Einstein’s Wormhole Exposes Salesforce Calendars to Potential Hackers

  • Salesforce’s Einstein Activity Capture has shown a bug giving access to external users.
  • The bug has been removed by the Salesforce team with a new update.
  • Salesforce user teams can change guest ID parameters to cover for the bug if they do not have the latest version.

Salesforce Communities and Einstein Activity Capture (EAC) can lead to a compromise of the administrator’s Outlook or Google calendar through a bug the Varonis research team discovered, naming it Einstein’s Wormhole. Calendars used by admins may contain highly sensitive information, including attendee names and emails, file attachments, meeting URLs and passwords, agendas, and email replies.

The issue has been reported to the Salesforce team and they have fixed it as of August 19, so if your Salesforce Community was created prior to this date, you must remediate exposed calendar events.

The EAC is used to sync emails and calendar events between Microsoft Exchange, Google accounts, and Salesforce. If a user leaves access open with a meeting link, hackers could gain passwords and infiltrate a meeting without being noticed.

source: Varonis

Short of getting the latest upgrade, the most effective way of securing against the Einstein Wormhole bug is to change your guest ID parameters. First, you must replace your guest user’s email with something like "test[@]example.com" or "guest[@]yourcompany.com." After that, remove all confidential information accessible via the guest account.

source: Varonis

You can do this via the Development Console option in your Salesforce app and access the “Execute Anonymous Window.” Next, “Execute” the code above to change the email address used by guests.

REVIEW OVERVIEW

Latest

Why Is Demon Slayer So Popular?

In August 2019, the world suddenly started talking about an anime series that had just released its nineteenth episode. Fast forward to...

F1 Live Stream 2022: How to Watch Formula 1 Without Cable

There's not much time until the 2022 Formula 1 World Championship gets underway - the first race is scheduled for late March,...

Disney+ Announces Basketball Series Inspired By Award-Winning Book The Crossover

Disney Plus announced a new basketball-themed drama series that is set to land on the streaming platform, drawing inspiration from the critically...
For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: Chrome, Edge, Firefox, Safari