HOWTO prevent unsolicited Google Calendar entries
Introduction
If you discovered this article because you’ve
experienced a similar occurrence please note that Your GOOGLE account was not hacked. This is a way spammers are trying
to get you to interact with them.
Yesterday
the calendar notification on my phone got triggered a few minutes past
midnight. While I am particularly careful not to set alarms to go off during
the night it sometimes happens. Since
I’ve made it a policy not to take my phone to bed with me, I got up walked to
the table on which the phone was sitting and checked what was the notification
associated with the chime.
The
notification read “Your iPhone Xs is
ready for PickUp”. I hadn’t created this reminder nor had I accepted a
request from a third party on this topic.
Rather than go back to bed I decided to dive into the topic and
investigate.
If you are
not interested in the analysis of the topic jump to the section “How do I prevent this from happening?”.
Investigating the topic
The
organizer has an email account that may confuse an untrained victim that this
is in some way related to Google’s Cloud Identity and Access Management
(IAM). The invite has a link
to an Amazon sounding web site and has a parameter with a number that is
probably used to identify which accounts clicked through (the hit rate). Accounts that click through tell the sender
that:
- The account is active;
- The person is more reactive to clicking links. This is used to improve their knowledge base helping them identify accounts that are more likely to fall victim to phishing attacks.
The time zone of the message is Russian.
The
notification is set to repeat multiple times and some occurrences are
set at hours when people may be asleep. This approach is used to catch the
recipient off guard as well as bother them into clicking the link.
Attempting
to access this site a few hours after the fact brought up this warning on my
browser. The advice for everyone is to
back out at this stage.
Digging a
bit deeper it seems that the domain is registered with a domain registrar based
in Cyprus. Cloudflare, a professional US
company that offers CDN, DDoS mitigation, Internet security and distributed
domain name server services, was protecting the domain.
How do I prevent this from happening and clean up these invites?
- Click the Gear icon in the Google Calendar app
- Choose the Settings option from the menu.
- From the General submenu choose the Event setting option.
- From the section “Automatically add invitations”,
- Select the option “No, only display invitations to which I have replied”.
Once the
settings are applied, all calendar entries of this type will disappear.
Conclusion
Some might
ask why Google would implement this feature.
It was convenient to have entries automatically added without having to
acknowledge each entry. Sadly this option has been abused. People who depend on such functionality need
to decide what is best for them. Maybe
Google can implement a function that defaults to No unless you specifically way
yes.
Comments
Post a Comment