Spammers using PDF to avoid detection

gallery

Spammers are beginning to use PDFs in unsolicited junk mail in a bid to evade detection by corporate spam filters, according to new research.

According to Ralf Iffert, a researcher at IBM's ISS X-Force threat analysis team, spam using PDFs came onto the radar in early June. By the end of the month, this type of spam accounted for four per cent of all junk emails.

Iffert said soon after the first PDF spam was identified, another email was sent containing different attachments, with the PDF containing a single image of text written in wavy lines - characteristic of image-based spam.

"By the current small trickle of activity, it's obvious to us that spammers are simply experimenting with the technique now," said Iffert. "However, as you have probably seen in your own inbox, they are having some success."

But there was glimmer of hope in that the PDFs are identical at the binary level, which meant that a signature could be developed to counteract this threat.

Iffert said that on 6 July more PDF spam was identified and has now reached six to eight per cent of all spam.

"If PDF spam evolves like image-based spam did, then we have to prepare for the possibility that PDF spam could account for 20 per cent or more of all spam," said Iffert. "In fact, we may see this kind of volume increase happen much faster than the two-year rise of image-based spam."

Email to a friend

Print this page