Apple users over the last few weeks have reportedly been besieged with spam hitting their iCloud calendars in the form of unwanted invites, after cybercriminals figured out that they could send their junk offers directly to recipients' iCloud accounts.
By targeting the calendar directly via iCloud, the spammers can evade traditional spam filtering mechanisms that would likely block the communications if they were sent to recipients' email accounts.
In response to reports of complaints popping up on various Mac OS/iOS forums and websites, Apple released the following statement to Apple news site iMore on Wednesday: “We are sorry that some of our users are receiving spam calendar invitations. We are actively working to address this issue by identifying and blocking suspicious senders and spam in the invites being sent.” (SC Media also sent a request to Apple for additional comment.)
Even worse: deleting the spam invite sends a notification back to the spammer, essentially verifying that the iCloud account is valid and active, which may only encourage more spam.
“I have seen… a very significant increase in posts all over the major Mac forums about this problem," said Thomas Reed, director of Mac offerings at Malwarebytes, in an interview with SC Media. "It's really been a very sudden problem."
Several Apple news and blogging sites have reported the existence of workarounds that users can employ to stave off unwanted invites. But Reed, in a Wednesday blog post addressing the calendar spam scourge, cast doubt on their efficacy.
One tip is to change the calendar settings to receive all event invitations as emails, but according to Reed, this technique did not stop his iCloud Calendar from receiving spam that he sent to himself as a test.
The other trick is to create a secondary “junk” calendar, move all the spam invites there, and then delete the entire calendar. This tactic supposedly allows recipients to discard the spam without alerting the senders; indeed, Apple actually sends a notification to users, giving them the specific option to delete the calendar without notifying event organizers. (9to5Mac attributed the workaround to Dutch website AppleTips.)
However, Reed said he tested this approach to no avail: “The sender will always get a notification that the invitation was declined,” wrote Reed in his blog post, suggesting that recipients may instead prefer to simply quarantine the spam invites in the junk calendar, without deleting them.
Still, these methods are “not entirely bad because they do appear to work for some people,” Reed told SC Media. “But it's just unclear at this time why they work for some people and not for others. It's kind of like playing Russian Roulette.”
Reed did recommend that recipients report instances of iCloud calendar spam to Apple so the company can close out the offending iCloud account. Asked to speculate how Apple might address the problem moving forward, Reed guessed that the company might try to “filter or capture the spam on their end before it gets to the user's machine,” or modify the event deletion process so that spammers aren't automatically notified.
