Google Plus to shut down after massive data leak

Coding error found to have exposed half a million accounts after Project Strobe API review

Google is shutting down Google Plus after it not only failed to gain traction with people happier with the likes of Facebook and Twitter, but also because it discovered a massive data leak affecting up to half a million users.

In a blog post, Google said that after a major security review, dubbed Project Strobe, the social networking service would close. The review found a sizable flaw in Google Plus APIs that meant malicious apps could extract data such as the name, email address, occupation, gender, and age from a person's profile.

"It does not include any other data you may have posted or connected to Google+ or any other service, like Google+ posts, messages, Google account data, phone numbers or G Suite content," said Ben Smith, Google Fellow and vice president of engineering.

Smith said that "the Profiles of up to 500,000 Google+ accounts were potentially affected." However, Smith added that the API's log data is only kept for only two weeks and analysis showed that up to 438 applications may have used this API.

"We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused," Smith said. 

Google's Privacy & Data Protection Office reviewed this issue to look at the type of data involved to see if the firm could accurately identify the users to inform, whether there was any evidence of misuse, and whether there were any actions a developer or user could take in response, according to Smith.  "None of these thresholds were met in this instance," he said.

Smith said that despite Google's engineering teams putting in a lot of effort, "it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds."

Google Plus will come to an end for consumers next August, but business users will still be able to use the service as an internal corporate social network.

The firm has also promised to institute new security rules, including limits around the types of use cases that are permitted to access consumer Gmail data.

"Only apps directly enhancing email functionality - such as email clients, email backup services and productivity services (e.g., CRM and mail merge services)will be authorised to access this data," Smith added.

Google will also remove access to contact interaction data from the Android Contacts API within the next few months. In addition, Google Account permissions dialog boxes will be spilt to show each requested permission, one at a time, within its own dialog box.

Featured Resources

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Simplify cluster security at scale

Centralised secrets management across hybrid, multi-cloud environments

Download now

The endpoint as a key element of your security infrastructure

Threats to endpoints in a world of remote working

Download now

2021 state of IT asset management report

The role of IT asset management for maximising technology investments

Download now

Recommended

What is DevSecOps and why is it important?
Security

What is DevSecOps and why is it important?

30 Oct 2020
Weekly threat roundup: NHS COVID-19 app, Nvidia, and Oracle
Security

Weekly threat roundup: NHS COVID-19 app, Nvidia, and Oracle

30 Oct 2020
Ryuk behind a third of all ransomware attacks in 2020
Security

Ryuk behind a third of all ransomware attacks in 2020

29 Oct 2020
REvil hacking group says it has made more than $100m in a year
Security

REvil hacking group says it has made more than $100m in a year

29 Oct 2020

Most Popular

Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

21 Oct 2020
What is Neuralink?
Technology

What is Neuralink?

24 Oct 2020
Hackers demand ransom from therapy patients after clinic data breach
Security

Hackers demand ransom from therapy patients after clinic data breach

27 Oct 2020