# Why Privacy? Well, Hackers just abused Google.

Source: https://simplifiedprivacy.com/google-sheets/hacked.html
Kiwi News: https://news.kiwistand.com/stories/Why-Privacy-Well-Hackers-just-abused-Google?index=0x66d611cc2e4864b773e8a6d9966ca495c27445710d67c145b2dbae70a73ca8058f130814
Submitted by simplifiedprivacy.eth on 2024-09-02 UTC, 3 upvotes, 0 comments

## Summary

Google Sheets has a new zero-day flaw, which is cited as another reason to abandon Google Workspace for Linux. The bug lets hackers mass-email by enabling a Python script to masquerade as a PDF on Windows, and hackers have used it to impersonate government officials in many countries. Bleeping Computer reports that Google Sheets serves as a command and control server for infected devices, and a similar technique was used by Chinese hackers a year earlier. Targets reportedly span insurance, aerospace, finance, healthcare and many other sectors.

## Article

New 0-day in negligent Google sheets that is YET ANOTHER reason to completely abandon their invasive Workspaces

Warning:

If the government emails you asking for money, I can finally legally advise you (for security purposes) to ignore them.

Negligent Vulnerability

Remote Code

There’s a new 0-day in negligent Google sheets that is YET ANOTHER reason to completely abandon their invasive Workspaces. The bug allows hackers to remotely mass email, by enabling a Python script to masquerade as a PDF on Windows, from Google sheets. [1][2] Hackers have been abusing this to impersonate government officials and ravage private businesses in many countries. And since use of their Workspace products is so common among many institutions, this has serious risks for stolen funds (on top of regularly scheduled government theft).

Command & Control

According to Bleeping Computer, “Google Sheets is used as a command and control server, pinging it to get new commands to execute on the infected device and as a repository for stolen data”. [2] This is surprising to see this type of attack has not been fixed, given that a year ago Chinese hackers abused Google Sheets as a command and control in a similar way. [4]

Rampant

Not only is it the government, but hackers are also targeting insurance, aerospace, transportation, academia, finance, technology, industrial, healthcare, automotive, hospitality, energy, media, manufacturing, telecom, and social benefit organizations. [1]

Windows Only

“Web Integrity”

The Google sheets bug is only able work if you’re using Microsoft Windows. Ironically, Google came under heat a year ago for trying to have Chrome force the operating system to attest that it’s a “secure environment” (called Web Environment Integrity API) [3], which would lock Linux users out of many services as there’s no company to verify identities.

Irony

But now, ironically Google sheets is only vulnerable on what they told us was the secure environment of Windows. Just imagine if Chrome’s plans to haze Linux had went through, how much worse this current situation would be.

So I once again urge you to transition to Linux. And: For your safety, please ignore emails from governments

The sources for this article can be found here

If you really want to learn and take your privacy to the next level, Learn about HydraVeil, Access our VPN, and subscribe to our new content via: Podcast, Email List, Nostr, Bastyon, RSS, or join the Signal Group