Re: [calsify] Calendar spam - it is speeding up - security issue / warning

["Thomas Schäfer" <[e-mail]>]

Hi Doug,

Thanks for pointing to the mentioned article.

Members of CalConnect started thinking about this as soon as the big wave of calendar spam hit Apple users in November 2016 (https://www.bbc.com/news/technology-38144377). We soon started working on it by issuing article describing what happened (https://www.calconnect.org/news/2017/01/30/calendar-spam) and also started reaching out for E-Mail people at Messaging Malware Mobile Anti-Abuse Working Group (M3AAWG, https://www.m3aawg.org/) to work together on the topic.

In 2018 we finally managed to agree on working together on the topic (https://www.calconnect.org/news/2018/04/05/taking-calendar-spam-scheduling-developers-organization-calconnect-collaborates) and as Dave mentioned, the result was our published Calendar operator practices — Guidelines to protect against calendar abuse (https://standards.calconnect.org/csd/cc-18003.html) which also includes suggestions for mail and calendar service providers how to address the topic. Which now waits to be co-published by M3AAWG as well.

You are right, that the document may also address the area of calendar client developers a little bit more, but unfortunately we were not able to attract people developing clients to join.

Regarding some of your points:

>Virus checking and malicious site checking is the second (and not mentioned) half.

It is mentioned in https://standards.calconnect.org/csd/cc-18003.html#toc15 and https://standards.calconnect.org/csd/cc-18003.html#toc18, but as said, it does not contain a deep section about expected calendar client behaviour, as it aims for not inserting malicious events in your calendar at all and therefor preventing them to appear in your calendar client.

Thomas Schäfer
chair of TC CALSPAM @ CalConnect

> Gesendet: Freitag, 14. Juni 2019 um 04:57 Uhr
> Von: "Doug Royer" <[e-mail]>
> An: [e-mail]
> Betreff: Re: [calsify] Calendar spam - it is speeding up - security issue / warning
>
> On 6/13/19 8:10 PM, David Thewlis wrote:
> > FYI earlier this year, CalConnect published a best current practices for 
> > calendar operators on calendar spam.  This was developed in conjunction 
> > with M3AAWG; we understand that they will be publishing it as well.  See 
> > https://standards.calconnect.org/csd/cc-18003.html.
> > 
> > Dave Thewlis
> 
> Great! Just read it for the first time. I did not know it existed.
> 
> Should drafts start using 'https' and not 'http' in the examples? It is 
> not just about security over the wire. It can be about verifying the 
> destination host is from a verified and expected site. Should https be 
> required for all links in the future?
> 
> I could add a URL into an iCalendar property/ parameter that links to a 
> .DOC file that has malicious code. Several proposals lately have added 
> or used URL links to related documents.  Some CUAs could execute the 
> related viewing application themselves after the user says 'yes' to load 
> "YourIntroPacket.doc" - without virus checking.  This is a security issue.
> 
> A warning about the user saying "yes" to download and not automatic 
> loading is the first half. Virus checking and malicious site checking is 
> the second (and not mentioned) half.
> 
> Last time I wrote a CUA, I just used the OS call to load and view the 
> reflated application using the OS 'start the correct application' calls 
> - without checking.
> 
> -- 
> 
> Doug Royer - (http://DougRoyer.US)
> [e-mail]
> 714-989-6135
> 
> _______________________________________________
> calsify mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/calsify
>