Re: [calsify] Calendar spam - it is speeding up - security issue / warning

[Doug Royer <[e-mail]>]

On 6/18/19 10:23 AM, "Thomas Schäfer" wrote:
> Hi Doug,
> 
> Thanks for pointing to the mentioned article.
> 
> Members of CalConnect started thinking about this as soon as the big wave of calendar spam hit Apple users in November 2016 (https://www.bbc.com/news/technology-38144377). We soon started working on it by issuing article describing what happened (https://www.calconnect.org/news/2017/01/30/calendar-spam) and also started reaching out for E-Mail people at Messaging Malware Mobile Anti-Abuse Working Group (M3AAWG, https://www.m3aawg.org/) to work together on the topic.
> 
> ...
> Regarding some of your points:
> 
>> Virus checking and malicious site checking is the second (and not mentioned) half.
> 
> It is mentioned in https://standards.calconnect.org/csd/cc-18003.html#toc15 and https://standards.calconnect.org/csd/cc-18003.html#toc18, but as said, it does not contain a deep section about expected calendar client behaviour, as it aims for not inserting malicious events in your calendar at all and therefor preventing them to appear in your calendar client.

That is great, however these are IETF documents. And I am NOT talking 
about SMTP or EMAIL (the references you pointed to). I am talking about 
URLs to external documents that could have been transferred with a 
MAILTO URL. However, the examples in the drafts are using an HTTP url 
(not covered under SMTP or EMAIL and not transferred with SMTP).

Email virus checking might find that related document URL contains 
malicious content if it were a multipart/mime with a CID, or as a 
related and inline included content. However it is often the case that 
the calendar embedded URL point to external documents.

Not all calendar objects are transferred with IMIP. Enterprise internal 
hacking, WebCal, or just a link someone puts on some public sporting 
event would not be transferred with iMIP. All of which could have 
related document URL links that point to malicious items.

And related: can an RFC refer to a calconnect document as a NORMATIVE 
reference?



-- 

Doug Royer - (http://DougRoyer.US)
[e-mail]
714-989-6135