“Warning — Making your calendar public will make all events visible to the world, including via Google search. Are you sure?”
Remember this security warning? No?
If you have ever shared your Google Calendars, or maybe inadvertently, with someone that should not be publicly accessible anymore, you should immediately go back to your Google settings and check if you’re exposing all your events and business activities on the Internet accessible to anyone.
At the time of writing, there are over 8000 publicly accessible Google Calendars, searchable using Google engine itself, that allow anyone to not only access sensitive details saved to them but also add new events with maliciously crafted information or links, security researcher Avinash Jain told The Hacker News.
Avinash Jain, a security researcher from India working in an e-commerce company, Grofers, who previously found vulnerabilities in other platforms like NASA, Google, Jira, and Yahoo.
Well, since it’s intended behavior of the Calendar Service that comes as a handy feature to collaborate with people by making a Calendar public, one can not directly blame Google for the exposed data.
Also, the issue is really not new, instead it was first raised 12 years ago when Google added this “make it public” feature to its web-based calendar service as a cool way for users to discover exciting events through the search engines, but a few quick searches revealed sensitive corporate information that was inadvertently made public using Google Calendar.
As the researcher says, since Google doesn’t notify the creator of a public Calendar when someone accesses it or adds an event to it, the feature makes it harder for users to know if they are exposing information unintentionally and are even open to spammers and phishers as well.
Besides this, there’s also no graphical indication on the Calendar interface from where users can get a hint that they had made that Calendar public and should stop adding personal events to the same.
Using an advanced Google search query (Google Dork), one can list all publicly available Calendars within seconds and access every information, including sensitive corporate data belonging to some organizations, as shown in the screenshots shared by Avinash.
A few months ago, security firm Kaspersky also discovered scammers abusing Google Calendar service to target users with credential-stealing attacks, where phishers were sending victims an email containing a crafted event invitation with malicious links.
In case if a user wants to share a Calendar with someone privately, Google also allows users to invite specific users by adding their email addresses under Calendar settings, instead of making them accessible to the public.