Thousands of Google Calendars Possibly Leaking Private Information Online
“Warning — Making your calendar public will make all events visible to the world, including via Google search. Are you sure?” Google Calendars
Remember this security warning? No? Google Calendars
If you have ever shared your Google Calendars, or maybe inadvertently, with someone that should not be publicly accessible anymore, you should immediately
go back to your Google settings and check if you’re exposing all your events and business activities on the Internet accessible to anyone.
At the time of writing, there are over 8000 publicly accessible Google Calendars, searchable using Google engine itself, that allow anyone to not only access sensitive Google Calendars
details saved to them but also add new events with maliciously crafted information or links, security researcher Avinash Jain told The Hacker News.
Avinash Jain, a security researcher from India working in an e-commerce company, Grofers,
who previously found vulnerabilities in other platforms like NASA, Google, Jira, and Yahoo.
“I was able to access public calendars of various organizations leaking out sensitive details like their email ids, their event name, event details, location, meeting links, zoom meeting links,
google hangout links, internal presentation links and much more,” Avinash says in a post exclusively shared with The Hacker News.
Well, since it’s intended behavior of the Calendar Service that comes as a handy feature to collaborate with people by making a Calendar public, one can not directly blame Google for the exposed data. Google Calendars
“While this is more of an intended setting by the users and intended behavior of the service but the main issue here is that anyone can view anyone public calendar, add anything on it—just by a single search query without being shared the calendar link,” Avinash says. Google Calendars
Also, the issue is really not new, instead it was first raised 12 years ago when Google added this “make it public” feature to its web-based calendar service as a cool way for users to discover exciting events through the search engines,
but a few quick searches revealed sensitive corporate information that was inadvertently made public using Google Calendar.
and are even open to spammers and phishers as well.
Besides this, there’s also no graphical indication on the Calendar interface from where users can get a hint that they had made that Calendar public and should stop adding personal events to the same. Google Calendars
Using an advanced Google search query (Google Dork), one can list all publicly available Calendars within seconds and access every information,
including sensitive corporate data belonging to some organizations, as shown in the screenshots shared by Avinash.
“Various calendars belonged to many of the top 500 Alexa company’s employees as well, which intentionally/unintentionally were made public by the employee themselves,” Avinash warns.
A few months ago, security firm Kaspersky also discovered scammers abusing Google Calendar service to target users with credential-stealing attacks, where phishers were sending victims an email containing a crafted event invitation with malicious links.
In case if a user wants to share a Calendar with someone privately, Google also allows users to invite specific users by adding their email addresses under Calendar settings, instead of making them accessible to the public.
