> merely an unexploited vulnerability
The footnote there is, unexploited in the last 2 weeks they had logs for. They have no way of knowing if it was exploited earlier than that.
They would also have logs of any further attempts to exploit the vulnerability after it was found. I haven't seen anyone mention that. Although it's still no definitive proof, it can be useful corroborating evidence. (I left Google years ago, so I have no insider knowledge about the issue.)
A source would be great if there is one.
Straight from their announcement https://www.blog.google/technology/safety-security/project-s...
> We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API.
> We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused.
thank you
I don't know about "2 weeks" but it was clear from Google's announcement that they had no idea. I remember this, because it was posted on an HN thread where the poster claimed it was "unexploited" so I went in expecting that, and Google's own words made it clear they had no idea.
Re:The death of Google
by disfadbish on Tuesday October 09, 2018 @08:26PM
(#18180963)
Google has WAY more than 2 weeks worth of logs. When I was there having 90 days of live logs was the norm with very few exceptions. Anything older wasn't "live" but pretty easily accessible if you can get the resources approved.
Re:The death of Google
by michaelermer on Tuesday October 09, 2018 @04:16PM
(#18179462)
They don't tell if it was exploited, all they said was "we have no logs".
Google has done a great job of spinning this as "unexploited". The reality of it is (if you take them at their word and believe they only kept 2 weeks of logs "because privacy", which is suspicious for a company that thrives on data collection), they have no idea whether or not it was exploited.
People keep calling it a breach, but I thought it was merely an unexploited vulnerability? I may have missed it, but did it come out that there was a breach as well?