About this blog

Bob Sullivan

Corporate sneakiness. Government waste. Technology run amok. Outright scams. The Red Tape Chronicles is MSNBC.com's effort to unmask these 21st Century headaches and offer real solutions that save you time and money.

Bob Sullivan covers Internet scams and consumer fraud for MSNBC.com. He is the winner of multiple journalism awards for his coverage of online crime and author of Gotcha Capitalism: How Hidden Fees Rip You Off Every Day and What You Can Do About It. and Your Evil Twin: Behind the Identity Theft Epidemic.

Got some red tape you want Bob to untangle? Write BobSullivan@
feedback.msnbc.com.

9 a.m.: Don't forget to read annoying spam!

Posted: Tuesday, April 22 at 05:00 am CT by Bob Sullivan

Thank goodness the reminder popped up at 9:15 a.m., just a few minutes before my "meeting." Otherwise, I might have forgotten to claim my winnings.

"[Invitation] CLAIM PRIZE," the meeting reminder said. And when I opened the appointment, I was reminded of my good fortune. "Attn: Winner, We wish to congratulate you over your email success in our AMSTEL LOTTO balloting. ... You have been approve for the star prize of Euro 750,000."

I've received several such meeting invitations in recent days, and so have e-mail users across the Internet. Combine two of your least-favorite things -- unwanted meeting invitations and spam -- and you've got a major new Net nuisance. Computer security folks have taken to calling it "calendar spam."

Calendar spam arrives like any other spam – as an unwanted e-mail. But here's the problem: it also shows up as a meeting. That means the time specified on the spam will be blocked off on your online calendar, triggering an annoying reminder at the appointed hour. If you're a spammer, that's a major upgrade over your usual silent forays into consumers' junk mail folders.

Making matters worse, ignoring calendar spam doesn't make it go away. Because of the way Microsoft Outlook and Google calendars work, unanswered calendar spam will usually shove its way onto your calendar.

Calendar spam in your inbox looks like this.
Meetingspamininbox_2


While the technique first appeared about a year ago, it didn't become commonplace until a couple of weeks ago. Now, in the words of Message Labs researcher Alex Shipp, "We are seeing these by the truck load."

That means if you haven't seen them yet, you will.

So far, the messages aren't dangerous -- simply the usual fare featuring invitations to get burned in a Nigerian scam, announcements of fake lottery winnings and the like. While the spam I've received only hits Microsoft and Google calendars, other users report that their Yahoo calendars also have been attacked.

The spam is particularly effective because of the way scheduling software works. It’s designed to give other people access to your schedule. When recipients get an invitation to a meeting, the time is immediately blocked out while the system waits for an answer. That makes sense from an organizational perspective, to avoid overlapping meeting invitations. If the meeting request is simply ignored, the time is still listed as tentative.

"It's by design," said David Cowings, a researcher at Symantec Corp. "Anything that's not in the deleted folder shows up as an unaccepted meeting."

An unwelcome reminderMeetingspamoncalendar

Cowings said there's been a sharp increase in calendar spam complaints in recent weeks, but there’s no sign of a massive outbreak. He's concerned, however, that the technique could catch on. "It has potential," he said. "It's so effective because of the widespread use of Microsoft Exchange."

He's also concerned that new versions of the spam could include malicious payloads such as computer viruses.

RED TAPE WRESTLING TIPS
Coming up with generic advice for handing calendar spam isn't easy. Google has posted specific instructions for changing the way its software handles unaccepted invitations, which helps.

Microsoft Outlook users have several options, but none are ideal. There are instructions on Microsoft's site for turning off automatic acceptance of meeting requests, but that's doesn't keep spam invitations off the calendar as "tentative" meetings.

A better method, says Cowings, is to have your Outlook Exchange administrator set up filters to turn away all meeting invitations that come from outside your domain.

In the meantime, the best advice is to ignore the invitation e-mail and delete the meeting if it shows up on your calendar. Deleting the invitation e-mail without opening it should work in most cases. You might be inclined to open the invitation and decline the meeting, but that's a no-no -- it's never a good idea to open anything unexpected from a stranger.

MAIN PAGE NEXT POST Was your LendingTree file hacked?

Email this EMAIL THIS

56 COMMENTS

Well in this case, you are showing a subset of the problems with the mail client. The lack of a means to delete material that got past all of the filters and made it onto the machine is a major flaw. The flaw that is being exploited in this case is programmers who think that everyone lives by calenders, and to make it easy to set up apointments, when a reqest comes in, it is processed onto the calender. Take this, with my preceding comment, the end user has no chance to say no since the damage is already done. If the average user had a choice to not open mails, many would. I have had a couple of the inbox or deleted items boxes unable to delete that got by all of the spam and anti virus filters and software. When you go to find the fix, you get condesending advice as to how this would never happen if you were runnning up to date anti virus, but here is a link to the fix. Wake up programmers, you have created much of the problem, and the software does not help much. As a for the record, I have been online since I started using CIS in 1984, and I programmed until the mid 90's.

When is this going to become illegal and really policed?

Typical of the "features" built into Micro$haft's products, isn't it>

Wow, I've never seen or heard of this 'til this article. I suppose there are advantages to working in a secure facility.

Yeah. What Don said.

Bill Gates should take some of his monopoly money and do something about this spam bs. It's WAY out of control. You can't tell me that you can't back-track these spam offenders and shut'em down. I'm getting as many as 500 spams a day or more because I've got an info@my domain.

Boo-hoo-hoo,
That's what you get for using faulty software applications or for trusting google/yahoo to keep you safe. There is this thing called linux...

Too bad most comments are just waving their own flag, as this is an issue. I keep thinking that a non-legal, vigilante type response is the only way to address this issue or a tax on all Email. I wouldlike the tax but acting as a vigilante might be more fun...

Who has time to waste trying to get linux to work? Not me. Thank the deregulation free-market crazies. No enforcement means more spam.

I have a feeling a lot of these big corps are "in-bed" so to say, with these big time spammers.. I wonder how much money they are paid by the spammers to have deliberate security flaws in their software, and what percentage of the sales from people who respond to spam are paid back to the big corps....

I find it rather surprising no-one has ever looked into this possiblity.

If Linux were even a millionth as popular or easy to use as Microsoft products, then the spammers would be all over it as well. Not everybody who uses a computer is a computer programmer.

i have a very simple solution stopping all those lottery winning fake e mails you wont ever hear from them again and it only takes a second of your time works for me every time

I suggest we behead all spammers and post videos of the event. Since these people have no sense of human decency they are not human and, therefore, it would not be a crime.

Our on-line and desktop software "Office Tracker" does not have this issue as it was built to stop all the email passing and blocking of possible scheduling times by have the ability to schedule people or resources if you have the right privileges to do so (Manager or Boss). None of this can you make it to a meeting? If I'm the manager or boss and I check the schedules and you are available I will set the meeting and you will be making the meeting. This just make good sense. The whole meeting request structure is so out of date. This is 2008 and most of us are on-line all the time.

Office Tacker originated in 1992. Very stable and very good company.

for you Linux people Office Tacker is available for Linux and Windows at OfficeTracker.com

RonnieG, if everyone used Linux, then that is what spammers and hackers would be concentrating all of their energy on. No matter whether it's Windows or Linux, they're going to target whichever has the most users.

Larry Lynch, do you really think that we should all be taxed for sending email? Really? You might not want to say that out loud. And please explain to me how vigilante justice works on spammers. How do you find out who they are and where they are? If they're in, say France, are you going to fly there and beat them up?

Calendar spam is one more extremely annoying, intrusive, infuriating scheme that spammers have cooked up; unfortunately, once someone finds a way to make it more difficult for the spammers to do this, they'll have moved on to something else. If people wouldn't respond to spam, there would be no reason for the spammers to keep spamming.

Can anybody say: "Mac"?

I wish I knew more about programming, or tracking down all these letter's from Nigeria, and stuff. As it is, I have emailed microsoft's security department with a forwarded version of the emails. If we ALL did this, and over whelmed THEIR servers with them, maybe THEY would take action against the domains that provide this fraudelent activity. Like I said, I wish I knew more about it, as I wouldn't play fair either.

You can not just filter invitations outside your domain because those maybe genuine invitations to meetings with the customer, vendors and/or other groups within your company.

The real fix is for Outlook to get fixed to give the user control over how calendar invitations are handled. AND to treat the calendar just like email with spam filters and a learning algorithm.

This is not a problem caused by the "programmers", this is an issue of marketing and management shipping out the product before it has been fully developed -it's all financial pressure.

Gee Don. Don't blame the programmers. They write code to specifications set forth by the designers of these systems. The underpinings of these flawed features were probably crafted before security was the major concern it is today. And the crush to get software products out the door often paves the way for concentrating largely on functionality and less on security. "We can tighten it up on the next release" is often the thinking....

Agreed - it is sloppy. It does need to be fixed.

There's a simple way of avoiding this. Don't USE the online calendars, and for Pete's sake, DON'T use Outlook Express, which is buggier than a bait shop. If you have a PDA, use that. If you don't, there are marvelous calendars in all shapes and sizes, made of old-fashioned paper.

I am all for the behading of spammers, these people should be sacrificed to the angry vocano Gods. but Consumer Advocate does make a good point, who knows what the big companies are doing, so I got my pitch fork all rusted up who is with me in linching party....

Since many offers when clicked inform me that this is not available in the area you are located, why doesnt M.S.N block access to canadian isp adresses from spamming by american spammers?For example the I.R.S.has NO interest in me, also bank of america doesnt deal in canada and insurance companies in the U S will not take canadian customers.

Yeah. What Rand from Indiana said.

postini.com
nuff said

Wow... aren't we all impressed by Don, Onaway MI's comments? He so smart. Maybe HE should fix the problem for all of us! ALL IN FAVOR??

Yup ... me and my Missus, we had to stop sending email to each other. Now, we have to talk face to face. Fewer computers, fewer television sets. I might have to start holding her hand again.

I use a program called MailWasher at home. It allows you to delete/bounce messages on the server before you download other legit messages.

One way of at least reducung the amount of spam could be to increase the cost of sending it. I remember several discussions on this idea over the past few years. It won't stop everything, but it might slow the spammers down.

hey Jay - you are just another .1 cent of a CLICK INCOME to them. They don't CARE - THEY DON'T HAVE TO.

When they FINALLY get around to CLOSING the loophole about open servers and even taking ACTION against compromised BOTS, then we can discuss it further.

Right now the whole internet is running "open loop" - no control of ORIGINATION SITE whatever. no TRACING back to the origination WHATEVER

Design flaw? These features do have a purpose as designed because people ASKED for them. If you change the way the features work, it will no doubt annoy just as many people as you placate with the change.

Baseball bats can be used to hurt people... fix all baseball bats so they can't hurt people and you break the game of baseball.

It seems to me that Don and some of the other folks responding have some ideas that could produce some dialog about possible solutions. Starting a dialog is what this could be about and would much more likely lead to some viable solutions instead of suggestions of lynching, beheadings or just plain sarcastic insults! I know that I certainly don't know what to do and anybody who has any ideas I welcome and am grateful.

In case it's not bleeding obvious by now, the solution is not another operating system, but another solution for your mail client. Blind Linux pushers, take heed. If you're using Linux to open Google Mail, the problem will not magically go away.

Dont blame the technology or the law, blame the slime called sales people.

Initiation of spam e-mail as well as telemarketing of all types should be made illegal with SEVERE penalties for violating the law. These unwanted wastes are equivalent to someone reaching out and slapping recipients across the face with every e-mail they send or telephone call they make. Those who initiate these e-mails and those who do unsolicited telemarketing are a scourge to society. They cause significant waste. I suppose one should pity those involved as they obviously have nothing better to do, and hence apparently lead a worthless life of no value to anyone. I would think all would be suicidal as they can't possibly have any self-respect. On the other hand, I have to wonder - why would anyone ever respond to a spam e-mail or unsolicited telemarketing call? Why don't we all work together to end this scourge. We could do things such as always vote for the opposing candidate when a telemarketer calls and asks you to vote for someone (Note: This is something I already do - Sorry Gov. Rendell, your call assured that there would be no vote from here for Hillary Clinton)

For the person who said MAC as a solution-this would only work as long as MAC did not become as popular as Windows/Microsoft. The only reason MACs are "secure" is because they are not used as readily for corporations-book-keeping, etc. so hackers don't bother writing viruses for MACs. Not saying a MAC is not a good computer by any means, I use both MAC & Windows based computers, just saying that most hackers consintrate on the more redily used formats to attack.... As for Spammers/Scammers... I agree legal action needs to be taken-like you can have your phone on a "NO-Call" list to stop tele-market people, they should start working on something similar for e-mail....

The idea of an "no email" list is a good one but unless all spam is from legit senders that obey lists, this wouldn't work. I highly doubt if you were a spammer you would actually. Spammers are usually in it for the money, no matter if they get it by selling a product, by hacking a computer for personal info, or by coning a person.

I love email! If it weren't for email and calendars, I wouldn't get nothing done. This has its feature purpose, and don't not lets get rid of it to those people!

Try reading the article people. This has nothing to do with Microsoft or Bill Gates and this is hardly a problem unique to Microsoft since both Google and Yahoo have the same issues. This certainly has NOTHING to do with the operating system since the last I checked both Linux and Mac can also receive e-mail and go to Google or Yahoo.

Some of the prior comments make it apparent that some of you people are idiots. The fact that you suggest options and solutions that have nothing to do with the problem only confirms it.

Will the government please define spamming as an act of terror and stick Alan Ralsky and the other spammer scum in Guantanamo!!!

Is there a site somewhere where people can and do post the names, addresses, phone numbers, of spammers and their relatives?

Kids, if there are any spammers or children of spammers in your school. . .kick their asses and pick on them maliciously!!!

TonyE is right to say that a system cannot be designed to filter all external emails. Our company relies heavily on creating appointments with our clients and other third parties for our projects. Using a PDA to filter unknown mails before opening in Outlook does help

Ah yes, the splendid idea of a no-email list. Have tens of millions of people register their personal email address on that list. Then make that list available to legitimate marketing companies to filter their email campaigns. Of course, NOBODY would ever think of using that list to send out spam, right?

No-call lists work because there's a massive cost involved in a nationwide telemarketing campaign therefore you only expect real corporations to do it and those follow the rules (mostly).

Whereas the cost of entry in the world of email spam is basically a $10-a-month hosting service and an internet connection.

Imagine what "telemarketing" would be like if phone calls were free worldwide, your home phone line allowed you to place 50 calls a second, and your telemarketing software did the talking for you therefore requiring no actual manpower.

And imagine how many people would do the phone version of the nigerian fraud from overseas and actually USE the no-call list on purpose as a list of "known working phone numbers".

sounds like the email proggie is fuxored by design. If outside vendors need access to your calendar then they should pass some sort of basic screening notifiying the admin that they need access to your schedule. It's not that difficult.

I never want the FCC to interfere with the Internet operation since that would wreck the system, However I believe the FCC should apply what at one time was a rule which essentially stated that "any one deliberately interfering with an 'established communication', upon conviction, be fined $10,000 and/or a year in federal prison. Why can't the Internet be declared an "established communication system" by the FCC and such a rule applied? Any time you send any message via the Internet it travels through some sort of wire or wireless system all of which are under FCC control.
A few convictions of this sort would put a brake on the sending of virus programs and or unwanted spam.
The FCC would not have to touch the Internet itself but rather simply apply the law to the transmission of interference via any electrical communication system.
The welcome openness of the Internet has converted America to a giant carnival in which con-men can operate as they do in carnivals, circuses, and county fairs. We have rules like this with telephone and the Postal Service, why not the Internet??

Technologies initially developed to improve the quality of life for people. But, with every good technology there is a downside. Cars are great for fast transportation, but emit fumes that are bad for the environment. The internet is a marvelous source of information and communication, but it comes with hackers and spam. You can't blame the creators for flaws that they didn't know existed and you can't blame them for the annoying behavior of others. During the days of snail mail we didn't expect the postmaster to keep chain letters and junkmail from reaching our mailboxes. You have to take the bad with the good and if the bad outweighs the good on your scale of universal harmony then you have to make the choice to change something...not just blame someone else to remove your obligation to do something about the problem.

You could just switch to a mail-only client. How can your calendar get bogged down if it isn't included in your mail client?

I must be a programmer behind the times... no cell phone, no cable/satellite, and an OfficeMax desk calendar.

Thunderbird is a great email client, though.

Since the Nigerian scam has been mentioned you will probably be pleased to check out this site: http://www.419eater.com/ They tell you how to make a great sport out of getting back at the slugs that try, and often succeed, at bilking major dollars out of innocent people.

Do people not realize that some spam does come from places outside of the U.S.? All the U.S. laws in the world aren't going to mean anything to some obscure guy in another country sending out emails.

As of this morning I have yet to recieve an unwanted calendar thing. However, I fight spam all day and night. I am an experienced IT Security person and I have come to the conclusion that until the federal goverment does something about this, there is nothing that we can do despite the best security programs and hardware out there today. The goverment needs to do something like police it WITHOUT VIOLATING OUR PRIVACY RIGHTS!!!!!!!!

Even if you make it 'illegal' it gets sent from another country.

Junk faxes get sent from the Bahamas - which has no laws against it - Spammers send junk calendar spam from Rwanda or Croatia where there are no rules and no chance of being caught. R U going to Croatia, hire an investigator, find the owner and haul them to the US just to sue them?

Laws are meaningless since 95% of the world does not live in the US.

Oh Great!

Auto-sync your Blackberry to your e-mail and now your phone is popping up with this junk!

Just what I need!

Oh Great!

Auto-sync your Blackberry to your e-mail and now your phone is popping up with this junk!

Just what I need!

A response to Anthony Ingersoll's comments:

I would not like to see the federal, or any other government, involved with policing the internet. The main reason: When government renders a service to any sector of the economy they expect that sector to provide the money to support the operation, usually in the form of some sort of tax. The last thing I want to see is the government adding an ever-increasing tax burden on internet users. And to justify collecting the tax the government would undoubtedly make their presence visible via an unending series of rules and regulations. I'm not antigovernment, but I am against expanding government into areas where it is not essential.

The internet, mankinds greatest communication development to date, is doing fine. Sure problems like spam and hacking come up. But the free enterprise system eventually finds a way to take care of the problem. I prefer the commercial financial incentive to keep the internet working rather than government taxation and regulation.

This internet situation has gotten ridiculous. Our government facilities have been hacked. Talk about homeland security. I get all these sexual (filthy e-mails in my regular e-mail) I do not even bother to look at my bulk this is automatically deleted. Yahoo, microsoft, google, the federal government should protect us. I did not give any of these jerks my e-mail address and those who sell them should also be punished.

I like the way it tookme quite a while to submit this them I said not to remember me and my message disappeared. I am sick an tired of getting disgusting e-mail not just in my bulke which i delete without lookiing at it but in my regualar mail. The government has been hacked , talk about Homeland security. You talk to customer service for somputer company and virus software and you are talking to India! This greed is disgusting. Microsoft, yahoo, google, HP, the federal government should be held accountable or is this occuring because we owe another country money!! I gave none of these jerks my e-mail address and those that sell our info should be prosecuted also.With all our technology we should be able to block those impoverised countries from doing this. This is so disgusting. And to theose greedy ones you ca't take it with you and neither can the rest.

Eye am a gud speeler.

Forget spammers... concentrate on mastering the English language.

All information selling + trading should be made a crime with severe penalties globally, and start hitting these compaies + providers that do little to prevent it when it occurs over their systems endlessly. Also, at no time should you have to "consent" to allowing your info to be shared, just because you do buisness with someone, or because it's lumped into some "service agreement".
Also it's over due that some serious money get spent to create an effective agency or 2 that sole purpose is to fight and track these people down.

I for one, would be more than glad to see a few less parks built across the country each year, if it meant something serious would start being done about cleaning up the internet.

SEND A COMMENT

PLEASE READ: All comments must be approved before appearing in the thread; time and space constraints prevent all comments from appearing. We will only approve comments that are directly related to the blog, use appropriate language and are not attacking the comments of others. Firms mentioned in our comment area are welcome to add their own comments.

Message (please, no HTML tags. Web addresses will be hyperlinked):

TRACKBACKS

Trackbacks are links to weblogs that reference this post. Like comments, trackbacks do no appear until approved by us. The trackback URL for this post is: http://www.typepad.com/t/trackback/454638/28353588

BUY BOB SULLIVAN'S NEW BOOK

Cover_crunched_by_media Bob Sullivan's new book unmasks hundreds of hidden fees and offers step-by-step instructions on how to fight back. Order it here.

Syndicate this site

RSS is an easy way to get the news you want as it is updated even if you are not on MSNBC.com. More information about MSNBC.com's RSS feeds.

XML