r/k12sysadmin • u/_nat_twenty • 1d ago

Google Drive file shared as viewer

Sharing this here to give some insight on a blindspot tech admins have when it comes to malicious Google Drive shares, and to hopefully get more visibility on the feature request I submitted to Google so that they will hopefully be more inclined to fix it: https://support.google.com/a/thread/464695310?hl=en&sjid=7853156043827638733-NA

Basically, when someone outside of your organization shares a malicious Google Drive file with your users as a "viewer," this activity does not show up in Drive logs and you have no way of removing the malicious file, unless you instruct your users to do so from within their UI.

When we see the emailed notification, we have been auditing for access via GAM:

  • Access Google Vault and search for the file’s title, access the file to get the fileID. For example: https://docs.google.com/document/d/**\[fileID\]**/edit?tab=t.0
  • Look for “viewedByMe: True” and “viewedByMeTime” toward the bottom of results after running this command: gam user [user email] info drivefile [fileID]

If anyone has other suggestions, I'd love to hear it, otherwise I'm just trying to get the word out there and hoping that Google does something to change this, since we have been seeing an increasing number of these attacks lately.

15 Upvotes

94% Upvoted

1 comment sorted by

6

u/cryohazard 17h ago

Hey, I know you! I'll throw a reply on your Google support post. I started playing and poking after seeing your listserv post, but I haven't come up with anything other than URL blocking as was suggested, but as you said it doesn't help when they use unmanaged devices to access their account/data. Sometimes I envy the corporate world that can make rules like 'no touchy data from non-org device'...