Story image

Google shutting down Google+ after covering up privacy bug

09 Oct 18

Google has announced plans to shut down its social media platform Google+ after the Wall Street Journal reported it failed to disclose to a bug that potentially affected 500,000 accounts.

The Wall Street Journal obtained internal memos showing that Google’s management was aware of the bug, but chose not to share it with the public to avoid scrutiny by regulators.

Soon after the article was published, Google engineering fellow and vice president Ben Smith disclosed the bug and Google’s plans to shut down Google+ in a blog post.

The post says that a bug discovered in one of the Google+ People APIs allowed users to can grant access to their profile data, and the public profile information of their friends, to Google+ apps, via the API.

The bug meant that apps also had access to Profile fields that were shared with the user, but not marked as public.  

This data is limited to static, optional Google+ Profile fields including name, email address, occupation, gender and age.

It does not include any other data users may have posted or connected to Google+ or any other service, like Google+ posts, messages, Google account data, phone numbers or G Suite content.

Google discovered and immediately patched this bug in March 2018. It believes it occurred after launch as a result of the API’s interaction with a subsequent Google+ code change.

Google+ API’s log data is only for kept two weeks, so it cannot confirm which users were impacted by this bug.

Google ran an analysis over the two weeks prior to patching the bug which showed the Profiles of up to 500,000 Google+ accounts were potentially affected.

Up to 438 applications may have used the API.

Google says it found no evidence that any developer was aware of this bug, or abusing the API, and it found no evidence that any Profile data was misused.

Smith says in the post that Google+ “has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps.”

“The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds.”

Smith also announced in the blog post that Google will be launching more granular Google Account permissions and tightening up security permissions accessible via its APIs. 

Webroot senior threat research analyst Tyler Moffitt says, “Although it seems that Google has shut down an entire line of business due to this breach, from a GDPR perspective, the company appears to have gotten off lightly.

“Had this breach occurred just a few months later, Google could be subject to strict GDPR fines for not keeping user data safe. 

“It's important for consumers to realise that connecting apps in social media platforms only increases the amount of valuable information that could potentially be breached, as well as increased attack vectors that hackers can leverage.

Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
Securing hotel technology to protect customer information
Network security risks increase exponentially as hotels look to incorporate newer technologies to support a range of IoT devices, including smart door locks.
Why total visibility is the key to zero trust
Over time, the basic zero trust model has evolved and matured into what Forrester calls the Zero Trust eXtended (ZTX) Ecosystem.