Google Drive Hunter: Building the Tool Google Should've Built

Google Drive Hunter: Building the Tool Google Should've Built

Speakers: Ayman Elsawah

Conference: BSides SF

YouTube: https://www.youtube.com/watch?v=sOv8R4TTOPg

Overview

In an era where cloud collaboration platforms are indispensable, the accidental exposure of sensitive data remains a persistent and critical security challenge. Ayman Elsawah's talk, "Google Drive Hunter: Building the Tool Google Should've Built" (now rebranded as Sleuthther), addresses this pervasive problem head-on. Elsawah, Head of Security at Ambience Healthcare, unveils a custom-built command-line interface (CLI) tool designed to empower organizations to proactively identify and manage publicly shared files within their Google Workspace environments.

The core of the problem lies in the ease with which Google Drive files can be inadvertently shared publicly, often without the user's full awareness of the implications. This talk highlights how such seemingly innocuous actions can lead to the exposure of highly confidential information, from financial documents and legal contracts to personal identifiable information (PII) like passport photos and bank account numbers. Sleuthther emerges as a practical solution, offering a robust and user-friendly alternative to Google's native administrative tools, which often fall short in providing the necessary visibility and actionable insights for security professionals.

Elsawah's presentation not only details the technical journey of building Sleuthther but also underscores the broader importance of proactive data governance and the critical need for security teams to have effective tools at their disposal. The tool’s development, inspired by a real-world need for better auditing, showcases how leveraging Google Workspace APIs can bridge the gap between inherent platform capabilities and the stringent demands of enterprise security, ultimately helping defenders secure their digital estates against preventable data leaks.

Background

▶ Watch: Introduction to Sleuthther and talk agenda (0:00)

The problem of publicly shared files in cloud storage platforms like Google Drive is a silent but significant threat to organizational security. Despite Google Workspace offering various controls, sensitive documents frequently find their way onto the public internet. Elsawah vividly illustrates this with the ubiquitous "globe" icon, signifying public access, describing it as "the bane of my existence." This icon, often overlooked or misunderstood by users, signals a potential data breach waiting to happen.

Several factors contribute to this widespread issue. Firstly, users, particularly in departments like sales and marketing, often require the ability to share files externally for legitimate business purposes. However, the mechanism for sharing can be confusing. As Elsawah points out, platforms like Google and Slack will "conveniently share them publicly" if users aren't careful, sometimes asking "Would you like to share this with the world?" which many users might accept without fully comprehending the scope. Even granting editor access to another user can inadvertently lead to public sharing if that user subsequently changes permissions.

The consequences of such exposures are severe and wide-ranging. Elsawah lists numerous examples he has encountered:

• Financial Data: Invoices, contracts, sales quotes, pricing calculators.
• Human Resources Data: Offer letters with equity and compensation details.
• Confidential Business Information: Board meeting minutes.
• Personally Identifiable Information (PII): Bank account numbers, driver's license photos, passports.

While Google Workspace provides preventative measures such as restricting sharing by Organizational Unit (OU) or Google Group, these are often underutilized. Elsawah identifies three primary reasons:

1. Lack of Awareness: Many administrators and users are simply unaware that these robust controls exist.
2. Resource Constraints: Smaller organizations may lack a dedicated full-time IT or security person to implement and manage these policies.
3. Fear of Limiting Users: Restricting sharing capabilities can be perceived as an impediment to productivity, leading to reluctance from management to enforce such policies.

Elsawah's journey to build Sleuthther began out of frustration with Google's native administrative tools. While Google Admin Console allows searching for files, its interface is notoriously "ugly" and "not friendly." Crucially, it provides only a resource ID for documents, lacking clickable links or immediate context, making it impractical for security teams to quickly assess and remediate risks. Exporting data to Google Sheets from the Admin Console offers little improvement, as it still requires manual effort to link IDs to actual file content. Recognizing this significant gap, Elsawah sought to build a tool that would be simple, powerful, easy to automate, and provide actionable visibility into publicly shared files.

Key Findings

▶ Watch: The pervasive problem of publicly shared Google Drive files (3:55)

The development and deployment of Sleuthther illuminated several critical findings regarding Google Workspace security and the broader landscape of data exposure:

1. Pervasive and Diverse Data Exposure: The most significant finding is the sheer volume and variety of sensitive information inadvertently exposed through publicly shared Google Drive files. Beyond the obvious financial and HR documents, Elsawah’s experience confirmed that PII like passport photos and bank account numbers are frequently accessible, highlighting a critical gap in user awareness and existing controls.
2. Inadequacy of Native Google Workspace Admin Tools: Google's built-in Admin Console, while providing some search capabilities, is fundamentally ill-equipped for comprehensive security auditing of publicly shared files. Its clunky interface, lack of direct links to files from search results, and reliance on manual ID correlation make it impractical for security professionals needing rapid assessment and remediation.
3. The Power of Google Workspace APIs: The talk demonstrates that while the UI is lacking, the underlying Google Workspace APIs (Drive API, Admin SDK API, Sheets API) offer the granular control and data access necessary to build powerful auditing and remediation tools. This confirms that custom development can significantly enhance an organization's security posture where vendor-provided tools fall short.
4. OAuth Scope Management is Complex and Critical: Building a tool that interacts with Google Workspace data necessitates careful management of OAuth scopes. Elsawah discovered that achieving necessary functionality often involves requesting broad, high-risk scopes (like drive for full drive access), which must be handled with extreme caution and a commitment to least privilege. This highlights a common challenge in cloud API development: balancing functionality with security.
5. Real-World Data Reuse Risks: A compelling "interesting story" from Elsawah's development process revealed a critical real-world vulnerability: an executive coach reused a public onboarding document template for a highly sensitive letter of recommendation, inadvertently exposing a former client to the PII of another individual. This incident underscored that even seemingly innocuous user habits like "copy-pasting" content into existing, publicly shared files can lead to significant data leaks, reinforcing the need for proactive auditing.
6. Potential for AI-Driven Classification: Elsawah identified the challenge of security analysts having to manually review potentially sensitive files. His future vision for Sleuthther includes AI classification to automatically identify sensitive content (e.g., "offer letters," "board minutes," "passport photos") without human eyes needing to directly access the raw data, thereby reducing the exposure risk for security personnel themselves.

These findings collectively emphasize the ongoing need for vigilant security practices, robust technical controls beyond default settings, and innovative tools to combat the persistent threat of cloud data exposure.

Technical Deep Dive

▶ Watch: Shocking examples of sensitive data found publicly exposed (4:50)

Sleuthther (formerly Google Drive Hunter) is a Python-based command-line interface (CLI) tool designed to scan a Google Workspace environment for publicly shared files and generate an actionable report. Its development leveraged "vibe coding" with assistance from AI tools like Claude, highlighting a modern approach to rapid development in security.

The core functionality of Sleuthther relies heavily on interacting with several Google Workspace APIs. To achieve its objectives, specific OAuth 2.0 scopes must be granted to the application. Elsawah meticulously detailed the necessary scopes and their associated risks:

1. admin.directory.user.readonly: This scope is essential for the tool to iterate through all users within the Google Workspace directory. By listing all users, Sleuthther can then query each user's Google Drive for files they own. This scope is read-only, limiting its direct risk.
2. drive.readonly.metadata: This scope allows Sleuthther to retrieve metadata for files in Google Drive, including crucial information about their sharing permissions (e.g., whether a file is publicly accessible). This is a read-only scope, focused solely on file properties rather than content.
3. drive.file: Specifically used for creating the Google Sheets report directly within the user's Drive. This allows the tool to generate its output in a structured, accessible format.
4. drive: This is identified as the "most risky" scope. It grants full read and write access to all files in the user's Google Drive. While Elsawah emphasizes the danger, this broad scope becomes an "unnecessary evil" if the tool is to implement remediation actions, such as revoking public sharing permissions. For read-only auditing, it is not strictly necessary, and Sleuthther defaults to read-only mode to mitigate this risk.
5. sheets: This scope enables the tool to create and edit Google Sheets, which is where the final report of publicly shared files is generated. It allows for structured output with multiple tabs and direct links.

The development process involved overcoming several technical challenges:

• API Enablement: One initial hurdle was the lack of clarity around enabling specific APIs within a Google Cloud Project. Elsawah addressed this by building error correction into Sleuthther. Upon the first run, if an API is not enabled, the tool provides an intended error message with a direct link to the Google Cloud Project to enable the required APIs, significantly improving user experience and reducing troubleshooting time.
• User Iteration: The tool is designed to audit all users in the workspace, ensuring comprehensive coverage.
• Output Format: The output is a Google Sheet, which is highly practical for security teams. Each user gets their own tab, making it easy to review individual responsibilities. Crucially, the report includes direct links to the identified files, allowing security analysts to quickly verify the content and sensitivity without manually copying and pasting resource IDs, a major improvement over the native Google Admin Console.
• Dry Run Mode: For remediation actions, Sleuthther includes a dry run mode. This allows administrators to preview the impact of revoking permissions before making permanent changes, providing a safety net.
• Remediation Logic (Future/Considered): Elsawah also discussed potential future enhancements for automated remediation, such as revoking public sharing for files older than a certain threshold (e.g., 90 days). His research suggests that many old, publicly shared files are no longer actively used, making them prime candidates for automated cleanup. The tool also considers orphaned files whose owners have left the organization.

The architectural design prioritizes ease of use and actionable intelligence, making it a powerful addition to a security team's toolkit for managing Google Workspace data.

Demo / Proof of Concept

▶ Watch: Technical and educational methods to prevent public sharing (5:58)

The demonstration of Sleuthther showcased its straightforward functionality and the immediate value it provides. Elsawah ran the tool in a simulated environment, illustrating how it quickly scans a Google Workspace and generates a comprehensive report.

The core of the demo involved running the sleuthther command, which then proceeds to:

1. Authenticate with Google Workspace using the configured OAuth credentials.
2. Iterate through all users in the directory.
3. For each user, query their Google Drive for files marked as publicly shared.
4. Compile this information into a Google Sheet.

The resulting Google Sheet is the centerpiece of the demo. It presents the findings in a highly organized and actionable format:

• Tabs per User: Each user account found to have publicly shared files gets its own dedicated tab within the Google Sheet. This allows security analysts to quickly identify which individuals are responsible for the exposures.
• Direct File Links: Crucially, each entry in the report includes a direct, clickable link to the publicly shared Google Drive file. This eliminates the tedious manual lookup process required by Google's native Admin Console, enabling rapid investigation and remediation.
• File Metadata: The report also includes relevant metadata for each file, aiding in the assessment of its sensitivity and context.

Beyond the direct demonstration of the tool's output, Elsawah shared a compelling real-world proof of concept that occurred during Sleuthther's development. While testing an early web app version of the tool, he discovered a file titled "letter to academic institution" that he did not own and had no recollection of. Upon opening it, he found a detailed letter of recommendation containing another individual's name, occupation, the university they were applying to, and other sensitive personal information.

This discovery highlighted a critical, often overlooked, data exposure vector: file reuse. The executive coach, with whom Elsawah had previously onboarded using a shared public document template, had simply "control-A, deleted everything, and just started writing" a new sensitive document into that same publicly shared file. Because Elsawah still had editor access, he could view the entire version history, confirming the coach's actions.

Elsawah responsibly disclosed this finding to the executive coach, demonstrating not only the tool's effectiveness in uncovering hidden risks but also the importance of ethical security research. This incident served as a powerful validation of Sleuthther's utility, proving that even seemingly innocuous user behaviors can lead to significant data leaks that traditional tools fail to detect.

Defensive Implications

▶ Watch: The origin story and inspiration for building the tool (7:00)

Sleuthther provides invaluable insights and capabilities that have profound defensive implications for organizations utilizing Google Workspace. Security teams can leverage this information to implement a multi-layered defense strategy:

1. Proactive Discovery and Remediation: The most immediate implication is the ability to proactively discover publicly shared Google Drive files that pose a risk. Defenders should run Sleuthther regularly (e.g., daily or weekly) to identify new exposures. The generated report, with its direct links and user-specific tabs, enables rapid investigation and targeted remediation by either revoking public access manually or, in the future, through automated lockdown features.
2. Reinforce Technical Controls: While Sleuthther helps identify existing problems, it also highlights the need for stronger preventative technical controls. Organizations should:

• Restrict Sharing by OU/Google Group: Implement Google Workspace policies to restrict public sharing by default for most Organizational Units (OUs) or specific Google Groups, especially for departments handling highly sensitive data like Finance or HR. Exceptions can be made for groups like Sales and Marketing, but with additional oversight.
• Audit OAuth Tokens: Regularly audit all OAuth tokens granted within the Google Workspace. Elsawah noted his desire for a feature to "blow away dangerous OAUTH scopes that have been granted." This is crucial for managing third-party application access and ensuring least privilege.

1. Enhance User Education and Awareness: The "interesting story" about file reuse underscores the critical need for continuous security awareness training. Users must be educated on:

• The meaning of public sharing icons.
• The risks of reusing existing documents for new, sensitive content.
• Best practices for creating new files versus modifying existing ones.
• The importance of reviewing sharing settings before sharing any document.

1. Implement Automated Data Classification (Future): Elsawah's vision for AI classification is a significant defensive leap. By automatically flagging files containing PII, financial data, or confidential meeting minutes, organizations can prioritize remediation efforts and reduce the burden on human analysts, who currently face the ethical dilemma of reviewing potentially sensitive content. This also helps in scaling the detection process.
2. Expand Scope Beyond Drive: The talk touches on other Google Workspace vulnerabilities like public calendars and email forwarding rules. Defenders should consider broadening their auditing scope to these areas, integrating them into a holistic Google Workspace security posture management strategy. Public calendars, for instance, can reveal sensitive meeting details or PII.
3. Leverage Dry Run Capabilities: When implementing automated remediation, the dry run mode is critical. Defenders should always test the impact of automated permission changes before deploying them in production to avoid unintended consequences or disruption to legitimate business operations.
4. Consider File Lifecycle Management: The idea of automatically revoking permissions for files older than 90 days (or another defined period) is a powerful defensive strategy. Many older files are forgotten but remain publicly accessible, serving as long-tail risks. Implementing a file lifecycle policy can significantly reduce the attack surface.

By adopting these defensive strategies, organizations can move from a reactive stance to a proactive one, significantly reducing their exposure to accidental data leaks within Google Workspace.

Key Takeaways

• Publicly shared Google Drive files are a critical and pervasive data exposure risk, often containing highly sensitive information like PII, financial documents, and confidential business data.
• Google's native Admin Console is inadequate for comprehensive security auditing of these exposures, lacking user-friendly interfaces, direct file links, and efficient reporting capabilities.
• Custom tools like Sleuthther, built using Google Workspace APIs, provide superior visibility and actionable intelligence, empowering security teams to identify and manage these risks effectively.
• Careful management of OAuth scopes is paramount when developing and deploying such tools, balancing functionality with the principle of least privilege to mitigate the risks associated with broad access permissions.
• User education on file sharing and reuse is crucial, as inadvertent actions (like reusing public document templates for sensitive content) can lead to significant data leaks that technical controls alone may not prevent.
• Future advancements, particularly AI-driven classification, hold promise for automating the identification of sensitive content without requiring human security analysts to directly view confidential information, enhancing scalability and privacy in security operations.

About the Speaker(s)

Ayman Elsawah is the Head of Security at Ambience Healthcare. He is a passionate advocate for community and continuous learning in the cybersecurity field. Ayman is the host of the podcast "Getting into InfoSec," where he interviews professionals about their diverse paths into the security industry, aiming to inspire and guide aspiring individuals. He is also the author of a book that serves as a practical guide for those looking to enter the field. Beyond his professional roles, Ayman maintains a Substack where he shares insights on security leadership, essays, and guides, with over 120 articles published. A self-proclaimed "coffee nerd," he is always happy to discuss single-origin brews and specialized coffee varieties. Ayman has a deep appreciation for the BSides SF community, having volunteered and attended the conference for many years.