Blog

Use G Suite To Kill Dangerous Permissions From Third Party Apps

A whole class of stealthy security vulnerabilities has already invaded your organization. And your users are adding them every single day.

Third party applications can have dangerous permissions that suck confidential information from your email, documents and databases — and you can’t even see it happening.

But you have a secret weapon to kill these dangerous permissions.

What are Permissions and Third Party Applications?

Google intentionally made it very easy to integrate non-Google applications and services with Google products, so users could access features and functionality built by third-party software developers. This is true on both the consumer side (think Gmail) and business side (G Suite). There is a lot of crossover between these two sides. For example, Drive, Docs, Sheets and Calendar are available to people using Gmail or G Suite. While there are some differences, the similarities make for a very familiar experience on both sides. Partly because of that familiarity, users are quite comfortable integrating third-party applications with Gmail, Chrome, G Suite and the full array of Google products. And they do it simply by logging in with their Google accounts. It’s easy to integrate a third-party app. And with thousands of them in the Chrome Web Store, there is an app for everything… After selecting the application and clicking or pressing Add To Chrome, a screen appears, showing the permissions the app is requesting.

Why Permissions Can Be Dangerous

Permissions allow the third-party application to access the connected Google or G Suite Account, in a variety of ways. There are 3 broad levels of access:

  1. View your basic profile information
  2. Read from and write to your profile data
  3. Full account access

Viewing basic profile information is an extremely common permission requested by third-party applications. But details such as name, email address and country are typically not dangerous. Full account access is rarely requested, because it is rarely necessary, attracts scrutiny by the Google reviewers, and is likely to be noticed and reported by concerned users. The middle tier of read and write access is where most of the security vulnerabilities lie. It seems clear that allowing an application to read data is less risky than is writing data. But even reading data can — and should — raise concerns.

Examples

WiseStamp is one of many popular extensions that adds an attractive HTML signature to a user’s email messages. But look at the permission: read and change all your data on the websites you visit. That means that the application is, or could be, examining every website you visit, certainly including your Gmail and G Suite email account pages, as well as every other page. And it is not limited to reading data; since its purpose is to add an HTML signature to your email, it has permission to write — and not just to Gmail or G Suite email. Suddenly this innocuous little helper app that makes pretty signatures is revealed to have vast permission scopes.Wizy.io is another helpful extension. Its permissions scopes extend to several other areas — all of them in line with what the application needs to access in order to deliver its functionality. But granting those permissions can be dangerous. Note that this is not to imply that WiseStamp or Wizy exhibit any nefarious behavior. They are simply two of the more-popular apps within popular and seemingly innocuous categories, illustrating that users may focus on the benefits rather than the risks of any given third party application.

Take Control of the Situation

Being pragmatic, it doesn’t matter whether a software developer is actively deceiving users, or is allowing data leaks by mistake. Either way, the user is compromised. And if we are talking about a G Suite user, the damage can extend across the entire companyImagine a single user — say a sales manager — installing an application that grants permission to read contacts. That application now has access to every single customer record, with all kinds of detail about status and history. Would anyone even know this was happening? If someone did know, would they judge the benefit to be worth the risk? The first step is to get visibility into the fact that this is happening.

The second step is to make the judgment call about risk and reward.

The third step is to kill any dangerous permissions.

How to Find and Kill Dangerous Permissions

Administrators can use the native interface within G Suite to find and remove dangerous permissions. To do so:

  1. Log into the G Suite admin console
  2. Select Users
  3. Select a user
  4. Select Show More
  5. Select Security
  6. Review the list of third party applications and their associated permissions
  7. Select the Revoke button to the right of the application in question to revoke that application’s permissions

Unfortunately, the native G Suite admin console is quite limited. It allows only very poor searching and filtering, and it is clumsy because it requires so many steps to remove even a single application from a single user.

Administrators who want more visibility and control can use Alpin. Quick and easy to use, Alpin can search across all apps, users and permission types to find and neutralize the highest-risk vulnerabilities.

Keep your organization safe — G Suite and Alpin are secret weapons to close those security holes!

Alpin is now CoreSaaS.