[PBARC] PDF Spam

[WOLF, EARNEST G]

Security vendors and users agree that image spam is finally on the
decline, but at the same time a new kind of spam is emerging that uses
an attached PDF file to trick recipients into buying stock in a company.
Image spam, which has plagued antispam filters for the past year, is
finally on the decline as e-mail security vendors have tweaked their
products to block it, says Paul Henry, vice president of technology
evangelism with Secure Computing. Image spam has long fooled filters
because the message's text is embedded in an image found in an e-mail's
body, and filters until recently couldn't decipher images. At the
beginning of July it comprised about 38 percent of all spam and is now
down to about half that volume, says Henry.
Stats from Symantec also show the volume of image spam, which the
company says began to decline in May, has continued to shrink from its
all-time high of 52 percent of all spam sent in January.
"Image spam does seem to be decreasing ... Antispam software, RBLs
[real-time black lists] and other filtering techniques have done a good
job at decreasing the previous spammers' attempts; it is now time for
them to find a new avenue to annoy us," says Jim DeSantis, enterprise
messaging architect with Abhir Technical Consulting.
Beginning to take image spam's place is PDF spam, where the spammer
sends an e-mail message with a PDF attached -- which most spam filters
can't read -- that attempts to convince the recipient to purchase
stocks. So far security vendors are reporting two types; a
professional-looking PDF of a newsletter pumping a German company's
stock that security company IronPort says was sent more than 5 billion
times in its first few days, and a more rudimentary PDF attachment
containing text that pumped a stock which Symantec says was sent to more
than 30 million users over a 10-day period in late June.
So far, PDF spam isn't approaching the volumes that image spam has
enjoyed -- Secure Computing's Henry says in early July it accounted for
about 4 percent of all spam sent -- yet this new spam trick could prove
to be significantly more malicious. Henry says proof-of-concept code
exists that demonstrates security vulnerabilities in PDF files, which
means PDF spam could carry malware that is secretly downloaded on the
recipient's PC. Image spam was only dangerous to those recipients who
bought the stock that messages were touting and likely lost money on it.
"I haven't seen any malware yet in PDF spam ...but I'm keeping my eye on
it," Henry says.
PDF spam does hold some potential for spammers who are advanced enough
to take advantage of the technology, some say.
"Simply attaching a PDF to an e-mail and randomizing the size and name
of the title, to me, does not seem all that impressive, but it seems to
be working," says Kyle Ohme, director of technology with W3i.com, an
interactive marketing services provider.
"I'm interested to see how far this will go, as some may start to use
some of the more advanced functions of Adobe to place beacons and other
tracking mechanisms that have become limited in the past years," Ohme
says.
Malware-laden or not, PDF spam is an example of how spammers will
continue to innovate in order to get their messages across.
"The battle between spammers and spam-filter vendors will always be a
game of cat and mouse. The tools are definitely getting smarter ... the
better the tools the more creative spammers will be," says Sharon
Finney, information security administrator with Dekalb Medical Center in
Decatur, Ga. "I am seeing some increases in PDF spam, but no real volume
yet. All spam is a nuisance regardless of the technology behind it. I
don't think that any one type of spam is more of a nuisance than any
other."

Thanks,
Glenn