Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Spam Changes Direction

While PDF and image-based attacks skyrocket, spammers quietly shift toward Europe

You think you know where your organization's spam is coming from? Better check -- you may find the pattern has shifted in the past few weeks.

Spam -- and the malware it sometimes bears -- have taken some sharp turns since the beginning of June, and if you aren't watching for them, you could end up on the side of the road, security researchers say.

The biggest shift is the volume of PDF-based spam, which has grown even faster than many researchers predicted when the trend was first reported earlier this month. Security vendor MX Logic yesterday reported a 25 percent increase in spam volume as a result of the image-based spam.

"With PDF spam, the images are embedded within attached .pdf documents instead of within the body copy of the message," an MX Logic spokesperson said. "These messages are much larger than traditional text spam, potentially causing business disruptions due to a dramatic spike in bandwidth utilization."

MX Logic also is seeing an increase in spam that uses text within a PDF document instead of images. "MX Logic expects this shift to continue, and believes that this is truly the next evolution of spam," the spokesperson said. "In fact, as image spam volumes continue to decline, MX Logic expects PDF spam to take its place and greatly increase."

Symantec, BorderWare, and Marshal are among the other security vendors that also have reported a marked increase in PDF spam. (See New Image Spam Threat Uses PDF Files, BorderWare Finds New Trend: PDF Image Spam, and Marshal Warns of New Spam Tactics.)

While many researchers are warning about changes in spam's form factor, Sophos Labs says there also are some quiet shifts in its geography.

"The United States continues to relay more spam than any other nation, accounting for 19.6 percent -- a decrease of just 0.2 percent from the previous quarter," Sophos reported yesterday. "However, Europe now has six entries in the dirty dozen, which when combined, account for even more spam-relaying than the U.S."

Despite the strong presence of the U.S. and European nations in the the top 12 ("dirty dozen"), the sheer number of Asian nations relaying smaller amounts of spam meant that Asia proved to be the biggest spam-relaying continent during the second quarter, Sophos says. While Europe -- which topped the chart in the first quarter 2007 -- has reduced its percentage by 6.6 percent and fallen to second place, Asia, North America, South America, and Africa have all seen rises in spam-relaying activity.

Sophos experts predict further leveling of these statistics over the coming months, as spammers start to take advantage of the growing number of inadequately protected computers in places like South America and Africa.

— Tim Wilson, Site Editor, Dark Reading

  • MX Logic Inc.
  • Symantec Corp. (Nasdaq: SYMC)
  • BorderWare Technologies Inc.
  • Marshal Inc.
  • Sophos plc Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Threaded  |  Newest First  |  Oldest First
    Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
    Robert Lemos, Contributing Writer,  2/20/2020
    Ransomware Damage Hit $11.5B in 2019
    Dark Reading Staff 2/20/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    6 Emerging Cyber Threats That Enterprises Face in 2020
    This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
    Flash Poll
    How Enterprises Are Developing and Maintaining Secure Applications
    How Enterprises Are Developing and Maintaining Secure Applications
    The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2018-19668
    PUBLISHED: 2020-02-27
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-17963. Reason: This candidate is a reservation duplicate of CVE-2018-17963. Notes: All CVE users should reference CVE-2018-17963 instead of this candidate. All references and descriptions in this candidate have been removed to preve...
    CVE-2019-12882
    PUBLISHED: 2020-02-27
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
    CVE-2017-6363
    PUBLISHED: 2020-02-27
    ** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for...
    CVE-2017-6371
    PUBLISHED: 2020-02-27
    Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer header.
    CVE-2017-5861
    PUBLISHED: 2020-02-27
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-1000020. Reason: This candidate is a reservation duplicate of CVE-2017-1000020. Notes: All CVE users should reference CVE-2017-1000020 instead of this candidate. All references and descriptions in this candidate have been removed to...