Google admits Gmail and Google Calendar users could have been scammed by fake event notifications

Google has confirmed {that a} vulnerability could have left 1.5 billion Google Calendar and Gmail users uncovered to a harmful type of phishing assault.

As Forbes experiences, the issue was a results of the shut linking between the 2 providers, which permits calendar invites to be despatched by electronic mail – even by individuals you do not know, and have by no means spoken to earlier than – and added to your calendar mechanically.

If the vulnerability was exploited, it could be doable for a prison to ship a convincing fake calendar invitation to a sufferer, which they might be more likely to click on with out considering twice.

These rip-off invites could embody a malicious hyperlink that could not solely be used to steal login credentials (like an ordinary phishing assault), but in addition to offer different delicate data, equivalent to the way to achieve entry to a constructing the place the ‘assembly’ is because of happen.

Don’t get caught out

The vulnerability was first uncovered in 2017 by safety researchers Beau Bullock and Michael Felch of Black Hills Information Security.

This week, Google worker Lesley Pace printed a publish acknowledging the issue. “We’re aware of the spam occurring in Calendar and are working diligently to resolve this issue,” mentioned Pace. “We’ll post updates to this thread as they become available.”

In the meantime, in case you’re involved Black Hills Information Security has printed an intensive information which you can comply with to safe your Gmail and Google Calendar apps from potential assault. As all the time, although, a very powerful factor is to all the time deal with unsolicited emails with warning, and not click on any hyperlinks to occasions that you simply aren’t anticipating.