No, You Aren’t Being Invited to Win a New Car. That’s Spam on Your Calendar

Ryan Seguin

By abusing the automatic event creation feature of integrated email calendars, spammers are finding ways to send you malicious links that are harder to ignore.

Background

In June, researchers at Kaspersky wrote a detailed blog post about phishing tactics involving calendar invite spam, wherein a spammer can automatically add events to your personal calendar, with no interaction on your part, simply by sending you an invitation. All the spammer needs is your email address, either from a stolen or auto-generated list. This isn’t a vulnerability; it’s a function of your calendar working as intended.

Analysis

You are likely already familiar with seeing new events pop up on your calendar as coworkers send invitations to new meetings, regardless of whether or not you’ve seen the email that triggered the invite. This is a feature that calendar apps have enabled by default to make team collaboration swift and efficient. It’s also enabled across both business and personal accounts for all integrated calendars by default. This feature is also becoming more popular with attackers, who are using it for malicious purposes.

As Brian Krebs pointed out in his own blog:

“Calendar invites from spammers run the gamut from ads for porn or pharmacy sites, to claims of an unexpected financial windfall or ‘free’ items of value, to outright phishing attacks and malware lures. The important thing is that you don’t click on any links embedded in these appointments. And resist the temptation to respond to such invitations by selecting ‘yes,’ ‘no,’ or ‘maybe,’ as doing so may only serve to guarantee you more calendar spam.”

Solution

Google is working on a solution for Google Calendar. In the meantime, we strongly advise educating staff to be vigilant and refrain from clicking on unsolicited links. Scammers are banking on the fact that users are likely to be enticed by their messages and will click on the malicious links.

Exchange admins have full control over calendar settings and can ensure that spam invites aren’t automatically added to a user’s calendar, reducing the risk of unwitting clicks on malicious links. Managing this setting should sync with Outlook users within your organization.

Since Apple Calendar doesn’t offer an enterprise version, individual users must manage the settings on their own devices.

Note: Black Hills published a blog in 2017 that details a bypass in Gmail they call MailSniper that ignores user’s attempts to block automatic invites. At the time of publication it seems that Google has yet to fix this flaw.

Identifying affected systems

Because many modern calendar applications are cloud based with little direct organizational control over specific user permissions, the only way we’ve found for an organization to maintain control over user settings against spam is through Exchange Server administration.

As with Apple Calendar, G Suite-dependent organizations must rely on user education to mitigate risk. At present there is no option in the G Suite to manage user calendar settings beyond simple sharing permissions.

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 60-day trial of Tenable.io Vulnerability Management.

Read more >

Published on Sep 11, 2019

People also viewed

Senior Financial Analyst - Corporate Development

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Finance Finance
Your Role:Become a core member of Tenable’s internal corporate development team and assist with business, financial and valuation modeling for mergers, acquisitions and other strategic investments and initiatives.  Assist with evaluating elements ...

Cloud Security Intern

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Information Technology Internships
Your Role: The Cloud Security Intern will help Tenable secure their use of cloud systems across the company.  The intern will develop, implement and monitor security solutions for the cloud that assess risk, keeps Tenable data safe and bake in sec...

Salesforce Administrator

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Business Platforms Business Platforms
Your Role:Tenable Network Security is looking for a Salesforce.com Administrator to join our internal business platforms team. The qualified candidate will engage in the administration of Tenable’s  Salesforce.com instance, play a key role in the ...

Technical Support Intern

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Technical Support Internships
Your Role: The Technical Support Intern provides consistent, world-class security, network, and product support for specific Tenable products. In serving as the primary liaison between the company and customer, the Technical Support Intern resolve...

Research Intern - Plugin Automation

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Research Internships
Your Role: Tenable Research is looking for a Software Engineer Intern for the Plugin Automation team.  The position will involve developing frameworks for automated content creation, and processes for validating and publishing the content that is ...

Sales Development Manager

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Lead Generation Sales
Your Role:Tenable is looking for an experienced SDR Manager that will report to the Senior Director of Worldwide Sales Development and is responsible for ensuring the success of the Americas Tenable Sales Development team’s goals, as well as contr...

We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.