4 ms·

> merely an unexploited vulnerability The footnote there is, unexploited in the last 2 weeks they had logs for. They have no way of knowing if it was exploited

> merely an unexploited vulnerability The footnote there is, unexploited in the last 2 weeks they had logs for. They have no way of knowing if it was exploited earlier than that.

foobiekr 8y ago
A source would be great if there is one.
- rconti 8y ago
  I don't know about "2 weeks" but it was clear from Google's announcement that they had no idea. I remember this, because it was posted on an HN thread where the poster claimed it was "unexploited" so I went in expecting that, and Google's own words made it clear they had no idea.
- deleted 8y ago
  [deleted]
- kenhwang 8y ago
  Straight from their announcement https://www.blog.google/technology/safety-security/project-strobe/ https://www.blog.google/technology/safety-security/project-s... > We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API. > We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused.
  - foobiekr 8y ago
    thank you
puzzle 8y ago
They would also have logs of any further attempts to exploit the vulnerability after it was found. I haven't seen anyone mention that. Although it's still no definitive proof, it can be useful corroborating evidence. (I left Google years ago, so I have no insider knowledge about the issue.)
disfadbish 8y ago
Google has WAY more than 2 weeks worth of logs. When I was there having 90 days of live logs was the norm with very few exceptions. Anything older wasn't "live" but pretty easily accessible if you can get the resources approved.

> merely an unexploited vulnerability The footnote there is, unexploited in the last 2 weeks they had logs for. They have no way of knowing if it was exploited earlier than that.

foobiekr 8y ago

A source would be great if there is one.

rconti 8y ago
I don't know about "2 weeks" but it was clear from Google's announcement that they had no idea. I remember this, because it was posted on an HN thread where the poster claimed it was "unexploited" so I went in expecting that, and Google's own words made it clear they had no idea.
deleted 8y ago
[deleted]
kenhwang 8y ago
Straight from their announcement https://www.blog.google/technology/safety-security/project-strobe/ https://www.blog.google/technology/safety-security/project-s... > We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API. > We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused.
- foobiekr 8y ago
  thank you

puzzle 8y ago

They would also have logs of any further attempts to exploit the vulnerability after it was found. I haven't seen anyone mention that. Although it's still no definitive proof, it can be useful corroborating evidence. (I left Google years ago, so I have no insider knowledge about the issue.)

disfadbish 8y ago

Google has WAY more than 2 weeks worth of logs. When I was there having 90 days of live logs was the norm with very few exceptions. Anything older wasn't "live" but pretty easily accessible if you can get the resources approved.