BSidesSF 2026 - Google Drive Hunter: Building the Tool Google Should’ve Built (Ayman Elsawah)

All right. Thank you. Hi, everyone. How's it going? I cannot see you. I'm blinded by this light. But I see some faces. So thanks for having me. So thanks for coming to my talk. Today, I'm talking about Sleuther. So it was called Google Drive Hunter, but I decided to change the name just to avoid any license issues. And it's kind of in line with this web app I've been playing with as well. And it's a cool name. So there you go. So today we're going to talk a little about, I'll introduce myself, and then we'll also talk about the problem of shared drive files, and what kind of inspired me to build this tool. 1:15 And it was a really fun summer with Cloud Code, just to give you a little preview. And then an interesting story that came up during the time that I was building the tool and just playing around. And then what's in store in the future, and then happy to take some questions at the end. This is the only white slide. So my name is Ayman Elsawah. I'm the head of security currently at Ambience Healthcare. And we are hiring. We're looking for staff security engineers and a really super duper technical IT automation person. 1:47 So if you fit the bill, then please get in touch. A little about myself, too. I also started a podcast previously called Getting Into Infosec. And what I would do is I'd interview people how they got into security because there is no one direct path into security. So the idea was to help inspire and encourage other folks out there trying to get into the field. So that's that. And then I also wrote a book where if we sat down for coffee, which I'm a bit of a coffee nerd, you'll see in a second, this is what I would say. 2:18 It's filled with homework and a little bit of a guide of, you know, if we had a chat for about an hour, this is what we'd go over. And like I said, I'm a little bit of a coffee nerd. This was my set on the left here previously. This is from this morning. So it's, you know, it's getting a little out of control. I've stopped the bar at roasting. I have not started roasting yet. But if you ever want to have a conversation about single origin or Gujis or even a Geisha, I'm definitely happy to have that conversation. I also have a sub stack where I talk about security leadership. 2:52 And I go over some guides. I have some essays, rants, whatever you may call it. And, you know, it's over 120 articles on there. Feel free to check that out. And you can find me at Coffee with Ayman everywhere. And that's a little Turkish coffee I had this morning. Just a little note, I might be over-caffeinated and lack of sleep. So forgive me if I'm all over the place today. And this is a musical. You know, I was going to sing, but I decided not to, just to spare you from anything. 3:25 Besides NSF, you know, besides SF has a really warm place in my heart. You know, over the years, I've been coming here for so long. I made some really good friends over the years. And I just love the community and I want to encourage you to volunteer if you can. I've done my share of volunteering. It's really fun. If you volunteer for safety, you get a cool orange shirt. I don't know if you still have the orange shirt these days, but it's really good. And it's just, you know, kind of want to give a little hand to the B-Sides community and the volunteers for making this possible. 3:55 So thank you. All right, so let's talk about the problem of shared drive files. You're here because you might have experienced this problem yourself in the future, in the past. So let's talk about it. This little icon right here is the bane of my existence, and it's probably yours as well. This little small little global internet friendly icon is just there, but you know, you see that on a document that might be quite sensitive, you kind of just alarm bells start ringing. 4:28 And so this is how this was born. You know, shared drive files are everywhere. They're everywhere. They're a bit of a nuisance. Listen, they have their purpose, okay? They have their purpose, but You know, there's an extent to that. And what's interesting is Google and Slack will conveniently share them publicly, you know, when you drop a message into Slack. So how many people have seen this before, right? Oh, would you like to share this with the world? You know, it's like, okay, no, please don't. 4:59 But honestly, that's how like half these things happen. When you talk to people, I've talked to them and they're like, I didn't know it was shared. How did that happen? And well, this is how it happens. Either directly or you've given someone else editor access that can also change permissions and they shared it. So it's kind of like a bit of a rabbit hole. So there are tons of examples. I've seen them all. I've seen invoices and contracts shared publicly with the world. 5:30 Sales quotes, okay. Pricing calculators, I mean, that's like competitive advantage. Offer letters with equity and compensation information board meeting minutes right that should be confidential even worse bank account numbers driver's license photos passports and more things i haven't you know i don't want to talk about it here but you know i've seen i've seen everything and they've all been shared publicly on the internet so it's a it's a big problem now 6:04 A little bit of a PSA, I'd be amiss by not telling you how to prevent this. You may or may not know how to prevent this, but it's relatively easy to prevent. You can restrict it by OU and Google Workspace. You could also restrict it by a Google Group. You create a Google Group as a security group. So if it's so easy, then why isn't it done? Well, for most cases, people don't know that this exists. Two, you may not have a full-time IT person there to help guide you. 6:39 Or three, it's kind of a scary thing to limit people from sharing things publicly, and so you might get fired if you enable this. And so that's I think the three reasons for most part people why they haven't done this. Now, sales and marketing are generally the biggest offenders. And so but they need that ability to do that. That's fine. I think some groups that don't need that ability or maybe finance or, you know, they have they handle some really sensitive information. 7:09 So I think coupling it Both with technical controls and some education can go a long way. And it's really important. I'm not going to talk about all the things you could do, but definitely we should try to not only put technical controls, but also educate folks on how to do it. But in the case that you can't, well, we have a tool to help do that. So how did this journey start, right? So we were kind of thinking, we're like, okay, we want to, you know, we found a publicly shared file. 7:40 We're like, oh, how many others are out there that meet this criteria? And so we're like, okay, let's find all the publicly shared files in our Google workspace. And so I started off with in Google admin, but if you've ever spent time in Google admin, it's, How do I say it? Ugly. It's just not, you know, really friendly. So, yeah, I see a lot of people nodding their heads. So, it's just not friendly. You know, God bless their hearts. You know, they try to do their best. 8:13 But, you know, it doesn't fit the bill. So yes, you know, so anyway, this is what it looks like, right? You try to run a search, you try to look for files, you get this, you get the resource ID, you know, that's a unique ID of the document, but what are you going to do with that? There's no like clickable link that you could open to see the information in the file. So Yeah, so that's that. And we all know that in Google Workspace, the real power is behind the API. 8:44 Many of you have used GAM before. GAM is great. And now they just released Google Workspace CLI, which is like finally, I don't know how many years later. So that's a thing now. But still, this was, you know, we're just trying to solve this problem and Google Workspace was not cutting it. Again, this is how it would look like. You know, it's just not really super clean. Yes, you can export to Sheets, but then what do you do with this information? Am I literally going to copy and paste the document ID so that I could, you know, find out what the file is? 9:17 No, no thank you. I'm not going to do that. So last summer I caught the vibe coding bug, and I'm looking for something to build. And so here we go. I'm like, oh, let's build something. And so I was like, OK, there has to be a better way. So let's put the requirements together. What do we want to do? We want something that's simple. We want something that's powerful, something like GAM, but gives me visibility into types of files, easy to run, like some command line tool that I could just run and automate, and obviously gives me the information I need, right? 9:51 So I could discern and figure out, hey, do I need to pull this off the internet or not? So let's talk about the journey of building this tool. So the pains of OAuth. So there is several APIs you have to enable in Google Workspace to get this to work. But as I was having conversations with Claude to build this, it wanted all permissions. I'm like, no, no, don't do that. 10:21 Let's try to do something least privileged. And so, you know, I had to take a look at the OAuth scopes that are out there and how do we reduce the scopes to, you know, only what we need to do. And then I'm like, okay, well, do I want to actually revoke permissions? And, you know, do I trust a vibe coding tool to do this? And it was kind of scary. So, you know, you have to do some manual review and make sure you're not, you know, destroying all your Google Drive workspace files. And how do you back up all your workspace files? You know, that's not really a thing. 10:54 Yes, you can do that, but I didn't do that for my workspace. It was interesting. How do we do this in a safe way? So, you know, ran into these, you know, okay, let's go over what we need. We need to go through all users in the directory. So we need admin directory user and read only. We need drive read details, right? So that'll put people the metadata of a file to let you know if it's shared or not. 11:24 I want to create a drive for creating the sheets report. So yeah, that's good. The most risky one is like drive. It's just like drive means like full drive access to all files in your workspace. That is a really, really, really risky thing to ask for. But unnecessary evil that you have to do to remove permissions. And then the sheets API to create and edit sheets. So I ran into quite a few challenges building this tool. 11:56 The fact that you have to enable an API in a project was not super clear to me when I was doing it. So I spent a lot of time troubleshooting and dealing with errors. But once I figure it out, I'm like, okay, I don't want anyone else to go through this problem again. And, you know, I don't want to tell them RTFM and whatever it may be. So let's add some error corrections in there and kind of make it so that it's easy to use. Again, what's the North Star here? We want to make it easy to use and doable, right? So I added some error correction. When you run the tool the first time, it's going to give you an error that's intended. 12:31 And it's going to give you a link to... Hop straight into your project and enable three apis once you do that everything's going to be nice and clear so yeah so i just wanted to build that make it kind of really user friendly Yeah, again, what else we want to make it? We want to audit all users. So we want to go over all users in the workspace. I did add a dry run mode for lockdown because, hey, what's actually going to happen? 13:03 I think I need to do some updates. We'll talk about some future updates, but I want to tune lockdown a little more. You could do it by how many days a file has been out there. And that's actually a good... A thing to consider like how many files are out there that have been out there for more than six months that you really need that people are still using not many from what i've noticed so sometimes it's safe to just say hey any file over 90 days just blow it away right so that's that's kind of like what i found in my in my research and then even when people leave at a startup a lot of people come and go so sometimes the file is not owned by anybody anymore 13:43 In the sheet, I want to have a tab for each user so that I could go by user and see what files are there. And obviously, I want a direct link to files. So I want to be able to see the file and see what the issue is. A little more on On a security person actually being able to access this file, it's kind of like an interesting conundrum. You're trying to find publicly shared files and they're available on the internet, but you really don't want to be seeing all these files, right? Should I be seeing this file? So it's interesting. 14:14 And that's where AI came in later to help with that. All right, so let's hop into the demo. And we're in a theater, so I decided to put theater music. 15:07 And these are all the shared files that are out there.

And that's it. That's Sleuther in action. All right, so I did a lot of talking, but there's some more. So as I was building, I was building a web app version of this. And I was going through a bunch of different iterations and bugs. I'd find files shared with me or files maybe I didn't own or then shared drive files. 15:48 By the way, I had a Jiffy created of data So when I was running a search, I saw this and I was like, what is this? What is this file? Letter to academic institution. And you see on the left there is the owner. And it was not me. It was not me as the owner. I'm like, what is this file that was created in September? 16:22 I have no idea what this file was. And I opened the file, and inside the file... Let's see here. Inside the file... Was it was it was written by someone I knew so it was like an executive coach but it had a lot of detailed information about someone else it was like a letter of recommendation and I'm like what is this file why do I have this file here so I was concerned, but I was really confused as to how I ended up with this file. 16:55 It had the person's name and occupation, had the letter to university, how long they were working together, all this kind of stuff. It was kind of crazy. So what ended up happening was this file was used as kind of like, it was a public file that was shared when I was onboarding with her. And like, here's an onboarding document and how we could work together and all this kind of stuff. What ended up happening is she ended up reusing that same file. She just control, you just copied everything, deleted it, and just started writing into this file the letter of recommendation that she was doing. 17:32 And I'm like, oh my God, are you serious? So yeah, I mean, that's like taking recycling and reuse to like another level. I mean, just create a new file. So it was interesting. And I just kept like, luckily there was a virgin history because I had editor access as well. So. So, you know, convenient. And that's how I came to this. I'm like, okay, well, I need to tell her this. I need to responsibly disclose this. So I wrote this letter. It took a while, but I was like, you know, first of all, you see this, you're like, you know, you're kind of shaking. 18:05 I was nervous. I'm like, why do I have this? I'm like, okay, so I just hop into like, you know, security mode and write this letter. And I was pretty proud of it. I kind of wrote this whole letter. I'm like, hey, by the way, just not to be alarmed, but I have this file and I don't think I should have it. And, you know, I tried to take, you know, try to let her down easy. And I said, yeah, I know this may be disconcerting for you, but it could have been worse. So, you know, I tried to let her down easily. And I got this message back. 18:35 She's like, oh. And she was happy that at least it came from me, like a former, former, former client. So, you know, she removed access and it was done. It was, it was interesting learning lesson. But, you know, she felt pretty horrible receiving it. But at least the security person found it, right? So, yeah. And that's, that's it. That's, that's the story. A little in the future. I want to put AI classification of files. Why? 19:06 Well, the idea is that I don't want to see these files. I don't want to go and look into your offer letters, look into your board minutes, look at passport photos. I don't want that. I don't want to see all that information. And if it's a security analyst running, I don't want them to see it necessarily. So why don't we have AI classification, just go and kind of try to classify it. It's not as easy as it sounds, and I'm playing with that right now. I have a branch that's playing with that right now. 19:37 I'm trying to put either a local model option as well, or just send it to using an API. I want to email users on my behalf, so just get an email saying, hey, by the way, this file was found. That way people can just self-remediate. I think that's always the easiest thing to do. I also want to like, you know, the whole experience with OAuth tokens. I'm like, hey, what other OAuth tokens are out there in my workspace? And can I blow them away? So really would like to just run a OAuth token search and just blow away dangerous OAuth scopes that have been granted. 20:13 So that'd be nice. And users with public calendars, that's a thing. Sometimes people's calendars are actually publicly available out there, and you could see, obviously, a lot of sensitive information there. Also, people sometimes have email forwarding enabled, so basically an all-purpose tool to help secure Google Workspace in a way, but in a simplistic fashion where possible. So that's pretty much it. 20:44 And this is where you can find Souther and where you can find me online. And thank you.

So I don't know if you mean like Gemini actually sharing or Gemini finding the files.

That's a good question. Well, Gemini is not included with all Google Workspace accounts, but if I could have Gemini find the files, that could be good, but I'm not sure if Gemini has that capability at the super admin level. I think it's only more for your own files, so I wouldn't know how to answer that question, but come see me afterwards and we could have a discussion.

Yeah, yeah. So it's default read-only. So the lockdown or revoke permissions is not enabled by default. So when you run the, as you saw in the demo, it's read-only by default. So it'll go through all the users in your workspace and find the files, and then you could decide what to do after that.

Yeah, I mean, I encourage everyone to write their own if you don't find the functionality in the software you're looking for. So, you know, I think the big hero of this talk was cloud code, really, and just vibe coding in general. The fact that I could write a tool like this as a busy professional is a lot. So I encourage it, if anything, just to learn. Just to learn more about what works under the hood and how to get things to work at scale. 23:13 So yeah, totally.