Spammers find new ways to slip through

By Jon Swartz, USA TODAY

SAN FRANCISCO - Just when it appeared tech firms had the upper hand against spam, spammers have unleashed new forms of the meddlesome e-mail to trick filters.

Spam in the form of popular PDF e-mail attachments and electronic greeting cards is confounding e-mail security systems and annoying consumers. The recent Storm e-mail virus and several pump-and-dump stock scams are clogging inboxes and snookering consumers into downloading malicious software. And it could get worse as the holidays approach, anti-spam experts say.

The trend illustrates the shifting nature of spam's deceptive packaging. As anti-spam vendors come up with solutions, new versions pop up. The most common spam - which uses images to avoid the detection of spam filters - is quickly fading because of advances in anti-spam technology.

But spam in PDFs, non-existent in May, now accounts for 8% of unsolicited commercial e-mail. Last week, a PDF promoting a pump-and-dump scam contributed to a 30% increase in overall spam. It was sent from compromised PCs turned into spam-spreading bots, security firm Sophos says.

Faux electronic-greeting cards, containing links to viruses, have also picked up. Since mid-July, security firm Postini has blocked about 800 million copies of Storm, an e-mail virus masquerading as a greeting card. "It's a cat-and-mouse game, and PDFs are the latest twist," says Adam Swidler, senior marketing manager at Postini.

Spammers also are beginning to use Excel and Zip files.

As spam evolves, from text in the body of e-mail to images embedded in attachments, it has become more difficult for filters to identify, says Tom Gillis, co-founder of IronPort Systems, a security firm acquired by Cisco Systems (CSCO). "There is a social engineering element to this. People are more likely to open a PDF file or Excel document, which are more trusted."

continue here