Re: [calsify] Calendar spam - it is speeding up - security issue / warning

[David Thewlis <[e-mail]>]

FYI earlier this year, CalConnect published a best current practices for calendar operators on calendar spam.  This was developed in conjunction with M3AAWG; we understand that they will be publishing it as well.  See https://standards.calconnect.org/csd/cc-18003.html <https://standards.calconnect.org/csd/cc-18003.html>.

Dave Thewlis


> On Jun 13, 2019, at 18:13, Doug Royer <[e-mail]> wrote:
> 
> Years ago, I predicted without more controls (no clue what), that calendaring can be used to attempt to schedule appointments and spam.
> 
> No proposal from me. Perhaps after reading the article below, new security controls may be needed soon. It might make a new great topic / draft. Clearly - do not click on appointments in email to find out what they are about.
> 
> This article is pointing out the latest calendaring security abuse. (it is a bit of pay-to-view, you can still read it).
> 
> Summary, spammers are sending out calendar appointments with URLs that look like appointments (and are fake links or malicious links), or have valid iCalendar objects that have or link to malicious calendar attachments. The MUA/CUA or perhaps user is being careless about what is loaded.
> 
> The original post that led me to this article pointed out that Thunderbird with the calendar add-on, may be vulnerable to this.
> 
> Not entirely new or new news. But it seems to be picking up.
> 
> https://www.forbes.com/sites/daveywinder/2019/06/11/new-security-warning-issued-for-googles-1-5-billion-gmail-and-calendar-users/#700c55f7565e
> 
> No proposal from me. Just for those on this list, if you happen to have an idea for helping slow or stop this kind of thing, it may be time to rethink iTIP and calendar security.
> 
> -- 
> 
> Doug Royer - (http://DougRoyer.US)
> [e-mail]
> 714-989-6135
> 
> _______________________________________________
> calsify mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/calsify





--
Dave Thewlis, Executive Director
CalConnect - The Calendaring and Scheduling Consortium
[phone] voice | [phone] mobile | [phone] fax
http://www.calconnect.org | [e-mail]