Google Calendar content for thousands of users is currently exposed online. A Calendar setting allows all Internet users to gain access to information, such as email addresses and other personal data, stored in Calendar.
This setting essentially allows you to share your Calendar content with others. This means that anyone who has the link to your Calendar will be able to access it.
Google displays a warning on screens. However, many users and businesses ignore it, putting important data at risk, since anyone can access it with a simple search.
A security researcher from India, Avinash Jain, discovered that using advanced search parameters (dorks) can give access to information such as meetings, interviews, events, internal information, and locations of certain companies.
The researcher discovered over 200 Calendars, which exposed important information.
Finding the exposed Calendars is very easy, according to the researcher. A general Google search is enough (inurl:https://calendar.google.com/calendar?cid=).
With this simple search, Google found over 7,000 results. However, not all of the calendars exposed have information. Some are empty. They would have to be searched one by one to identify the ones with meaningful content.
The researcher managed to gain access to a huge amount of personal data, belonging to doctors, ordinary users , and organizations.
When a company 's data is exposed , the risk is even greater. Competitors could use this information. The worst-case scenario, however, is that it could be used by cybercriminals, who could exploit the data to carry out an attack.
The researcher said he contacted Google and informed them of the issue, but the company responded that this is how the product works and that users decide whether to protect their data or not. After all, Google shows them the warning.
A company, however, whose Calendar was on display, rewarded Avinash Jain for his discovery.
However, some users find the setting that allows sharing of Calendar content useful because they need to communicate their schedule to others and this is an easy way to do so.
One solution would be to set up Calendar in such a way that it shares minimal information about the schedule, the ones that are necessary (like whether you are busy or available).
Google provides an easy guidethat shows how to manage sharing options.
