Rewterz Threat Alert – Private Information on Google Calendars Publicly Exposed and Exploited

Severity

High

Analysis Summary

Over 8000 Google Calendars are found to be publicly accessible using Google search engine. It not only allows public to access sensitive information saved to the calendars but also enables them to add new events with maliciously crafted information or links. The act of making the calendar public is a handy feature intended to facilitate collaboration, and requires user interaction in the form of following warning pop up:

Many people set the setting to public, intended or unintended, in order to share these events with other people. However, the public setting does not require people to have a hyperlink of the calendar in order to access it. They can view and edit anything on it just by a single search query. Public calendars of various organizations exposed sensitive information including email ids, their event names, event details, location, meeting links, zoom meeting links, google hangout links, internal presentation links and much more, as shown below.

Moreover, Google neither notifies the creator of a public Calendar when someone accesses/adds an event to it nor sends any reminders that the calendar is publicly accessible, making it exploitable by phishers.

Researchers reported that many of the exposed calendars belonged to top 500 Alexa company’s employees.

Exploitation of Google Calendar Service in Cyber Incidents

Apparently helpful in collaboration, this feature of Google Calendar Service is being exploited to target users with credential-stealing attacks, in which phishers send victims an email containing a crafted event invitation with malicious links.

Since anyone can now edit one of these calendars to send you invitations to events or meetings, threat actors are now sending such malicious invitations en masse without raising concerns. The spam details may claim that you are entitled to a cash payment for some reason, and a link will be provided to let you receive the amount. The malicious link will redirect to spam pages demanding your credit card details either for the transfer of your payment, or for you to pay some registration fee before claiming your reward.

Not just credential theft, this service can also be exploited for delivering malware and ransomware on target systems, clicking which the targets will fall victim to the attack.

Impact

• Information Disclosure
• Credential Theft
• Potential Financial Loss

Remediation

• Check privacy settings of your Google calendars and make them private.
• To share a calendar with someone privately, invite specific users by adding their email addresses under Calendar settings.
• Do not click on links provided with Google Calendar invitations before verifying from the sender.