Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Spam Changes Direction

While PDF and image-based attacks skyrocket, spammers quietly shift toward Europe

You think you know where your organization's spam is coming from? Better check -- you may find the pattern has shifted in the past few weeks.

Spam -- and the malware it sometimes bears -- have taken some sharp turns since the beginning of June, and if you aren't watching for them, you could end up on the side of the road, security researchers say.

The biggest shift is the volume of PDF-based spam, which has grown even faster than many researchers predicted when the trend was first reported earlier this month. Security vendor MX Logic yesterday reported a 25 percent increase in spam volume as a result of the image-based spam.

"With PDF spam, the images are embedded within attached .pdf documents instead of within the body copy of the message," an MX Logic spokesperson said. "These messages are much larger than traditional text spam, potentially causing business disruptions due to a dramatic spike in bandwidth utilization."

MX Logic also is seeing an increase in spam that uses text within a PDF document instead of images. "MX Logic expects this shift to continue, and believes that this is truly the next evolution of spam," the spokesperson said. "In fact, as image spam volumes continue to decline, MX Logic expects PDF spam to take its place and greatly increase."

Symantec, BorderWare, and Marshal are among the other security vendors that also have reported a marked increase in PDF spam. (See New Image Spam Threat Uses PDF Files, BorderWare Finds New Trend: PDF Image Spam, and Marshal Warns of New Spam Tactics.)

While many researchers are warning about changes in spam's form factor, Sophos Labs says there also are some quiet shifts in its geography.

"The United States continues to relay more spam than any other nation, accounting for 19.6 percent -- a decrease of just 0.2 percent from the previous quarter," Sophos reported yesterday. "However, Europe now has six entries in the dirty dozen, which when combined, account for even more spam-relaying than the U.S."

Despite the strong presence of the U.S. and European nations in the the top 12 ("dirty dozen"), the sheer number of Asian nations relaying smaller amounts of spam meant that Asia proved to be the biggest spam-relaying continent during the second quarter, Sophos says. While Europe -- which topped the chart in the first quarter 2007 -- has reduced its percentage by 6.6 percent and fallen to second place, Asia, North America, South America, and Africa have all seen rises in spam-relaying activity.

Sophos experts predict further leveling of these statistics over the coming months, as spammers start to take advantage of the growing number of inadequately protected computers in places like South America and Africa.

— Tim Wilson, Site Editor, Dark Reading

  • MX Logic Inc.
  • Symantec Corp. (Nasdaq: SYMC)
  • BorderWare Technologies Inc.
  • Marshal Inc.
  • Sophos plc Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Virginia a Hot Spot For Cybersecurity Jobs
    Jai Vijayan, Contributing Writer,  10/9/2019
    How to Think Like a Hacker
    Dr. Giovanni Vigna, Chief Technology Officer at Lastline,  10/10/2019
    7 SMB Security Tips That Will Keep Your Company Safe
    Steve Zurier, Contributing Writer,  10/11/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Current Issue
    7 Threats & Disruptive Forces Changing the Face of Cybersecurity
    This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
    Flash Poll
    2019 Online Malware and Threats
    2019 Online Malware and Threats
    As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-17660
    PUBLISHED: 2019-10-16
    A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the tolang parameter, as demonstrated by the index.php/admin/translate/sa/index/surveyid/336819/lang/ PATH_INFO.
    CVE-2019-11281
    PUBLISHED: 2019-10-16
    Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input...
    CVE-2019-16521
    PUBLISHED: 2019-10-16
    The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payl...
    CVE-2019-16522
    PUBLISHED: 2019-10-16
    The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the Disable Cookie text. A...
    CVE-2019-16523
    PUBLISHED: 2019-10-16
    The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.