Hello, welcome to the Thursday, October 20th, 2016 edition of the Sand Center and Storm Center's Stormcast.

My name is Johannes Ulrich, and it I'm recording from Baltimore, Maryland.

Xavier wrote up some interesting span that he received recently with a calendar file as an attachment.

Now, I've seen these attachments before.

Typically, the point here is to have that appointment added to your calendar automatically,

which some mail clients will do,

and then, of course, the reminder essentially will amplify the spam.

In this case, however, it looks like they played a little bit a different trick.

What they did is they added 50 different participants to this appointment

and then they're counting on the recipient of the email to cancel the appointment, which will send an email to all 50 participants, essentially distributing the spam even further.

Interesting approach, because this way the attacker actually only has to send one email and gets the victim to amplify these emails to the 50 different recipients.

You should definitely not configure your mail client to automatically add appointments.

There should at least be a prompt asking you if you want to have them added to your calendar

and then just delete them if you don't like the particular invite if you want to have them added to your calendar and then just delete them if you don't like

the particular invite if you think it is spam and do not cancel or otherwise respond to these

messages.

And the process used by Komodo to verify ownership of domains for SL certificates had an interesting

vulnerability if you try to verify a Belgium or European domain. These are the dot BE or dot

EU domains. Turns out that for those particular top level domains, you cannot get a text

representation of the who is information that includes the owner's email address and commonly

that is used to verify the ownership of a particular domain. Instead, these particular top-level domains only offer this data in image form

in order to prevent spammers from harvesting the data.

...