Péssima notícia para o Google, que sofreu uma enorme violação de dados que expôs os dados privados de mais de 500.000 utilizadores do Google Plus via apps terceiras.
Como conseqüência da exposição de dados, a empresa vai desligar a rede de social do Google+.
A causa principal da violação de dados é uma vulnerabilidade de segurança que afeta uma das APIs do Google+, e que permite que developers terceiros acedam a dados de mais de 500.000 utilizadores.
Os dados expostos incluem nomes de utilizadores, endereços de e-mail, ocupação, data de nascimento, fotos de perfil e info sobre o seu género.
“Google exposed the private data of hundreds of thousands of users of the Google+ social network and then opted not to disclose the issue this past spring, in part because of fears that doing so would draw regulatory scrutiny and cause reputational damage, according to people briefed on the incident and documents reviewed by The Wall Street Journal.” reported the Wall Street Journal.
“As part of its response to the incident, the AlphabetInc. unit on Monday announced a sweeping set of data privacy measures that include permanently shutting down all consumer functionality of Google+.”
O Google anunciou que os seus investigadores resolveram imediatamente essa vulnerabilidade em março de 2018 e que não encontraram evidências de que algum developer tenha explorado a falha para aceder os dados dos utilizadores indevidamente. A falha estava presente nas Google+ People APIs desde 2015.
“We discovered and immediately patched this bug in March 2018. We believe it occurred after launch as a result of the API’s interaction with a subsequent Google+ code change.” reads a blog post published by Google.
“We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API.”
“A memo reviewed by the Journal prepared by Google’s legal and policy staff and shared with senior executives warned that disclosing the incident would likely trigger “immediate regulatory interest” and invite comparisons to Facebook’s leak of user information to data firm Cambridge Analytica.” continues the WSJ.
O Google manterá o Google+ somente para utilizadores corporativos a partir de agosto de 2019.
Google also provided information about the Project Strobe program that has seen a privacy internal task force conducting a companywide audit of the company’s APIs in recent months.
“In a blog post on Monday, Google said it plans to clamp down on the data it provides outside developers through APIs. The company will stop letting most outside developers gain access to SMS messaging data, call log data and some forms of contact data on Android phones, and Gmail will only permit a small number of developers to continue building add-ons for the email service, the company said.” concludes the WSJ.“The coming changes are evidence of a larger rethinking of data privacy at Google, which has in the past placed relatively few restrictions on how external apps access users’ data, provided those users give permission. Restricting access to APIs will hurt some developers who have been helping Google build a universe of useful apps.”
One Reply to “Google Plus – Leak de mais de 500.000 utilizadores”