HOWTO prevent unsolicited Google Calendar entries
If you discovered this article because you’ve experienced a similar occurrence please note that Your GOOGLE account was not hacked. This is a way spammers are trying to get you to interact with them.
Yesterday the calendar notification on my phone got triggered a few minutes past midnight. While I am particularly careful not to set alarms to go off during the night it sometimes happens. Since I’ve made it a policy not to take my phone to bed with me, I got up walked to the table on which the phone was sitting and checked what was the notification associated with the chime.
The notification read “Your iPhone Xs is ready for PickUp”. I hadn’t created this reminder nor had I accepted a request from a third party on this topic. Rather than go back to bed I decided to dive into the topic and investigate.
If you are not interested in the analysis of the topic jump to the section “How do I prevent this from happening?”.
Investigating the topic
The organizer has an email account that may confuse an untrained victim that this is in some way related to Google’s Cloud Identity and Access Management (IAM). The invite has a link to an Amazon sounding web site and has a parameter with a number that is probably used to identify which accounts clicked through (the hit rate). Accounts that click through tell the sender that:
- The account is active;
- The person is more reactive to clicking links. This is used to improve their knowledge base helping them identify accounts that are more likely to fall victim to phishing attacks.
The time zone of the message is Russian.
The notification is set to repeat multiple times and some occurrences are set at hours when people may be asleep. This approach is used to catch the recipient off guard as well as bother them into clicking the link.
Attempting to access this site a few hours after the fact brought up this warning on my browser. The advice for everyone is to back out at this stage.
Digging a bit deeper it seems that the domain is registered with a domain registrar based in Cyprus. Cloudflare, a professional US company that offers CDN, DDoS mitigation, Internet security and distributed domain name server services, was protecting the domain.
How do I prevent this from happening and clean up these invites?
- Click the Gear icon in the Google Calendar app
- Choose the Settings option from the menu.
- From the General submenu choose the Event setting option.
- From the section “Automatically add invitations”,
- Select the option “No, only display invitations to which I have replied”.
Once the settings are applied, all calendar entries of this type will disappear.
Some might ask why Google would implement this feature. It was convenient to have entries automatically added without having to acknowledge each entry. Sadly this option has been abused. People who depend on such functionality need to decide what is best for them. Maybe Google can implement a function that defaults to No unless you specifically way yes.