Researchers detail how they brute forced shortened URLs from OneDrive and Google Maps to access private information; Microsoft and Google respond
Andy Greenberg / Wired :
Context & Ripple Effects
This 2016 report by Andy Greenberg documents researchers enumerating shortened URLs to reach private OneDrive files and Google Maps data — an attack that works because 'secret' links rely on unpredictability rather than permissions. Read against the related coverage, it is the earliest entry in a long line of externally discovered access-control failures at Microsoft.
The pattern recurs across the corpus: researchers later found an Azure flaw that could expose Office 365 data via Bing search results, a GitHub repo leaking 38TB of AI-unit data including secret keys, and an exposed Azure server holding staff credentials for internal systems. Each time, disclosure came from outside the company, not from internal review.
First-order effects
- OneDrive and Google Maps users who relied on unlisted share links had private information reachable by anyone willing to enumerate URLs, forcing Microsoft and Google to issue responses and harden their link schemes.
Second-order effects
- Both companies face pressure to stop treating link obscurity as a security boundary — sharing features built on guessable tokens become liabilities that researchers can demonstrate at will, raising the cost of every 'secret link' design.
Third-order effects
- If the corpus-wide pattern holds, Microsoft's exposure problems are structural: permission boundaries enforced inconsistently across Azure, GitHub, and consumer services, with external researchers functioning as the company's de facto audit layer.
The trend: Cloud platforms are being pushed from obscurity-based link privacy toward explicit permission boundaries as researchers repeatedly demonstrate that enumerable identifiers defeat secrecy.