Friday, March 29, 2024

Google Photos Vulnerability Allows Hackers To Track Location History

A vulnerability exists with the web version of Google photos allows malicious websites to extract the photos metadata information.

Google photos will tag your photos automatically based on the metadata information such as geographic coordinates, date, etc.

The Photo metadata allows information to be traveled along with the image file that can be read by software, hardware, and end users.

Imperva security researcher Ron Masas discovered a browser side-channel attack. Researchers used an HTML link tag to create multiple cross-origin requests to the Google Photos search using javascript to measure the time it took for the onload event to trigger.

By calculating the baseline time based on the trigger event, then researchers used the search query “photos of me from Iceland” and compared the result to the baseline.

If the query took a long time than the baseline time, then it will be assumed that query returned results matching to the photos in Iceland.

How the Attack Works

In order to make the attack works, first, the attacker needs to trick the user to open the malicious website at the time when the user logged into Google Photos. Imperva published a Video demonstration explaining the attack.

Once the malicious website is opened in the browser it silently generates requests to the Google Photos search endpoint and extracts answers to any query the attacker wants.

This process can be incremental, as the attacker can keep track of what has already been asked and continue from there the next time you visit one of his malicious websites, reads Imperva report.

The vulnerability was reported to Google by Imperva and the vulnerability has been patched now.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Beware !! Hackers Exploiting WinRAR Vulnerability to Hack Windows Computer While User Extract the Content

APT Hackers Group Exploiting the Window OS Using New Zero-day Vulnerability

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles