is probably pretty low, but not impossible.

However, Google does enforce access control checks on these documents before delivering them, which by default are restricted to the account that created them. A user can change the permissions to make a document public, in which case it is possible you could find a readable document by randomly guessing IDs. It would be even less likely that you guess a valid file ID and that file happens to be public.

0

The "garbage string" you speak of is actually the identifier or unique name for your file. It's possible that if you change one character, that would be the identifier for another file. It's unlikely because there are so many possible identifiers.

Finally, it's just a URL. Just because you have the URL doesn't mean that Google Drive will actually deliver the file to you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.