Apple investigating iCloud Calendar spam solution

Posted:
in iCloud edited November 2016
Apple on Wednesday released a statement regarding a recent spate of spam iCloud Calendar invitations, saying it is working to address the issue by identifying and blocking suspicious invite senders.




Apple acknowledged the issue, which became a problem for many iCloud users in recent weeks, in a brief statement to iMore's Rene Ritchie, who subsequently shared the response via Twitter.

"We are sorry that some of our users are receiving spam calendar invitations. We are actively working to address this issue by identifying and blocking suspicious senders and spam in the invites being sent," Apple said.

The company failed to detail how, exactly, it plans to target offending users.

Over the past week, spammers have increasingly turned to Apple's Calendar service instead of sending advertisements and other promotional content through email, effectively bypassing potential spam filters. Depending on system settings, iCloud Calendar invites are pushed out directly to connected iOS and Mac devices, which in turn trigger an onscreen notification that must be accepted or denied.

Further, interacting with an iCloud Calendar invite automatically sends a response to the sender, meaning spammers can easily determine whether a particular account is active.

An innocuous problem compared to malicious data breaches and hardware hacks, iCloud Calendar spam has nevertheless become a thorn in the side of Apple device owners used to a spam-free experience.

While Apple works on a backend solution users can manually redirect Calendar invites to Mail instead of the Calendar app. To change this setting, users must sign in to iCloud.com on a Mac or PC, navigate to the Calendar web interface and click on Settings, represented as a small gear icon at the bottom left of the screen. Select Preferences > Advanced, navigate to Invitations and choose Email to [email address]. This method will deactivate push notifications for all Calendar invitations, including legitimate requests.

Alternatively, users can simply turn off Calendar notifications on their iOS device by navigating to Notifications > Calendar in the Settings app. The settings pane includes options for switching off notifications for incoming invites or all Calendar events.

Users who want to rid their calendar of spam invites without alerting spammers have to undertake the arduous process of creating a dedicated spam calendar, adding all spam invites to said calendar, then deleting it.
gtr
«1

Comments

  • Reply 1 of 33
    Good, it's driving me mad.
    dysamorialightknight
  • Reply 2 of 33
    Users who want to rid their calendar of spam invites without alerting spammers have to undertake the arduous process of creating a dedicated spam calendar, adding all spam invites to said calendar, then deleting it.
    Haha! "Arduous"? The whole process took me about a minute and a half to clear out 5 spam invitations, from "Spam" calendar creation through to deletion. 
    gtr
  • Reply 3 of 33
    mtbnutmtbnut Posts: 199member
    "The company failed to detail how, exactly, it plans to target offending users."

    Damn, at least give them more than 5 minutes before declaring that they've failed? Didn't this just start happening a few weeks ago? Maybe 'did not' instead of 'failed to'?
    Rayz2016dangermouse2StrangeDays
  • Reply 4 of 33
    So far, I've only received one spam invitation, but it really freaked me out since it was a type of spam I've never seen before. I though the sky was falling until I searched and found others reporting the same issue. I still don't fully understand the mechanism that allows this to happen.
    edited November 2016
  • Reply 5 of 33
    When I tried to move the offending ads, Calendar would not let me, saying that only the creator of the invite could modify it. Since I don't use iCloud Calendar, I just deleted and recreated the Home calendar. I have since redirected such invites to email, where they will be easily disposed of.
  • Reply 6 of 33
    cornchipcornchip Posts: 1,945member
    fortunately haven't been hit by these.
  • Reply 7 of 33
    Apple could crowd-source the identification of spam iMessages. If users consistently pointed out spam upon arrival, Apple algorithms could spot the pattern pretty damn quick and block further communiques from that device and number.
  • Reply 8 of 33
    netroxnetrox Posts: 1,415member
    I got a few spam invites and it angers me that Apple did not think of this potential problem. First of all, do NOT click "Decline" because it will send a response to spammers letting them know you READ it. Second, it should NEVER send invites without your whitelist. Third, it should be a way to DELETE an event easily... and guess what? There's no way to delete the event without hitting "Decline" which is a big no no since it will inform the spammer you exist.
    dysamoriajasenj1
  • Reply 9 of 33
    netrox said:
    There's no way to delete the event without hitting "Decline" which is a big no no since it will inform the spammer you exist.
    As the article states,  and I have done, just create a new calendar called, for instance, "Spam", move the invites into that calendar and then delete the Spam calendar. The invite is now gone and you don't have to accept or decline it. 
  • Reply 10 of 33
    netroxnetrox Posts: 1,415member
    netrox said:
    There's no way to delete the event without hitting "Decline" which is a big no no since it will inform the spammer you exist.
    As the article states,  and I have done, just create a new calendar called, for instance, "Spam", move the invites into that calendar and then delete the Spam calendar. The invite is now gone and you don't have to accept or decline it. 
    Yes and it's way too much trouble. 
    dysamorialightknight
  • Reply 11 of 33
    My problem is I can't log in to icloud.com on a computer to change that one simple preference. Every time I try to log in, Apple tries to force me change my Apple ID password. Apparently it doesn't meet their criteria for "safe" even though every other iCloud interaction doesn't have a problem with my password. Only icloud.com. And I'm not going to change my password for this one stupid, simple preference. 

    Apple needs to put all the preferences that are available on icloud.com available in the iOS settings app. 

    Rant over. :) 
    dysamoriajasenj1
  • Reply 12 of 33
    waltgwaltg Posts: 90member
    Two issues Apple has messed up on here! One, you can't delete the invite,, two, you can't turn off the invites!! I NEVER use this part on the calendar and I should have the ability to turn it off!
    dysamoria
  • Reply 13 of 33
    guyrguyr Posts: 50member
    If you ONLY have an iPhone or iPad, you can NEVER visit icloud.com and see the same things as if you are on a Mac/PC - so you can't change the settings... So the only option is to create a new Junk Calendar and go that route. So Apple, please also allow a pass through to the web options too, or and this might be crazy, have those same settings available on the web also available through the App settings on an iOS device...
    edited November 2016 dysamoria
  • Reply 14 of 33
    netrox said:
    netrox said:
    There's no way to delete the event without hitting "Decline" which is a big no no since it will inform the spammer you exist.
    As the article states,  and I have done, just create a new calendar called, for instance, "Spam", move the invites into that calendar and then delete the Spam calendar. The invite is now gone and you don't have to accept or decline it. 
    Yes and it's way too much trouble. 
    Too much trouble? It takes less time than it took for your original post. 
    StrangeDays
  • Reply 15 of 33
    boredumbboredumb Posts: 1,418member
    mtbnut said:
    "The company failed to detail how, exactly, it plans to target offending users."
    Damn, at least give them more than 5 minutes before declaring that they've failed? Didn't this just start happening a few weeks ago? Maybe 'did not' instead of 'failed to'?
    I think I read in Communities someone reporting one in July.
    I had three around Black Friday, but since I directed them to eMail, I haven't seen one, so I guess
    one or more of the 295 Rules I've set (usually pointlessly) might be working, deleting them
    before I see them...maybe?  It's nice Apple is looking at it, but it doesn't seem good that it could
    have happened in the first place, and it really sucks that you appear to need a Mac to address it...
    (I couldn't find a way around it on my iPhone, but, that's normal :s)
  • Reply 16 of 33
    wigginwiggin Posts: 2,265member
    netrox said:
    There's no way to delete the event without hitting "Decline" which is a big no no since it will inform the spammer you exist.
    As the article states,  and I have done, just create a new calendar called, for instance, "Spam", move the invites into that calendar and then delete the Spam calendar. The invite is now gone and you don't have to accept or decline it. 
    Have you actually tested that this does what you think it does? I've seen it documented at least twice elsewhere that people have tested this with someone they know and deleting the "Spam" calendar still sends the decline response to the other person. Are we certain that this advice isn't being just being blindly passed on from one web site to another without anyone actually verifying that it's not sending a decline?

    I also hope that whatever Apple is working on also takes care of the spam photo sharing invites that show up in Photos. Much less common but that's out there, too.
  • Reply 17 of 33
    netrox said:
    netrox said:
    There's no way to delete the event without hitting "Decline" which is a big no no since it will inform the spammer you exist.
    As the article states,  and I have done, just create a new calendar called, for instance, "Spam", move the invites into that calendar and then delete the Spam calendar. The invite is now gone and you don't have to accept or decline it. 
    Yes and it's way too much trouble. 
    Too much trouble? It takes less time than it took for your original post. 
    Seriously, it's a nuisance not only to do it, but to explain to coworkers the workaround. Yes it's too much trouble, how hard is it to have a 'decline don't notify' button?
    youl see this has been an issue for some years now, bout time it got a simple fix.
    dysamoria
  • Reply 18 of 33
    Rayz2016Rayz2016 Posts: 6,957member
    Weird thing is that spammers have taken so long to catch on to this. Filtering out the spam invitations is one solution, though unless Apple has an AI trick we haven't heard of yet, this is never going to be 100% successful. 

    Seems to me that a better solution would be to:

    create an an option that would only allow invitations from people in your address book

    create an option that would only allow invitations from people you've replied to before

    and, the most obvious one, allow people to delete  invitations without sending back a response. 
    dysamoriajasenj1zoetmb
  • Reply 19 of 33
    cxxccxxc Posts: 2member
    Rayz2016 said:
    Weird thing is that spammers have taken so long to catch on to this.
    It's actually been happening for some time now, but it's becoming more widespread now.

    People complained about this on Apple Communities back in 2012:  https://discussions.apple.com/thread/3705591?tstart=0
    dysamoriaRayz2016
  • Reply 20 of 33
    tyler82tyler82 Posts: 1,100member
    guyr said:
    If you ONLY have an iPhone or iPad, you can NEVER visit icloud.com and see the same things as if you are on a Mac/PC - so you can't change the settings... So the only option is to create a new Junk Calendar and go that route. So Apple, please also allow a pass through to the web options too, or and this might be crazy, have those same settings available on the web also available through the App settings on an iOS device...
    Just click on the share arrow in Safari, and there is an option for "request desktop site." That will give you the full web page as if you are viewing from a computer.
    guyr
Sign In or Register to comment.