An overlooked vulnerability in Google Drive Desktop breaks foundational security principles.
The Unexpected Threat on Windows
When you think about Google Drive, you expect security, convenience, and zero-trust protection. Yet, I discovered a disturbing flaw in the Google Drive Desktop app on Windows: any user with privileged access can copy another user's Drive cache and suddenly gain full access to their files—without re-authenticating.
What’s Going On: The DriveFS Cache Leak
- DriveFS is the local cache directory used by Google Drive Desktop.
- On Windows, this cache is not isolated between users.
- By copying the victim’s DriveFS cache into your own profile, Google Drive Desktop loads their account just as if you were them.
- This meets none of the key security principles: no re-authentication, no encryption at rest, no zero-trust, and breaks data isolation.
Why This Matters
This is a textbook insider threat scenario:
| Risk | Description |
|---|---|
| Stealthy Access | Any user with privileged access on a shared device can view and exfiltrate sensitive documents. |
| Silent | No alerts; no extra authentication; access seems legitimate. |
| Compliance Violation | Fails to uphold standards like NIST, ISO 27001, SOC 2, Zero Trust frameworks, GDPR, HIPAA, and PCI DSS. |
Proof of Concept (PoC)
Tested on Windows 10/11 with Google Drive Desktop 112.0.3.0:
- Attacker logs into Drive Desktop.
- Close the app.
- Copy:
C:\Users\<victim>\AppData\Local\Google\DriveFS\<ID>\into:C:\Users\<attacker>\AppData\Local\Google\DriveFS\<ID>\ - Restart the Drive app.
- Voilà —attacker sees the victim’s Drive data as if it’s their own.
- Even pausing sync, “My Drive” remains accessible indefinitely.
What This Breaks
- Zero Trust principle: Trust is blind—any cache is accepted.
- Encryption at Rest: There’s none; caches are reusable across accounts.
- Session Management: No re-authentication required.
- Data Isolation: Violated. One profile’s cache loads in another.
- Standards Compliance: Out of alignment with NIST, ISO, SOC 2, GDPR, HIPAA, PCI DSS.
What Can Google Do?
- Encrypt DriveFS caches per user, tied to credentials.
- Enforce re-authentication when loading cached data.
- Apply OS-level ACLs to block cross-profile access.
- Allow admins to revoke or invalidate DriveFS caches remotely.
What You Can Do Now
- Avoid using Drive Desktop on shared machines.
- Clear DriveFS caches when switching users.
- Use separate, locked-down Windows profiles.
- Restrict the app to dedicated, managed endpoints only.
Final Thoughts
Security isn’t about what qualifies for a bounty—it's about protecting users. By ignoring zero-trust basics and leaving sensitive caches unprotected, Google Drive Desktop invites insider threats and compliance risks. Until this is fixed, risk lies with users and IT teams. The security community must demand better—because trust without verification is broken.
Would love to hear how others are protecting synced file systems in their environments—drop a comment below!
💡 This article is also available on Medium—feel free to share or discuss there as well.
Top comments (0)