Why PDF Spam Will Stick Around....And Why it Will Not

Thanks to the new Storm Worm variants over the past few weeks we have been seeing a large increase in PDF spam. PDF Spam currently comprises between 10-15% of the overall spam volume that we see in the MX Logic Threat Operations Center.

I've mentioned before that I think PDF spam is here to stay, but I'd also like to present a counterpoint to my own argument so that I can say that I have looked at both sides of this coin.

The primary reason that PDF spam might not last as a delivery mechanism is that it is terribly inconvenient for the end user. Everyone has heard it by now:

"Don't open attachments from people that you don't know"

"Don't open attachments from people that you do know if you weren't expecting what they sent"

Blah Blah.

Image spam was uniquely annoying in that the image rendered itself directly within the body of the email message. If you opened the message (and didn't have images blocked by default) you were automatically presented with whatever advertisement accompanied it. No fuss. No muss. In order for a user to view the content of PDF Spam they have to consciously double click the attachment within their email client.

Clearly, despite advice to the contrary, people are still opening whatever attachments come into their inbox otherwise this tactic for both spam and malware distribution wouldn't still be so popular. If the purpose of PDF spam is to get the user to take action, however they need to make the delivery of the content as convenient as possible. Forcing the user to open the attachment flies in the face of that paradigm. Besides that, it generally takes between 15 and 30 seconds just for Acrobat Reader to open! I barely even care what the content is after that amount of time, much less have any desire to act on it!

So then why PDF spam to begin with? Because it worked! Will it stick around? I still think it will, but in order to continue to be viable the tactic will need to become much more refined.