Spammers’ New Technique with PDF Files Works Successfully

Spammers have started to use attachments in PDF (Portable Document Format) in their unsolicited commercial e-mails in an attempt to avoid corporate filters, according to IBM's ISS X-Force's new research.

PDF spam appeared on the scene in the early days of June 2007 and by the end of the month, it comprised of 4% of the total junk e-mails. The figure then increased to 6-8% during early July 2007, said Ralf Iffert, a researcher at IBM's ISS X-Force's team. Pcpro published this in news on July 23, 2007.

Usually spam filters can't detect PDF documents and that is why spammers are conveniently using this technique. Moreover, since organizations use PDFs as a business instrument, most spam filters are designed to let them through.

The activity of spamming with PDF has started in small trickles, which indicates that spammers now are just experimenting with the method. However, many e-mail users will find this type of spam successfully placing itself in their inboxes, said Iffert.

The report highlights that if the development of PDF spam is similar to that of image spam, then probably PDF spam was responsible for 20% of total spam. In fact, the voluminous increase of this type of spam occurs much more rapidly compared to the two-year time that image spam took to evolve.

One of the earliest PDF-based spam scams appeared in a pump-and-dump stock scheme that Nick Kelly of McAfee's Avert Labs detected. McAfee has estimated that 2.6% of the junk messages contained PDF documents.

Kelly said that his organization was able to predict the presence of PDF spam because it is far easier to automate .pdf files than other file formats. With the decline in .gif type of image spam, spammers are expected to find similar techniques to deliver image spam, Kelly observed. Vnunet published this on July 23, 2007.

In another recent research by malware services company Commtouch, there is a rise in PDF attachments as image spam slows down and spamming methods converge. At the end of Q2 2007, PDF-based spam increased and during one large-scale attack, it accounted for 10-15% of total spam.

Related article: Spammers Continue their Campaigns Successfully

» SPAMfighter News - 8/3/2007