No, no lo están invitando a ganarse un auto nuevo. Eso es spam en su calendario

By abusing the automatic event creation feature of integrated email calendars, spammers are finding ways to send you malicious links that are harder to ignore.

Antecedentes

In June, researchers at Kaspersky wrote a detailed blog post about phishing tactics involving calendar invite spam, wherein a spammer can automatically add events to your personal calendar, with no interaction on your part, simply by sending you an invitation. All the spammer needs is your email address, either from a stolen or auto-generated list. This isn’t a vulnerability; it’s a function of your calendar working as intended.

Análisis

You are likely already familiar with seeing new events pop up on your calendar as coworkers send invitations to new meetings, regardless of whether or not you’ve seen the email that triggered the invite. This is a feature that calendar apps have enabled by default to make team collaboration swift and efficient. It’s also enabled across both business and personal accounts for all integrated calendars by default. This feature is also becoming more popular with attackers, who are using it for malicious purposes.

As Brian Krebs pointed out in his own blog:

“Calendar invites from spammers run the gamut from ads for porn or pharmacy sites, to claims of an unexpected financial windfall or ‘free’ items of value, to outright phishing attacks and malware lures. The important thing is that you don’t click on any links embedded in these appointments. And resist the temptation to respond to such invitations by selecting ‘yes,’ ‘no,’ or ‘maybe,’ as doing so may only serve to guarantee you more calendar spam.”

Solución

Google is working on a solution for Google Calendar. In the meantime, we strongly advise educating staff to be vigilant and refrain from clicking on unsolicited links. Scammers are banking on the fact that users are likely to be enticed by their messages and will click on the malicious links.

Exchange admins have full control over calendar settings and can ensure that spam invites aren’t automatically added to a user’s calendar, reducing the risk of unwitting clicks on malicious links. Managing this setting should sync with Outlook users within your organization.

Since Apple Calendar doesn’t offer an enterprise version, individual users must manage the settings on their own devices.

Nota: Black Hills published a blog in 2017 that details a bypass in Gmail they call MailSniper that ignores user’s attempts to block automatic invites. At the time of publication it seems that Google has yet to fix this flaw.

Identificación de los sistemas afectados

Because many modern calendar applications are cloud based with little direct organizational control over specific user permissions, the only way we’ve found for an organization to maintain control over user settings against spam is through Exchange Server administration.

As with Apple Calendar, G Suite-dependent organizations must rely on user education to mitigate risk. At present there is no option in the G Suite to manage user calendar settings beyond simple sharing permissions.

Obtenga más información

• Kaspersky Research Blog
• Krebs on Security Blog
• The Verge's Guide for Blocking Calendar Invites
• Google Community Support Thread
• Microsoft Exchange Management Documentation

Únase al Equipo de respuesta de seguridad de Tenable en Tenable Community.

Obtenga más información sobre Tenable, la primera plataforma de Cyber Exposure para el control integral de la superficie de ataque moderna.

Get a free 60-day trial of Tenable.io Vulnerability Management.