A vulnerability exists with the web version of Google photos allows malicious websites to extract the photos metadata information.
Google photos will tag your photos automatically based on the metadata information such as geographic coordinates, date, etc.
The Photo metadata allows information to be traveled along with the image file that can be read by software, hardware, and end users.
Imperva security researcher Ron Masas discovered a browser side-channel attack. Researchers used an HTML link tag to create multiple cross-origin requests to the Google Photos search using javascript to measure the time it took for the onload event to trigger.
By calculating the baseline time based on the trigger event, then researchers used the search query “photos of me from Iceland” and compared the result to the baseline.
If the query took a long time than the baseline time, then it will be assumed that query returned results matching to the photos in Iceland.
In order to make the attack works, first, the attacker needs to trick the user to open the malicious website at the time when the user logged into Google Photos. Imperva published a Video demonstration explaining the attack.
Once the malicious website is opened in the browser it silently generates requests to the Google Photos search endpoint and extracts answers to any query the attacker wants.
This process can be incremental, as the attacker can keep track of what has already been asked and continue from there the next time you visit one of his malicious websites, reads Imperva report.
The vulnerability was reported to Google by Imperva and the vulnerability has been patched now.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.
APT Hackers Group Exploiting the Window OS Using New Zero-day Vulnerability
Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make it a highly effective and low-cost…
A very important message from the Norwegian National Cyber Security Centre (NCSC) says that Secure Socket Layer/Transport Layer Security (SSL/TLS)…
Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices, which makes it an attractive target…
ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine, to target infected systems, which extracts…
Santander has confirmed that there was a major data breach that affected its workers and customers in Spain, Uruguay, and…
The U.S. government has offered a prize of up to $5 million for information that leads to the arrest and…