BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//talks.toorcon.net//toorcon21//talk//JACXUM
BEGIN:VTIMEZONE
TZID:PST
BEGIN:STANDARD
DTSTART:20001029T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10;UNTIL=20061029T100000Z
TZNAME:PST
TZOFFSETFROM:-0700
TZOFFSETTO:-0800
END:STANDARD
BEGIN:STANDARD
DTSTART:20071104T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11
TZNAME:PST
TZOFFSETFROM:-0700
TZOFFSETTO:-0800
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000402T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=20060402T110000Z
TZNAME:PDT
TZOFFSETFROM:-0800
TZOFFSETTO:-0700
END:DAYLIGHT
BEGIN:DAYLIGHT
DTSTART:20070311T030000
RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3
TZNAME:PDT
TZOFFSETFROM:-0800
TZOFFSETTO:-0700
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-toorcon21-JACXUM@talks.toorcon.net
DTSTART;TZID=PST:20191109T110000
DTEND;TZID=PST:20191109T112500
DESCRIPTION:On Halloween\, October 31\, 2018\, 2 Black Hills Security Resea
 rchers\, Beau Bullock and Michael Felch disclosed\, step-by-step to Google
  how anyone with a gmail account could add an event\, as "accepted" to any
  Google Calendar via the Google Calendar API.  Google called it a feature.
   Why\, a year later is this not fixed?  This talk will demonstrate how th
 is "calishing" attack can be utilized in a Red Team operation where the ta
 rget organization uses G-Suite.  I will demonstrate this by leveraging an 
 open source python tool that I have developed\, G-Calisher\, based on Beau
  Bullock's and Michael Felch's PowerShell module "Invoke-InjectGEventAPI" 
 from their MailSniper tool.  I will lead the audience through the entire k
 ill chain from recon (How to determine if an organization is using G-suite
  for its email) through Command and Control.  I will also discuss how the 
 organization can stop this attack.
DTSTAMP:20260314T231530Z
LOCATION:Red Day
SUMMARY:Gone Calishing:  A Red Team Approach to Weaponizing Google Calendar
  and How to Stop It. - Antonio Piazza
URL:https://talks.toorcon.net/toorcon21/talk/JACXUM/
END:VEVENT
END:VCALENDAR