Thousands of Google Calendars Possibly Leaking Private Information Online

"Warning — Making your calendar public will make all events visible to the world, including via Google search. Are you sure?"

Remember this security warning? No?

If you have ever shared your Google Calendars, or maybe inadvertently, with someone that should not be publicly accessible anymore, you should immediately go back to your Google settings and check if you're exposing all your events and business activities on the Internet accessible to anyone.

At the time of writing, there are over 8000 publicly accessible Google Calendars, searchable using Google engine itself, that allow anyone to not only access sensitive details saved to them but also add new events with maliciously crafted information or links, security researcher Avinash Jain told The Hacker News.

Avinash Jain, a security researcher from India working in an e-commerce company, Grofers, who previously found vulnerabilities in other platforms like NASA, Google, Jira, and Yahoo.

"I was able to access public calendars of various organizations leaking out sensitive details like their email ids, their event name, event details, location, meeting links, zoom meeting links, google hangout links, internal presentation links and much more," Avinash says in a post exclusively shared with The Hacker News.

Well, since it's intended behavior of the Calendar Service that comes as a handy feature to collaborate with people by making a Calendar public, one can not directly blame Google for the exposed data.

"While this is more of an intended setting by the users and intended behavior of the service but the main issue here is that anyone can view anyone public calendar, add anything on it—just by a single search query without being shared the calendar link," Avinash says.

Also, the issue is really not new, instead it was first raised 12 years ago when Google added this "make it public" feature to its web-based calendar service as a cool way for users to discover exciting events through the search engines, but a few quick searches revealed sensitive corporate information that was inadvertently made public using Google Calendar.

As the researcher says, since Google doesn't notify the creator of a public Calendar when someone accesses it or adds an event to it, the feature makes it harder for users to know if they are exposing information unintentionally and are even open to spammers and phishers as well.

Besides this, there's also no graphical indication on the Calendar interface from where users can get a hint that they had made that Calendar public and should stop adding personal events to the same.

Using an advanced Google search query (Google Dork), one can list all publicly available Calendars within seconds and access every information, including sensitive corporate data belonging to some organizations, as shown in the screenshots shared by Avinash.

"Various calendars belonged to many of the top 500 Alexa company's employees as well, which intentionally/unintentionally were made public by the employee themselves," Avinash warns.

A few months ago, security firm Kaspersky also discovered scammers abusing Google Calendar service to target users with credential-stealing attacks, where phishers were sending victims an email containing a crafted event invitation with malicious links.

In case if a user wants to share a Calendar with someone privately, Google also allows users to invite specific users by adding their email addresses under Calendar settings, instead of making them accessible to the public.

Have something to say about this article? Comment below or share it with us on Facebook, Twitter or our LinkedIn Group.