US senator urges investigation into Google+ bug ‘coverup’

https://sociable.co/business/us-senator-google-coverup/

by egusa • 8 years ago

100 81 8 years ago

Sure. First hold Equifax accountable, then we'll talk about Google.

Half the job of a politician is to get re-elected. This is part of that half. There's outrage and standing up for the people against a big company. Someone will be dragged before Congress and get embarrassed publically. And then we move on.

DecayingOrganic• 8 years ago

This reminded me of a story:

In an op-ed promoting campaign finance reform, the Oracle of Omaha, Warren Buffett, proposed raising the limit on individual contributions from $1,000 to $5,000 and banning all other contributions. No corporate money, no union money, no soft money. It sounds great, except that it would never pass.

Campaign finance reform is so hard to pass because the incumbent legislators who have to approve it are the ones who have the most to lose. Their advantage in fundraising is what gives them job security. How do you get people to do something that is against their interest? Put them in what is known as the prisoners’ dilemma. According to Buffett:

Well, just suppose some eccentric billionaire (not me, not me!) made the following offer: If the bill was defeated, this person—the E.B.—would donate $1 billion in an allowable manner (soft money makes all possible) to the political party that had delivered the most votes to getting it passed. Given this diabolical application of game theory, the bill would sail through Congress and thus cost our E.B. nothing (establishing him as not so eccentric after all).

Consider your options as a Democratic legislator. If you think that the Republicans will support the bill and you work to defeat it, then if you are successful, you will have delivered $1 billion to the Republicans, thereby handing them the resources to dominate for the next decade. Thus there is no gain in opposing the bill if the Republicans are supporting it. Now, if the Republicans are against it and you support it, then you have the chance of making $1 billion.

Thus whatever the Republicans do, the Democrats should support the bill. Of course, the same logic applies to the Republicans. They should support the bill no matter what the Democrats do. In the end, both parties support the bill, and our billionaire gets his proposal for free. As a bonus, Buffett notes that the very effectiveness of his plan “would highlight the absurdity of claims that money doesn’t influence Congressional votes.”

This situation is called a prisoners’ dilemma because both sides are led to take an action that is against their mutual interest. In the classic version of the prisoners’ dilemma, the police are separately interrogating two suspects. Each is given an incentive to be the first to confess and a much harsher sentence if he holds out while the other confesses. Thus each finds it advantageous to confess, though they would both do better if each kept quiet.

From the book The Art of Strategy. Great book.

paulcole• 8 years ago

The only job of a politician is to get elected.

JumpCrisscross12• 8 years ago

This is part of that half

The other half, selling proposed legislation to one's own (and one's colleagues') constituents, involves the same process.

HillaryBriss• 8 years ago

whether rightly or wrongly, this is an East Coast Democrat taking a swipe at one of California's most important tax revenue sources. but California is the Democratic Party's heartland.

i'm not trying to make a political statement here, just an observation that the Democratic party is of two minds when it comes to tech nowadays. it didn't used to be this way. further evidence of an emerging political realignment.

JumpCrisscross12• 8 years ago

First hold Equifax accountable, then we'll talk about Google

They're both screw-ups. If someone breaks into your house, we don't say "first let's solve peace in the Middle East; then we'll talk about your house."

Something being second (or further down the list) doesn't mean it should be ignored. It's just another reason to look at the issue.

Google is more politically vulnerable than Equifax because more people know what it is. That makes it a better whipping boy for getting public support behind any resulting legislation.

darawk• 8 years ago

What Google did isn't even a scandal. The whole story is "Google fixes security bug". Companies fix bugs all the time without notifying anyone. This is the silliest non-story.

loceng• 8 years ago

Equifax is arguably a more serious breach, with more obvious problems in security - complete lack of forethought in security.

kurthr• 8 years ago

One is a known breach/leak which produced demonstrable harm. The other is a bug that can't be shown not to have been used past the stored logging.

One is the known burglary of your hotel room with your items for sale online. The other hotel used locks that could be bypassed, but only has security footage saved for the last month to show you weren't robbed then.

mirceal2• 8 years ago

Not a big Google fan (actually actively minimizing Google products use) but I do not agree with you. Having your SSN/all details about your credit history exposed is way way worse than having your google account compromised. People know what a credit bureau is as good or better than what google is. There should be real, measurable consequences to the Equifax leak (as in they should no longer be allowed to operate). As far as Google goes and how they choose to handle this: I for one think they should have closed the security hole, keep monitoring it and kill the service separately after a while. It does not look good for them that they did it in one go, but at the end of the day, you are free not use google.

mothers• 8 years ago

Please stop. Whataboutism is not helpful.

UncleEntity2• 8 years ago

Sure. First hold Equifax accountable, then we'll talk about Google.

Nah, first hold OPM accountable then we'll talk about the private sector.

knorker2• 8 years ago

So not only should companies have to publish hacks, they also have to publish when they internally find a bug?

Do I also need to publish if I left my keys in the door for two hours, but nobody broke in?

jstanley• 8 years ago

How do you know nobody broke in?

And if you're responsible for storing personal data for millions of people in your home, and you left the keys in the door for a few hours, and you can't prove that nobody broke in, then maybe you should let people know that there's a chance their data has been compromised.

orev• 8 years ago

Server logs are more or less equivalent the video recordings of the front door in this analogy. So the answer is you can know that nobody broke in by looking at the logs/recordings.

knorker2• 8 years ago

How do you know nobody broke in?

This applies to almost every security-related bug ever, so the analogy holds.

If you run a company with PII in your mysql, and mysql has a bug (not uncommon), are you now required to tell all your customers that someone may have hacked your database, and then erased the logs?

What if you irresponsibly didn't have a firewall (or your firewall allowed connections from business partners, to some non-PII tables)?

It's possible that between the time the bug was introduced (or made public), and the time you patched, that someone at your business partner stole personal information, and it's not feasible for you to in all cases know if this happened. No matter how good you are, it's not feasible in the real world.

And if you're responsible for storing personal data for millions of people in your home, and you left the keys in the door for a few hours, and you can't prove that nobody broke in, then maybe you should let people know that there's a chance their data has been compromised.

Maybe I should. And in this case, I did. But not right away.

But it's a long way from "maybe you should" to "you MUST (by power of law) IMMEDIATELY".

Read up on some "keys left in the door" scenarios about nuclear weapons security. We tend to not find out about those right away either.

JumpCrisscross12• 8 years ago

they also have to publish when they internally find a bug?

Has anybody actually proposed this? There are a lot of options between staying silent and public disclosure.

Klathmon3• 8 years ago

What are they? Because making a forced bugfix reporting system seems like pointless busywork if the public can't have access to it (and to be honest, it sounds pointless even if they do).

brandonmenc• 8 years ago

Do I also need to publish if I left my keys in the door for two hours, but nobody broke in?

You are not a giant company that stores the personal data of hundreds of millions of people. So, presumably, no.

TangoTrotFox4• 8 years ago

The thing that makes this unique is that Google is claiming that they have no idea whether the bug was used by third parties. In my opinion this already seems questionable. And it's a big deal whether true or false. If true it means that Google is likely engaging in questionable security practice by not even logging remote access to privileged information, if false it's far worse for them as it almost certainly means that they believe the information was accessed by unauthorized parties, and they then chose to lie about it.

tylerl• 8 years ago

No, Google is claiming that all of their evidence, including research and data gathering, shows that the bug wasn't known or abused, but for privacy reasons they only keep two weeks of logs, so that particular chunk of evidence (the server logs) doesn't cover enough time to be definitive.

tptacek15• 8 years ago

What an embarrassment. Blumenthal should leave the performative infosec policymaking to his colleague Ron Wyden.

It is not and never has been a norm for SAAS vendors to disclose internal vulnerabilities that have not been discovered independently by third parties. Tens of thousands are found every year by internal teams and contractors at companies around the country, many of them far more severe than the G+ bug (which would probably win a sev:low on a real assessment, less impactful than an XSS bug). You hear about none of them.

A coherent argument that this is as it should be: http://flaked.sockpuppet.org/2018/10/09/internal-disclosure-...

You can argue that things should be different for shrink-wrap software and hardware products, where vulnerabilities have a half-life and users need to be notified to patch. I won't disagree, but I will note that the norm of not disclosing internal discoveries holds there as well.

JumpCrisscross12• 8 years ago

Tens of thousands are found every year by internal teams and contractors at companies around the country

It's fair to say "Google followed current best practice." It's not fair to say "current practice is how it should always be."

What is acceptable for a company selling razors to Minessotans may not be for a behemoth with troves of personal data on every American. The question, "should Google have heightened disclosure requirements around confirmed and potential breaches," is not invalid.

tptacek15• 8 years ago

The link I posted does a better job of directly addressing that argument than I could do by retyping it here.

ta6935783388• 8 years ago

The law need not match your personal idea of morality. We have religion if you want to live by someone else's moral code.

ocdtrekkie3• 8 years ago

I think the biggest tell here was that Google had discussed disclosing it, and chose not to out of fear of regulation and bad press. This wasn't an everyday internal vulnerability. And they have no proof it wasn't used. But they chose to keep it secret specifically because they were afraid of the backlash, and the fact that it would demonstrate their security wasn't significantly different from Facebook's, it was just that they had a vastly less successful product.

Their decision wasn't about what was best for users, it was about what they thought they could get away with. I'm not shocked Congress is interested in that, because the memo is far more condemning than anything about the actual bug.

As an additional note, we can't rely on Ron Wyden to keep Google in check: Google is one of his larger sponsors, spending somewhere around $20,000 a year on him.

tptacek15• 8 years ago

Companies find RCE and SQLI, fix them, don't conduct gigantic forensics investigations to determine if they'd ever been exploited, and get on with their lives. It happens routinely. What's so interesting about this bug? Did you read the details about it? I wasn't kidding when I called it a sev:low.

TangoTrotFox4• 8 years ago

The difference between a breach and a independent discovery is utilization by third parties. Through logging and other measures one can often determine whether exploits have been utilized to engage unauthorized access. Google's defense in this case is not good. They are simply claiming ignorance. 'We don't have any idea if this exploit was utilized, as we were not logging access to the privileged information.' It really defies belief that Google, who's entire business is based on data, would not be logging access to confidential user information (even by the users' themselves). But it's an issue whether true or false. If true it means Google was and/or is likely engaging in poor security practice. If false, it's far worse as it means not only was user information likely accessed by parties that should not have had access to it, but it would also mean that Google then lied about this. An investigation is wholly justified here.

tptacek15• 8 years ago

This is word salad. In fact, Google is engaging in excellent security practice. They re-audited an application, found a minor vulnerability, and fixed it. Most tech companies don't do any of this.

chimeracoder• 8 years ago

What an embarrassment. Blumenthal should leave the performative infosec policymaking to his colleague Ron Wyden.

Blumenthal is also the senator behind the abomination that is SESTA[0]. He's an opportunistic scumbag - it's not that he's simply ignorant about technology; he's actively malevolent and uses his knowledge to that effect.

[0] https://www.eff.org/deeplinks/2018/03/how-congress-censored-...

Rafert3• 8 years ago

It is not and never has been a norm for SAAS vendors to disclose internal vulnerabilities that have not been discovered independently by third parties.

The bug sounds like it would need reporting to a data protection authority under the GDPR, which doesn't make a distinction on who discovered the breach. But I'm not sure if the fact that there is no evidence of the bug being abused means they didn't need to report after all.

tptacek15• 8 years ago

Someone claimed this on Twitter, so I took the time to finally read through the GDPR to validate the claim, and I don't find anything anywhere that requires the discovery of a vulnerability --- at all, by anyone --- to prompt a report to an external authority. I didn't look very hard, but maybe you can point me at it?

GDPR is clear about breach reporting, that is true. But a vulnerability is not a breach.

crunchlibrarian• 8 years ago

This is not as black and white as you portray it.

1. They don't actually know if the breach was exploited, because of the limited log window.

2. It appears that Google intentionally avoided the congressional hearings last month because of this breach, if they asked a question such as "are there any other incidents you have not disclosed" they would have had to either perjure themselves or kick off a PR fiasco in front of lots of TV cameras in real time. When you're evading authorities because of an incident like this it's far worse than any hack itself.

Maybe it is high time for software companies to start disclosing internal vulnerabilities (whether they can demonstrate it has been exploited or not) in light of the massive, worldwide societal impact these companies now have.

People everywhere should be mad as hell that these mega corporations are so powerful that they regularly evade oversight to continue building their monopolies. It's not about disruption or innovation anymore, it's become something far more evil.

tptacek15• 8 years ago

I don't think we're going to get anywhere if you casually use the word "breach" to describe the discovery, by a firm's own security team, of a security vulnerability and its subsequent fix. I can't write a better rebuttal to your comment than I already did in the post I linked at the root of the thread.

Isinlor2• 8 years ago

It's a really shitty job by Google PR people. Who in their right mind would close product in response to a security vulnerability? It was bound to grow out of proportions.

Headlines like "500 000 people at risk! The bug was so serious that Google shuts down their social network!" just write themselves.

US senator urges investigation into Google+ bug ‘coverup’

Related Stories