Blocking New Kinds of Spam: Check Content not File Types
The recent a drop in image spam and an increase in PDF spam is no surprise. Once detection rates improve beyond a certain point, its worth the time and effort of spammers to find another tactic. It also means we're not done with spam once we get better at detecting PDF spam. The SecuriTeam Blog is reporting DOC spam now.
It's hard to know what percentage of spam is now coming through as PDFs, here are some widely varying statistics on PDF spam from SecurityFocus
While security firms agreed that PDF files started regularly appearing as spam attachment about mid-June, estimates for the volume of PDF spam varied somewhat between companies. MessageLabs, which filters out virus-laden and spam e-mail messages for its clients, estimated that about 30 percent of all spam now uses PDF files. Security firm McAfee had a more modest estimate that 2.6 percent of all junk e-mail messages carried PDF files. While Symantec, the owner of SecurityFocus, has found the fraction varies between 2 and 7 percent.
The volume of PDF spam will fluctuate and other document types will be used. The problem is that shortcut measures, like allowing all PDF files through but blocking image files will no longer work. It's the content, not the file type that needs to be analyzed.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
Comments
Checkout a module I wrote called “PDFassassin” which is a plugin for SpamAssassin.
This can scan emails for PDF attachments, uses the pdftotext utility to extract the text for Spam messages, and also extracts images and uses OCR to pin-point Spam messages embedded in pictures.
This plugin can really help prevent the wave of PDF spam messages from hitting your mbox
Details at:
http://blog.atmail.com/?p=61
The arms race continues!
Posted by: Ben Duncan | July 23, 2007 10:02 AM
This could be helpful but now we have to deal with image spam (including 3D images) and other forms of document spam.
I'm afraid spammers will keep changing tactics as fast as we can train filters with new detection patterns.
Posted by: Dan | September 5, 2007 7:00 PM