Calendar meeting links used to spread Mac malware | Hacker News Reader

Calendar meeting links used to spread Mac malware

krebsonsecurity.com

89 pointstodsacerdoti21 comments

From the article: "Malicious hackers are targeting people in the cryptocurrency space in attacks that start with a link added to the target’s calendar at Calendly"

This is only an issue for users of "Calendly" which apparently is some third-party application for calendars. I'm all for recognizing security flaws in MacOS, but it's not like this is a flaw of default apps like the built in Calendar feature of MacOS. It could have easily be framed as "Using Calendly is a security risk".

Calendly isn't really relevant here. The attack vector isn't even delivered through the calendar invite. The "investor" just sends a calendar invite with an intentionally broken link, and then when the meeting time comes and the victim can't connect to it, the attacker exploits their sense of urgency by sending the malicious link over the same Telegram channel where they initially established contact.

I'm not even sure why the post mentions Calendly so prominently. It's orthogonal to the attack, which is a malicious link sent to the user via Telegram.

You’re certainly right that calendly is just a conduit for this attack, and the attackers would simply pick something else if calendly disappeared overnight.

Calendly is really relevant to the article from the perspective of a cybersecurity professional (the majority of Krebs readers). If you’re in security at a bank or crypto company, you better be checking for some of these IoCs and calendly is one place to start hunting.

Isn't this a common failure mode? It's something that kept happening to me by accident in a Microsoft Teams + Outlook combo, where the "Teams meeting" link auto-inserted by Outlook would get stripped out by my preference to send plaintext e-mails. Plenty of work meetings over some year or two involved me or other participants asking on chat for meeting links or invites, until I finally figured out the root cause...

It was more than that. He was told there was some tech issue and given a random script to run that would “fix it”.

This is all social engineering to get someone blinded by money to run a script that installs the malware.

Absolutely. Take any meeting link and add a random character and you’ll get a broken meeting link. You could do this with any meeting app.

This time yes. There's been flaws in the built-in Calendar app as well and reasonable to assume there are others, unfixed ones still.

It's not even really 'using Calendly', it's just 'being tricked into running malicious code', as in there's no exploit as such here, it's just social engineering to get the user to run a supplied script.

I worked for a startup in 2020 as a contractor and they hired a security firm to audit us. Part of that was detailing how susceptible the company employees were to social engineering. What I noticed then is a notification appeared in my calendar that looked like an invitation to a regular zoom appointment. But when you opened the 'meeting' it prompted you to install an exe. I actually think they were using the same vector here. So this whole calendar bug has been known and exploited for a long time.

I get the feeling almost everyone in our company installed the firms PoC malware, by the way. Because afterwards there were PowerPoints on how to avoid such attacks. It's kind of funny. You can invest a crap load in security to protect your companies assets. Taking into mind the most complex flaws you can imagine. But then a simple email campaign or event system ends up taking down an employee. Then they have access to all internal data. These kind of attacks are what the most prolific intruders are using today because they're so easy to mount and hard to defend against. Why invest it like months or years of R & D in the hope of finding a zero-day in some system when you can just get some random receptionist to trust you in a single phone call?

investing a crap load in security and allowing users to execute random exe's from the internet without sandboxing doesn't add up.

> I get the feeling almost everyone in our company installed the firms PoC malware, by the way. Because afterwards there were PowerPoints on how to avoid such attacks.

I'm currently rolling out a phishing / malware training for my team, seems like I should cover this. Can you share some tips on avoiding this?

> Why invest it like months or years of R & D in the hope of finding a zero-day in some system when you can just get some random receptionist to trust you in a single phone call?

Which is why iOS / ipadOS style security is so popular. I know my dad will defeat whatever measure I take to prevent him from installing malware. The only thing that works is restricting him to iPhones/ipads.

Walt, why does macOS not block the app/script? In recent years, it’s become a mess to even run legit software that isn’t signed & notarized, so how does the “script” evade this?

Notarization is for binaries. You can always run a Bash or Python script, I assume Apple Script is similar.

Ok. I don’t know how Apple Scripts are distributed and invoked, but this is starting to sound like a generic “trick user to run a script from the terminal” which is a vector in all OSs. Terminal=power.

The annoying thing is tons of legit projects distribute their scripts on the web and ask you to run them with curl and sh. Normalizing that paves the way for this type of attack.

By default terminal in macOS doesnt have full access to the system, you specifically have to go grant it "full disk access" to get close to that.

Of course that doesn't help when people with no idea what they're doing routinely disable SIP and turn off security features because being asked if you really want to run "ScammyScammersonsScam.app" once is an indignity.

I would imagine gatekeeper would have shown at least one warning but maybe the user just allowed it.

> But clicking the meeting link provided by the scammers prompts the user to run a script

Users blindly clicking "Ok" is the downfall of all tech security.

At the onset of the Ukraine conflict, links like that would pop up in heated anti-Russia threads on Reddit. Maybe some can be found back on archive. This exploit has been out there for awhile and it makes you wonder why it hasn’t been plugged yet.

There's a similar problem on iOS, I've already removed two calendar viruses from family's phones.

That’s not a virus it’s a spam calendar account your family member has accidentally added. That’s not specific to iOS and a different attack to the one described in the article.

Reply on news.ycombinator.com