Red-team lab / Case files / The shared doc

The shared doc

Google Bard (now Gemini) · November 2023

Case file

In 2023 Bard gained extensions that let it read a user's Gmail, Drive and Docs. Johann Rehberger, with Kai Greshake and Joseph Thacker, showed that a Google Doc shared with the victim could carry instructions that Bard followed when it read the doc: write a Markdown image whose URL contains the earlier conversation. When the chat displayed the image, the browser sent that data out. Google's Content Security Policy only allowed images from Google domains, but Google Apps Script runs on one, script.google.com, so a script there could receive the data.

How it was built:

  • Extensions let Bard read the user's Docs, including docs others shared with them
  • Bard's replies are Markdown, rendered in the browser, images included
  • A Content Security Policy limits images to Google domains

What happened next: Google fixed the issue after the report. The write-up was published in November 2023.

Sources:

Phase 1Spot it

Flag the events that are part of the attack: where the instructions came in, and where the data went out. External sharing and image loads are normal on their own.

Activity for one user's Bard sessionReconstructed
0 flagged

Phase 2Stop it

Each chain below shows how the incident unfolded. Break every chain at some step, within a budget of 2, and keep the service running.

The chat leaks through an image URL

  1. An outsider shares a doc that carries instructions
  2. Bard follows them while reading the doc
  3. The reply contains an image whose URL holds the chat
  4. The browser loads it from an allowed Google domain
Cost 0 / 2

Logs are reconstructions: names, times and most wording are invented to match the documented pattern, except lines marked "as reported". Which controls stop which step is a teaching model based on common judgement, not a measurement. Points: 100 when both phases pass first time, 10 less per failed submission.

Built with Llama