PDFs: Potentially Dubious Files as spammers try new tack

Stuart Corner
Friday, 29 June 2007 08:05

Business IT - Security

Email and Internet content security provider Marshal says a new form of spam has emerged: spam messages contained in a PDF document sent as an email attachment.

According to Marshal, the attached pdf in the spam email has the file name 'username_report.pdf' with the username being the same as the recipient’s name in their email address). Marshal says this personalisation of the file name makes the message appear more legitimate.

The new spam technique was first used in a recent pump 'n dump spam outbreak [the practice of promoting a cheap stock in order to inflate its price. At which point, the persons pumping the stock dump their own shares at a profit] that promoted a German company’s stock. According to the Marshal Trace team, "we can now expect to see ongoing use of PDF attachments to communicate spam messages."

Bradley Anstis, Marshal's director of product management, said: "spammers believe that many anti-spam solutions largely ignore PDF files. As we recently reported, pump 'n dump spam has declined dramatically and part of the reason for this is overuse of this method. Users are more savvy and can more readily identify a financial scam. With the recent PDF spam outbreak, the spammers have attempted to add credibility and legitimacy to their messages in an attempt to fool users."

Anstis added that the increasing use of zombie networks and spambots favoured the use of this form of spam. "In the past, spammers avoided this kind of spamming method because attaching file types like PDFs greatly increased the size of the message. Historically spammers used their own servers to send out spam and were inclined to keep the spam size small, enabling them to send out more messages. Now with the widespread use of zombie networks and spambots, the spammers are less concerned with the size of the message. The spammers have tens of thousands of infected PCs at their command and are able to move large volumes of spam of this type."