Twelve years ago, Google introduced a new feature to Google Calendar, part of G-Suite, that allowed users to share their calendars with others. It's a great feature and invaluable in a corporate environment because it gives teams an easy way to collaborate. Google itself even touted the "make it pubic" feature of their calendar as being a cool way to use their search engine to discover upcoming events.
Unfortunately, as with most things, there's a potential downside. Recently, a security researcher named Avinash Jain discovered more than 8,000 publicly accessible Google Calendars, searchable via Google's own search engine. Many of these calendars contain sensitive information (which is bad enough), but worse, they allow any user to add new events that can cause real harm to the system hosting the calendar. This is done via maliciously crafted events or poisoned links.
Avinash Jain reports
"I was able to access public calendars of various organizations leaking out sensitive details like their email IDs, their event name, event details, location, meeting links, zoom meeting links, google hangout links, and much, much more.
This is more of an intended setting by the users and intended behavior of the service. The main issue, however, is that anyone can view anyone's public calendar, add anything on it - just by a single search query without being shared the calendar link.
Jain goes onto say that several calendars belonging to many of the top 500 Alexa company's employees were made public, which is certainly cause for concern.
This most recent finding adds to the chorus already warning of the dangers of calendar sharing. Just a few months ago, researchers from Kaspersky Lab discovered scammers abusing Google Calendar in a variety of ways. For example, there were phishing scams that contained poisoned links masquerading as google calendar event links.
Stay vigilant and be sure you have all employees check their Google Calendar security settings so you're not revealing more than you intended to.
As Hill Street Blues' Sgt. Esterhaus always advised: "Hey, let's be careful out there!"
Meanwhile, check out this report
This free executive report may give you insights into how to build your business with safe IT environments: 10 Hidden IT Risks That Might Threaten Your Business and 1 Easy Way to Find Them
I am Denis Wilson, President and Principal Consultant for DWP Information Architects. I help professionals grow their business by building a foundation of rock-solid information solutions for smaller healthcare, insurance, financial, legal, and nonprofits firms in Ventura County and San Fernando Valley. And have created cost-effective IT solutions, for over 20 years, specializing in cybersecurity and regulatory compliance. I am also a published author and speaker, working extensively with a variety of organizations, as well as providing small business technology education programs through business and professional associations. This just in: I will be speaking regularly at California Lutheran University's Center for Nonprofit Leadership starting in September.
Contact me if you would like me to speak at your association.