April 18th, 2007
Beware of data seepage on Google Calendar
If you use Google Calendar to set up corporate meetings or private conference calls, you might want to be careful about how that data is available to the rest of the world.
Here's an example of the kind of information that leaks out via Google Calendar's public search feature:
- Go to Google Calendar
- In the search box, type in "moderator passcode"
- Click on Search Public Events
That's just one basic example of a search query that returns potentially sensitive corporate information that could be used by competitors or others for nefarious purposes.
Now, if that search query is expanded for specific terms (use your imagination) and aimed at specific targets (again, use your imagination), the Web-based calendar becomes a gold mine for sensitive data.
I've found information (including e-mail addresses, phone numbers, passcodes and links to supporting documents) in public calendars maintained several well-known corporate entities.
From sales calls to internal department meetings to conference calls with potential clients, the information is all there, available to anyone with an Internet connection.
Google Calendar does offer the user the ability to keep your entries private. You should use it if you value your data.
* More from RSnake and Robert McMillan.
Ryan Naraine is a journalist and security evangelist at Kaspersky Lab. He manages Threatpost.com, a security news portal. Here is Ryan's full profile and disclosure of his industry affiliations.
For daily updates on Ryan's activities, follow him on Twitter.
Subscribe to Zero Day via Email alerts or RSS.
