Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: InfoSec Handlers Diary Blog - Spam to your calendar via Google agenda? InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Spam to your calendar via Google agenda?

Published: 2008-04-22
Last Updated: 2008-04-22 13:07:31 UTC
by donald smith (Version: 1)
0 comment(s)

Every once in a while I see a new spamming method.
This one came from google agenda and came in as a meeting invite.
I deleted the email but due to my preferences in exchange it appeared in my calendar anyways.

So I only have to send them $150 non-resident tax to get $1.2 M.
What a deal:) I think I will pass.

I have never had to analysis an ics (calendar file) before so I saved it.
Next I used a text processor to pull elements of the header.
Here is what the header looks like. I removed the email addresses:)

PRODID:-//Google Inc//Google Calendar 70.9054//EN

Actual content viewable via outlook calendar.
"Google Agenda
donald smith, vous êtes invité(e) à participer à
Your pending transfers respond prompt.
sam. 5 avr. 20:30 – 21:30
(Fuseau horaire : Hawaï)
Agenda : donald smith
Compliments and Greetings,
This is an official notification of the availability of your full
entitlement valid 1.2 million which has not been affected due to official
negligence. This transfer has been held pending and its original account
suspended pending when the benefactor provided the TAX clearance
document .but the impostors who are operating in syndicates all over the
world today are misled and misguided you about the position of your fund
with the sole aim of exporting money from you that explain why you have
not receive the payment up-to-date.

However, you are advised to immediately reconfirm your telephone and
currant contact/ payment receiving details to this e-mail address ( .You will receive your payment by: (1)
By wire transfer direct to your nominated bank account. (2). Issuing
you ATM CARD 3) or by drawing a cashiers cheque payable in your name,
with strict procedures of the International funds transfer rules and
regulations in avoidance of unhealthy intents and unnecessary delay.

So, let us know which of option you like to receive your monies .But
before we proceed, you are required to make a payment of the Non-resident
tax of $150 only as the authorities demand which is described as
selective payment to enable us effect maximum clearance on
your file and automate your full information on the transfer script
text to ensure that the payment reach your hand on time through a legal
secure way from the exact time frame we initiate our service if you
accurately furnished us with our requirement as instructed.

Note that we have no legal right to deduct or add to the value of your
funds because your payment has already been keyed into the system for
final transfer, thus the compliance with this condition this payment
will reach you within 48 banking hour or less.

Yours faithfully,
Johnson Mark
International Clearing House West Africa- BENIN
Affiliate to the World Association of Debt Management.
Plus d’infos sur l'événement»

Participerez-vous ?
Oui |Non |Peut-être
Vous recevez ce message à l'adresse victim', car vous participez à cet événement.

Pour ne plus recevoir de notifications pour cet événement à l'avenir, refusez cet événement. Vous avez également la possibilité de créer un compte Google Agenda sur la page et de définir vous-même les paramètres de notification pour l'intégralité de votre agenda.

Keywords: calendar spam
0 comment(s)
Diary Archives