Stats show surge in PDF and ZIP spam

Data collected by SonicWALL from its Smart Network database of over 1.3 million e-mail users shows ongoing growth in the volume of spam, virus and phishing attacks, increased use of PDF spam and the emergence of a new wave of Excel and Zip spam. The results were based on aggregated results from the SonicWALL Smart Network from April to July, 2007.

SonicWALL’s analysis shows that Directory Harvest Attacks (DHA), Denial of Service (DoS) and similar attacks decreased by 2% over the quarter, but still accounted for 55.7% of e-mail flowing into inboxes. Spam, viruses and phishing attacks, increased by 4% from Q1 2007, and comprised 37.4% of all e-mail, with the remaining 6.9% being Good email – a 3% increase over Q1 2007.

During the second quarter of 2007, PDF spam emerged as a persistent threat. These types of e-mail attacks typically contain little to no text in the body but attach a PDF file, usually a stock or drug spam message containing malicious code, which, if opened, can be automatically downloaded onto a victim’ s computer. SonicWALL believes the widespread adoption of PDF spam illustrates the adaptability of spammers in finding new techniques to counteract image spam prevention techniques.

“PDF spam demonstrates the continued innovation in spam techniques that attempt to bypass anti-spam detection and trick employees into opening e-mails that give the appearance of legitimate business letters,” said Andrew Klein, senior product manager for SonicWALL’s Email Security division. “PDF spam is effective because files in PDF format have long been considered an acceptable way for businesses to transfer information. Much like phishing emails, spammers have manipulated the trust factor to get past both technical and psychological defences.”

More recently, SonicWALL has detected an increasing amount of Excel and ZIP file spam. Utilising the same trust-busting premise as PDF spam, Excel and ZIP spam succeed because they mimic legitimate correspondence to get more eyes to view the message.

Klein commented, “Think about how many times you’ve fired off a PDF or ZIP file to someone with no message or a simple note along the lines of ‘Here it is’. Spammers are mimicking this behavior. As a result, it is difficult to educate email users as to which emails to open and which to ignore. The results are that if a PDF spam message gets into a user’s Inbox, it is has a much higher likelihood that it will be opened than a traditional spam message.”