Malware uses Google Docs as proxy to command and control server

Backdoor.Makadocs variant uses Google Drive Viewer feature to receive instructions from its real command and control server

Security researchers from antivirus vendor Symantec have uncovered a piece of malware that uses Google Docs, which is now part of Google Drive, as a bridge when communicating with attackers in order to hide the malicious traffic.

The malware -- a new version from the Backdoor.Makadocs family -- uses the Google Drive "Viewer" feature as a proxy for receiving instructions from the real command and control server. The Google Drive Viewer was designed to allow displaying a variety of file types from remote URLs directly in Google Docs.

"In violation of Google's policies, Backdoor.Makadocs uses this function to access its C&C [command in control] server," said Symantec researcher Takashi Katsuki, Friday in a blog post.

It's possible that the malware author used this approach in order to make it harder for network-level security products to detect the malicious traffic, since it will appear as encrypted connections -- Google Drive uses HTTPS by default -- with a generally trusted service, Katsuki said.

"Using any Google product to conduct this kind of activity is a violation of our product policies," a Google representative said Monday via email. "We investigate and take action when we become aware of abuse."

Backdoor.Makadocs is distributed with the help of Rich Text Format (RTF) or Microsoft Word (DOC) documents, but does not exploit any vulnerability to install its malicious components, Katsuki said. "It attempts to pique the user's interest with the title and content of the document and trick them into clicking on it and executing it."

Like most backdoor programs, Backdoor.Makadocs can execute commands received from the attacker's C&C server and can steal information from the infected computers.

However, one particularly interesting aspect of the version analyzed by Symantec researchers is that it contains code to detect if the operating system installed on the target machine is Windows Server 2012 or Windows 8, which were released by Microsoft in September and October respectively.

The malware doesn't use any function that's unique to Windows 8, but the presence of this code suggests that the analyzed variant is relatively new, Katsuki said.

Other strings from the malware's code and the names of the bait documents suggest that it's being used to target Brazilian users. Symantec currently rates the distribution level of the malware as low.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags symantecGooglesecurityDesktop securityspywaremalware

Struggling for Christmas presents this year? Check out our Christmas Gift Guide for some top tech suggestions and more.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?