PDF spam - the latest trend

Ibbenbueren, Germany, – Wrocklage Intermedia GmbH, a leading developer of content security, PDF and digital signature software, has today launched a white paper to explain why PDF spam is so successful and how administrators can fight against it.

Recent research shows that between 60% and 90% of emails received nowadays is considered as spam. The Spam headache for administrators is constantly increasing because spammers are always at least one step ahead of anti-spam software vendors. Spammers registered a considerable success with image spam because the anti-spam software industry failed to come out with proper counter-measures to stop image spam.

Based on their success with image spam spammers improved their methods in June 2007 with a new technique that is even more problematic than image spam.

Instead of embedding the image within the email itself, they ‘repackaged’ it within an attachment using one of the most common file formats in use today – a PDF file.

Currently that means that spammers are not only one step ahead but at least two steps ahead. The reason is that anti-spam vendors do not understand PDF technology and introduce useless filters such as blocking emails which contain a PDF smaller than X KB. How can someone seriously consider this an efficient filter?

Those recently introduced “PDF Filter” do harm organisations more than the PDF SPAM itself. Most businesses today transfer essential documents using the PDF format and cannot afford even one missed document.

To address the PDF spam threat, administrators need to press anti-spam vendors to introduce proper PDF analysis or just drop useless filters and become proactive themselves.

With the Aloaha PDF SDK it is very easy and fast to analyse a PDF document. For example the PDF can be converted to ASCII to find out if it is an image only PDF or to detect some keywords. It is also suggested to count the PDF documents pages because PDF SPAM contains currently never more than one page and one PDF Layer. Even the media size of PDF SPAMs is an indication which can be used to filter out unwanted PDF documents.

In IIS/Exchange it is extremely easy to write a so called event sink/script sink which could be used to analyse emails and drop image SPAM.
Please contact aloaha@wrocklage.de in case you need to implement your own script sink. Wrocklage also offers high performance C++ event sinks.

Visit http://www.aloaha.com/software-development/pdf2txt.php for further information.