RE: New Spam Technique

["Alison Hell" <ijwafea () gawab com>]

Hi list
This may be an example:
Name:  Kalpesh 
Mailadress: Kalpeshisen () schmelzer-brauhaus de
Content: bill-*the part from the emailadress(no @xxx.xxx)*
Text: *none*
attachment: payment.pdf
text of the attachment: u cant copy it

I uploaded this file:
http://www.file-upload.net/download-369170/payment.pdf.html
web.de detects that spam

mfg allison


I am using GFI MailEssential - and it success with 95% of these spams ..

Mohamed Farid ,, 

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of Banyan He
Sent: Tuesday, July 24, 2007 11:23 AM
To: Wheeler, Eric
Cc: WALI; tony barry; Security Basics Forum
Subject: Re: New Spam Technique

Hi Wheeler,

Can you pls show us some samples about it?

What the antispam appliance do you have?

Regards

Wheeler, Eric wrote:

> > I was trying to think of a way to block this but its rather difficult
> > when the email + the subject line + the attachment + the attachment
> > contents are different every time 
> >
> > -----Original Message-----
> > From: listbounce () securityfocus com
>   
[mailto:listbounce () securityfocus com]

> > On Behalf Of Banyan He
> > Sent: Saturday, July 21, 2007 9:41 AM
> > To: WALI
> > Cc: tony barry; Security Basics Forum
> > Subject: Re: New Spam Technique
> >
> > Bad news, that pdf attachment contains the advertisement or the image.
>   

> > Actually, there is no appliance works on this perfectly. The pdf size 
> > should be big or small.
> >
> > WALI wrote:
> >   
>   
> > > > Read, the nuances of catching pdf spam:
> > > >
> > > > http://www.techworld.com/security/news/index.cfm?newsid=9031
> > > >
> > > > ----- Original Message ----- From: "tony barry" <tony () no-bull co nz>
> > > > To: "Security Basics Forum" <security-basics () securityfocus com>
> > > > Sent: Thursday, July 19, 2007 11:04 PM
> > > > Subject: New Spam Technique
> > > >
> > > >
> > > >     
> >     
> > > > > > Hi List,
> > > > > >
> > > > > > We operate several mail servers with catch all accounts and have
> > > > > >       
> > >       
> > noticed
> >   
>   
> > > > > > a lot of Mailer Daemon 'delivery failed messages mails from genuine
> > > > > > sites (mostly German)arriving recently. It would seem the spammers
> > > > > >       
> > >       
> > are
> >   
>   
> > > > > > sending out e-mails with a PDF attachment and a forged senders
> > > > > >       
> > >       
> > address
> >   
>   
> > > > > > to bogus recipients at these organizations whose mail server rejects
> > > > > >       
> > >       
> > the
> >   
>   
> > > > > > message and sends notification to the forged sender. We have opened
> > > > > >       
> > >       
> > one
> >   
>   
> > > > > > attachment on an isolated machine and it was one of the 'watch these
> > > > > > stocks they're going through the roof messages (not exactly sure of
> > > > > >       
> > >       
> > the
> >   
>   
> > > > > > details as my German is a bit rusty). My concern is that there could
> > > > > >       
> > >       
> > be
> >   
>   
> > > > > > a 'payload' embedded in the PDF. Is this possible?
> > > > > >
> > > > > >
> > > > > > -- 
> > > > > > The Simple Server Company
> > > > > > PO Box 51528 Pakuranga
> > > > > > Auckland
> > > > > >
> > > > > > 021 413642  09 5768552
> > > > > >
> > > > > > http://www.simpleserverco.com
> > > > > >
> > > > > > This e-mail and any attached files transmitted with it are
> > > > > >       
> > >       
> > confidential
> >   
>   
> > > > > > and intended solely for the use of the addressees. If you have
> > > > > >       
> > >       
> > recieved
> >   
>   
> > > > > > this e-mail in error please inform the sender by sending a reply and
> > > > > > delete this message.
> > > > > >       
> > >       
> > > >     
> >     
> >
> >   
>   

-- --------------- Banyan He Email&Web Security MSN: 
banyan.he () hotmail com Skype: banyan.he Email: banyan () rootong com 
Website: http://www.rootong.com * * * * * * * * * * * * * * * * * * * * 
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * 
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * 
* * * * * * * * * * * This e-mail (including attachments) is classified 
as Mediterranean Smart Cards Company confidential and proprietary 
information The recipient hereby is committed to hold in strict 
confidence the contents of this (e-mail, document, and information) and 
not to disclose to any third party without the prior written consent of 
Mediterranean Smart Cards Company. Recipient will be held liable for any 
unauthorized disclosure. It is intended solely for the addressee. Unless 
you are the addressee, you may not read, copy, use or store this e-mail 
in any way, or permit others to. If you have received it in error, 
please notify the sender by return e-mail and delete the message in its 
entirety, including any attachments * * * * * * * * * * * * * * * * * * 
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * 
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * 
* * * * * * * * * * * * *



---------------------------------------------
Free POP3 Email from www.Gawab.com 
Sign up NOW and get your account @gawab.com!!