Google Exposed User Data, Feared Repercussions of Disclosing to Public

Re:Google Exposed User Data, Feared Repercussions of Disclos... by tyingq on Monday October 08, 2018 @05:17PM (#18171390)

"Logs show that it has never been used by anyone"

Is it 100% confirmed that the logs would show it?

What they said was "We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused."

That seems only to say they couldn't find anything. Not that it absolutely didn't happen.

[ Parent | on HN ]

Re:Google Exposed User Data, Feared Repercussions of Disclos... by fauigerzigerk on Monday October 08, 2018 @06:19PM (#18171814)

>Is it 100% confirmed that the logs would show it?

The answer is clearly no as they only had two weeks worth of logs out of the three years during which this bug has existed. Here's what they're saying:

"We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. However, we ran a detailed analysis over the two weeks prior to patching the bug [...]"

https://blog.google/technology/safety-security/project-strob...

[ Parent | on HN ]

Re:Google Exposed User Data, Feared Repercussions of Disclos... by jacquesm on Monday October 08, 2018 @05:44PM (#18171593)

You can't prove a negative. All you can do is hope that your logs are not tampered with and that they show that nobody used the hole that you are aware of.

[ Parent | on HN ]

Re:Google Exposed User Data, Feared Repercussions of Disclos... by yebyen on Monday October 08, 2018 @06:37PM (#18171924)

I don't know how you could prove whether anyone exploited this or not, unless you found a breach list posted on the open internet... even if you had the access logs:

> This data is limited to static, optional Google+ Profile fields including name, email address, occupation, gender and age. (See the full list on our developer site.) It does not include any other data

This is such a bogus statement out front. The first time I read it, I didn't even see "the full list" mentioned. The full list is much longer than this seemingly innocuous list of properties of a person. It includes such gems as:

> A list of places where this person has lived.

> A list of email addresses that this person has,

> The hosted domain name for the user's Google Apps account.

It's a little worse than they painted it to be, maybe not much, but at least they're being transparent, I guess...

[ Parent | on HN ]

Re:Google Exposed User Data, Feared Repercussions of Disclos... by jacquesm on Monday October 08, 2018 @06:39PM (#18171928)

That's sort of the point. You can only prove positively that a breach has been exploited because there can be proof of that. But there can never be 100% ironclad proof that it wasn't exploited.

[ Parent | on HN ]

Re:Google Exposed User Data, Feared Repercussions of Disclos... by tyingq on Monday October 08, 2018 @07:34PM (#18172206)

Well a little bit of detail as to whether exploiting this bug even creates a log entry might be interesting.

[ Parent | on HN ]

Re:Google Exposed User Data, Feared Repercussions of Disclos... by jacquesm on Tuesday October 09, 2018 @02:30AM (#18173750)

If it does not they have other problems.

[ Parent | on HN ]

Re:Google Exposed User Data, Feared Repercussions of Disclos... by ocdtrekkie on Monday October 08, 2018 @06:16PM (#18171800)

It is, in fact, far worse than ucaetano portrays it: They don't have logs for it, and hence, have no way to know whether it was used or not. Google had the two preceding weeks of logs, out of the three plus years the vulnerability existed.

[ Parent | on HN ]