G Suite apps that have access to Drive and Gmail data found communicating with undisclosed external services.
June 2, 2020 By Catalin Cimpanu
In research presented last month, security researchers said that many of the apps listed on the G Suite Marketplace have access to users' Gmail and Drive accounts, but also communicate with undisclosed external services, creating the opportunity for secret data exfiltration from Google accounts.
The research, carried out by Irwin Reyes and Michael Lack of Two Six Labs, analyzed the permissions requested by third-party Google apps listed on the G Suite Marketplace.
Reyes and Lack said they used an automated script to install all the 1,392 apps listed on the G Suite Marketplace on January 2, 2020, on a test Google account and then record the permissions each app requested.