No, You Aren’t Being Invited to Win a New Car. That’s Spam on Your Calendar
By abusing the automatic event creation feature of integrated email calendars, spammers are finding ways to send you malicious links that are harder to ignore.
Background
In June, researchers at Kaspersky wrote a detailed blog post about phishing tactics involving calendar invite spam, wherein a spammer can automatically add events to your personal calendar, with no interaction on your part, simply by sending you an invitation. All the spammer needs is your email address, either from a stolen or auto-generated list. This isn’t a vulnerability; it’s a function of your calendar working as intended.
Analysis
You are likely already familiar with seeing new events pop up on your calendar as coworkers send invitations to new meetings, regardless of whether or not you’ve seen the email that triggered the invite. This is a feature that calendar apps have enabled by default to make team collaboration swift and efficient. It’s also enabled across both business and personal accounts for all integrated calendars by default. This feature is also becoming more popular with attackers, who are using it for malicious purposes.
As Brian Krebs pointed out in his own blog:
“Calendar invites from spammers run the gamut from ads for porn or pharmacy sites, to claims of an unexpected financial windfall or ‘free’ items of value, to outright phishing attacks and malware lures. The important thing is that you don’t click on any links embedded in these appointments. And resist the temptation to respond to such invitations by selecting ‘yes,’ ‘no,’ or ‘maybe,’ as doing so may only serve to guarantee you more calendar spam.”
Solution
Google is working on a solution for Google Calendar. In the meantime, we strongly advise educating staff to be vigilant and refrain from clicking on unsolicited links. Scammers are banking on the fact that users are likely to be enticed by their messages and will click on the malicious links.
Exchange admins have full control over calendar settings and can ensure that spam invites aren’t automatically added to a user’s calendar, reducing the risk of unwitting clicks on malicious links. Managing this setting should sync with Outlook users within your organization.
Since Apple Calendar doesn’t offer an enterprise version, individual users must manage the settings on their own devices.
Note: Black Hills published a blog in 2017 that details a bypass in Gmail they call MailSniper that ignores user’s attempts to block automatic invites. At the time of publication it seems that Google has yet to fix this flaw.
Identifying affected systems
Because many modern calendar applications are cloud based with little direct organizational control over specific user permissions, the only way we’ve found for an organization to maintain control over user settings against spam is through Exchange Server administration.
As with Apple Calendar, G Suite-dependent organizations must rely on user education to mitigate risk. At present there is no option in the G Suite to manage user calendar settings beyond simple sharing permissions.
Get more information
- Kaspersky Research Blog
- Krebs on Security Blog
- The Verge's Guide for Blocking Calendar Invites
- Google Community Support Thread
- Microsoft Exchange Management Documentation
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 60-day trial of Tenable.io Vulnerability Management.
Related Articles
Volt Typhoon: What State and Local Government Officials Need to Know
November 19, 2024Increased activity from the state-sponsored threat group Volt Typhoon raises concerns about the cybersecurity of U.S. critical infrastructure. Here’s how you can identify potential exposures and attack paths.
Cybersecurity Snapshot: Guide Unpacks Event-Logging Best Practices, as FAA Proposes Stronger Cyber Rules for Airplanes
August 23, 2024Looking to sharpen your team’s event logging and threat detection? A new guide offers plenty of best practices. Plus, the FAA wants airplanes to be more resilient to cyberattacks. Meanwhile, check out the critical vulnerabilities Tenable discovered in two Microsoft AI products. And get the latest on ransomware trends, vulnerability management practices and election security!
Detecting Risky Third-party Drivers on Windows Assets
August 7, 2024Kernel-mode drivers are critical yet risky components of the Windows operating system. Learn about their functionality, the dangers they pose, and how Tenable's new plugins can help identify and mitigate vulnerabilities using community-driven resources like LOLDrivers.
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
Five Cyber Agencies Sound Alarm About Active Directory Attacks: Beyond the Basics
November 21, 2024A landmark global report emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the second of our two-part series, we take you beyond the basics to highlight three key areas to focus on.
Volt Typhoon: What State and Local Government Officials Need to Know
November 19, 2024Increased activity from the state-sponsored threat group Volt Typhoon raises concerns about the cybersecurity of U.S. critical infrastructure. Here’s how you can identify potential exposures and attack paths.
- Threat Intelligence
- Threat Management
- Vulnerability Management
- Vulnerability Scanning