Security Information Vulnerability Research Security Blog

Finding the name behind the gmail address

July 15th, 2008 by , Filed under: Full Disclosure, Google, Privacy, Web

Ever wondered what name is behind some obscure gmail address? Maybe your preferred gmail address was taken and you’re wondering who took it?
Here’s a cute vulnerability in the gmail system that comes from the strong tie-ins between gmail, the google calendar and all the other services.

How to do it:

- Go to the ‘share this calendar’ tab

- Enter the email address in the ‘person’ box

- Click ‘add person’ and ‘save’

- When you return to this screen you will see the first and last name along with the gmail address

Screenshots:

I always wondered who was behind admin@gmail.com

Tell google you want to share your calendar and put their gmail email address

Oh, I guess they figured people like me would be interested…

admin@gmail.com is a smart ass

If you are getting personalized emails from spammers to your gmail account, here’s an idea on how they got your name.

Share
  • jlevy

    that’s only good if they used their real name. some people use fake names or just repeat the the email address itself as the real name. Still it is interesting that you can easily get this information like that…

  • Wonder

    I wonder who is behind security@gmail.com, root@gmail.com, and of course billgates@gmail.com :)

  • Maruti Borker

    Doesnt work anymore :)

  • Eric TF Bat

    It still works (or at least it did half an hour ago) but the person you select gets sent an email to tell them you’ve shared your calendar with them, so I think as a sneaky method to find someone’s name it has a few flaws…

  • http://www.BeyondSecurity.com Aviram

    Eric – you’re right, of course, unless they don’t have a gmail calendar account (only a gmail account) in which case you’ll be prompted to invite them to google calendar. I believe that if you click ‘don’t invite’ they don’t get anything.

    Also, if you really want to cover your tracks, open a fake gmail account under a fake name. They will know ‘someone’ shared their calendar with them, but they won’t know it was you (and I’m betting that if you use a gmail username like ‘v1agra4cheap’ they won’t give it much thought).

    I’ve got to admit, though, that my experience as a stalker is very limited :-)

  • Fliffy

    What if they use their real name as e-mail address? Does the internet implode?

  • http://ahoier.livejournal.com/ Adam

    as usual, all spam should be reported to spamcop.net, knujon.com, and castlecops.com/sirt :)

    Get these dudes behind bars….

    There’s already investigations going on in NZ regarding some of them….

  • John

    Unbelievable but it does work… and I believe its a big loop whole… I hope google guyz will handle this issue on priority basis…

  • Shady

    Hey Aviram,
    Cool stuff man. Software will have bugs but i dont think that sensitive personal info with Google is so easily available public.

    It works really great…. Maybe the admin guy has known this
    bug [maybe thats why he is SMART ASS] already.. :-)

    Good post….

  • http://tnetech.net tnetech

    Thats the thing about Google, great services but they got all our details. Whether or not you use a false name is unimportant. They have our IP address, our search histrory – a record of everythinng we have done on line.
    I am sure this is just one of the many flaws we will find out about from the Google machine.

    http://tnetech.net

  • http://bramp.net/blog/google-calendar-exploit Andrew Brampton

    I reported this to Google back in March, and then again in April. Neither times did I get a reply, so I tried posting it to bugtrap, that got no reply, so I posted it on my blog and on Slashdot. My comment on slashdot was voted down out of existence…. now the news is on the front page of Slashdot… grrr!

  • http://www.byteburn.com Arthur

    Gmail has pretty effective anti-spam mechanism that’s why I don’t get obscure gmail addresses from my inbox. Nice find though!

  • l a

    Andrew Brampton…sorry to hear that no one was listening, but usually it only happens if you have a pen at one of these slashdot type websites or blogs, where they are linked to a multitude of other websites….next time if u want to post on slashdot, comment to commander taco about it, he usually listens and sets up a new article if interesting enough

  • http://www.firegames4free.de asdil12

    I can do it even better:

    Technical Support
    Larry Page

  • http://www.toke.de/ Toke

    The same thing does happen with google maps when you invite someone to a map.

  • http://www.randomreflection.com Bellagh

    Awesome, thanks! I had wondered who had the gmail account I wanted, and I just found his/her name this way. The person did not have a Google calendar and I chose not to “invite,” but when I saved and went back to manage calendar, there was the name.

  • http://www.ybo-interactive.com yairb

    Think about a gmail account you want to hijack.
    Now that you know the person’s name, how hard is it to find out his “mother’s maiden name” , “first phone number” , “first teacher’s name” in FaceBook/LinkedIn/Google?

  • jason ross

    heh. now i know why i got a shared calander message from ‘aviram jenik’. coulda just asked for my name , i’m not keeping it a secret ;-)

  • http://ziplab.ru Интеллектуальная Собственность

    Hey Aviram,
    Cool stuff man. Software will have bugs but i dont think that sensitive personal info with Google is so easily available public.

    It works really great…. Maybe the admin guy has known this
    bug [maybe thats why he is SMART ASS] already.. :-)

    Good post….

  • Tami Raivo

    I need to find out the name/address behind the email address fnfrhr@hotmail.com. Please advise if there is a fee?

  • manik

    this stuff doesnt work any more dudes..
    can smebody suggest smething else…

  • http://www.sitelersitesi.com link ekle

    Thanks

  • http://ipfinding.com find ip address

    Isn’t that the name you would get if you received an email from the person? As in from: John Doe?

  • http://www.shoes777.com/ nike shoes

    I need Thank you!

  • http://www.etoplum.com toplum

    this stuff dosenr work any more dudes.

  • naddy

    well someone has an email with my name and last name and everything. i think someone i doing crap behind my back with my name , like so ppl think that i wrote to ‘em
    Is there a way for me to figure out who is doing that?

  • nsamitha

    hi………………

  • nsamitha

    hi…………………….my mail add nsamitha1987@gmail.com………….bye……..

  • femi

    is it google that owns g-mail

  • http://gains31gamil.com gains

    plz send me address n phone no.

  • http://www.kamyonlar.net kamyon

    Thanks. this stuff doesnt work any more dudes..
    can smebody suggest smething else…

  • Muhammad Kashif

    I want to know who is behind the xs2kashi@gmail.com or xs2kashi@googlemail.com
    please tell me

  • hossein

    I want to know who is behind the
    azrapasha@gmail.com
    please send to my gmail.

  • http://www.pbrbigskykc.com Darci

    I REALLY REALLY REALLY need to find a first and last name behind the email account “familymatters321@gmail.com” and I would be sooooo greatful for any help you could provide me with!!!

  • arungtm

    i really need to know first and last name of ‘arungtm@gmail.com’ if anyone can help me finda then i would pay for him/her…
    contact me at meroidhok[at]yahoo.com via mail only…

  • http://www.homeland-security-portal.com Meir

    Try to google the name before the @.

  • cheap computers

    Its quite easy. I believe that if you click ‘don’t invite’ they don’t get anything.

  • http://kevin.learn-mandarin-hk.com/archives/6 kevin

    Thanks. this stuff doesnt work any more dudes..
    can smebody suggest smething else…

  • http://www.modelimodelleri.com modeller

    Thanks. this stuff doesnt work any more dudes..
    can smebody suggest smething else…

  • http://Gmail kathleen

    Could someone please help me find out the name of this persons email. I am suspecting it to be my sons new girlfreind she is tormenting his babys momma with visus lies. Please Please help me. I know it’s a moble email account and I now her moble number the email account is negrete2@gmail.com
    I can be reached at ablondekat@yahoo.com.

  • http://Gmail kathleen

    Sorry for the poor spelling and grammer I am upset.

  • http://www.tumfirmalar.info firma rehberi

    Thanks. this stuff doesnt work any more dudes..
    can smebody suggest smething else…

  • http://www.luminousoutsourcing.blogspot.com sridhara

    well someone has an email with my name and last name and everything. i think someone i doing crap behind my back with my name , like so ppl think that i wrote to ‘em
    Is there a way for me to figure out who is doing that?

  • http://www.indirbiz.com indir

    Thanks. this stuff doesnt work any more dudes..
    can smebody suggest smething else…

  • rnathus

    Some one in our son’s class opened an account with my lastname and sending e-mails to son’s friends and harassing us. How do I complain to G-mail. What is the best way to find persons’s real name.

  • daban sarbast

    hiiiiii,im from kurdistan

  • jack

    I tried the above suggestion,
    clicked add person and save
    now where do I go to find his name??
    I went back to the same page, there is nothing except the gmail address that I had typed in, no name.

  • mayphyokyaw

    finding person’s name using this account kenbokoko125@gmail.com

  • John Henry

    Using Google Calender worked perfectly, thank’s for providing this tool to locate “the one armed man” who is haunting my paranoid ex-sister.

  • Share







  • Categories


Security RSS Subscribe