Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Spam Changes Direction

While PDF and image-based attacks skyrocket, spammers quietly shift toward Europe

You think you know where your organization's spam is coming from? Better check -- you may find the pattern has shifted in the past few weeks.

Spam -- and the malware it sometimes bears -- have taken some sharp turns since the beginning of June, and if you aren't watching for them, you could end up on the side of the road, security researchers say.

The biggest shift is the volume of PDF-based spam, which has grown even faster than many researchers predicted when the trend was first reported earlier this month. Security vendor MX Logic yesterday reported a 25 percent increase in spam volume as a result of the image-based spam.

"With PDF spam, the images are embedded within attached .pdf documents instead of within the body copy of the message," an MX Logic spokesperson said. "These messages are much larger than traditional text spam, potentially causing business disruptions due to a dramatic spike in bandwidth utilization."

MX Logic also is seeing an increase in spam that uses text within a PDF document instead of images. "MX Logic expects this shift to continue, and believes that this is truly the next evolution of spam," the spokesperson said. "In fact, as image spam volumes continue to decline, MX Logic expects PDF spam to take its place and greatly increase."

Symantec, BorderWare, and Marshal are among the other security vendors that also have reported a marked increase in PDF spam. (See New Image Spam Threat Uses PDF Files, BorderWare Finds New Trend: PDF Image Spam, and Marshal Warns of New Spam Tactics.)

While many researchers are warning about changes in spam's form factor, Sophos Labs says there also are some quiet shifts in its geography.

"The United States continues to relay more spam than any other nation, accounting for 19.6 percent -- a decrease of just 0.2 percent from the previous quarter," Sophos reported yesterday. "However, Europe now has six entries in the dirty dozen, which when combined, account for even more spam-relaying than the U.S."

Despite the strong presence of the U.S. and European nations in the the top 12 ("dirty dozen"), the sheer number of Asian nations relaying smaller amounts of spam meant that Asia proved to be the biggest spam-relaying continent during the second quarter, Sophos says. While Europe -- which topped the chart in the first quarter 2007 -- has reduced its percentage by 6.6 percent and fallen to second place, Asia, North America, South America, and Africa have all seen rises in spam-relaying activity.

Sophos experts predict further leveling of these statistics over the coming months, as spammers start to take advantage of the growing number of inadequately protected computers in places like South America and Africa.

— Tim Wilson, Site Editor, Dark Reading

  • MX Logic Inc.
  • Symantec Corp. (Nasdaq: SYMC)
  • BorderWare Technologies Inc.
  • Marshal Inc.
  • Sophos plc Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Why Cyber-Risk Is a C-Suite Issue
    Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
    Unreasonable Security Best Practices vs. Good Risk Management
    Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
    Breaches Are Inevitable, So Embrace the Chaos
    Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Current Issue
    Navigating the Deluge of Security Data
    In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
    Flash Poll
    Rethinking Enterprise Data Defense
    Rethinking Enterprise Data Defense
    Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-19010
    PUBLISHED: 2019-11-16
    Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
    CVE-2019-16761
    PUBLISHED: 2019-11-15
    A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the [email protected] npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0...
    CVE-2019-16762
    PUBLISHED: 2019-11-15
    A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any...
    CVE-2019-13581
    PUBLISHED: 2019-11-15
    An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
    CVE-2019-13582
    PUBLISHED: 2019-11-15
    An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.