Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Spam Changes Direction

While PDF and image-based attacks skyrocket, spammers quietly shift toward Europe

You think you know where your organization's spam is coming from? Better check -- you may find the pattern has shifted in the past few weeks.

Spam -- and the malware it sometimes bears -- have taken some sharp turns since the beginning of June, and if you aren't watching for them, you could end up on the side of the road, security researchers say.

The biggest shift is the volume of PDF-based spam, which has grown even faster than many researchers predicted when the trend was first reported earlier this month. Security vendor MX Logic yesterday reported a 25 percent increase in spam volume as a result of the image-based spam.

"With PDF spam, the images are embedded within attached .pdf documents instead of within the body copy of the message," an MX Logic spokesperson said. "These messages are much larger than traditional text spam, potentially causing business disruptions due to a dramatic spike in bandwidth utilization."

MX Logic also is seeing an increase in spam that uses text within a PDF document instead of images. "MX Logic expects this shift to continue, and believes that this is truly the next evolution of spam," the spokesperson said. "In fact, as image spam volumes continue to decline, MX Logic expects PDF spam to take its place and greatly increase."

Symantec, BorderWare, and Marshal are among the other security vendors that also have reported a marked increase in PDF spam. (See New Image Spam Threat Uses PDF Files, BorderWare Finds New Trend: PDF Image Spam, and Marshal Warns of New Spam Tactics.)

While many researchers are warning about changes in spam's form factor, Sophos Labs says there also are some quiet shifts in its geography.

"The United States continues to relay more spam than any other nation, accounting for 19.6 percent -- a decrease of just 0.2 percent from the previous quarter," Sophos reported yesterday. "However, Europe now has six entries in the dirty dozen, which when combined, account for even more spam-relaying than the U.S."

Despite the strong presence of the U.S. and European nations in the the top 12 ("dirty dozen"), the sheer number of Asian nations relaying smaller amounts of spam meant that Asia proved to be the biggest spam-relaying continent during the second quarter, Sophos says. While Europe -- which topped the chart in the first quarter 2007 -- has reduced its percentage by 6.6 percent and fallen to second place, Asia, North America, South America, and Africa have all seen rises in spam-relaying activity.

Sophos experts predict further leveling of these statistics over the coming months, as spammers start to take advantage of the growing number of inadequately protected computers in places like South America and Africa.

— Tim Wilson, Site Editor, Dark Reading

  • MX Logic Inc.
  • Symantec Corp. (Nasdaq: SYMC)
  • BorderWare Technologies Inc.
  • Marshal Inc.
  • Sophos plc Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    DevSecOps: The Answer to the Cloud Security Skills Gap
    Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
    Attackers' Costs Increasing as Businesses Focus on Security
    Robert Lemos, Contributing Writer,  11/15/2019
    Human Nature vs. AI: A False Dichotomy?
    John McClurg, Sr. VP & CISO, BlackBerry,  11/18/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: -when I told you that our cyber-defense was from another age
    Current Issue
    Navigating the Deluge of Security Data
    In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
    Flash Poll
    Rethinking Enterprise Data Defense
    Rethinking Enterprise Data Defense
    Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2011-3350
    PUBLISHED: 2019-11-19
    masqmail 0.2.21 through 0.2.30 improperly calls seteuid() in src/log.c and src/masqmail.c that results in improper privilege dropping.
    CVE-2011-3352
    PUBLISHED: 2019-11-19
    Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modifying and deleting themes. A remote attacker with Zikula administrator privilege could use this flaw to execute arbitrary HTML or web script code in the context ...
    CVE-2011-3349
    PUBLISHED: 2019-11-19
    lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders. A local user can overwrite root-owned files via a symlink, which can allow possible privilege escalation.
    CVE-2019-10080
    PUBLISHED: 2019-11-19
    The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI ...
    CVE-2019-10083
    PUBLISHED: 2019-11-19
    When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.