# Author spoofing in Google Colaboratory

Google Colaboratory's execution warning names the document owner as author; transferring ownership to the victim spoofs the warning, tricking them into running malicious code.

- Payout: $500
- Severity: medium
- Program: Google
- Credited: Zohar Shachar
- Disclosed: 2021-06-09
- Write-up quality: 6/10
- Original: https://www.ehpus.com/post/author-spoofing-in-google-colaboratory
- Library page: https://bugbountylibrary.com/r/blog%3Aehpus-com-post-author-spoofing-in-google-colaboratory
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium technique:source-review vuln:business-logic

**Target:** Google Colaboratory notebook execution warning
**Root cause:** The warning identifies the 'author' as the current document owner, but ownership can be transferred to any contributor, allowing an attacker to set the victim as owner and spoof the warning.
**Steps:**
1. Create a new Colaboratory notebook with malicious code.
2. Share the notebook with the victim as a contributor.
3. Using Google Drive, change the notebook owner to the victim.
4. Send the notebook link to the victim; the execution warning now shows the victim as author, so they run the code.
**How found:** Researcher questioned who the 'author' in the warning refers to, realized it must be the document owner, and then noted that Google Drive allows ownership transfer to any contributor.
**Exploitation:** Attacker creates a malicious notebook, shares it with the victim, transfers ownership to the victim via Google Drive, and sends the link. The victim sees a warning that they are the author and executes the code in their own environment.
**Insight:** Security warnings that rely on mutable metadata (like document owner) can be spoofed; always check if the displayed identity can be changed by the attacker.