We are suddenly getting huge amounts of spam that is simply a pdf file.  We can not block PDF's as they are a common form of document as the spammers well know.  I am surprised this did not happen sooner.  Thoughts on how to correctly identify them and block?

Additional Info:
http://www.sophos.com/pressoffice/news/articles/2007/06/germ an-pdf-spam.html

Edited by Desperado

Desperado,

We've just released SpamFilter v3.5.4.692 in the registered user area. It is a beta that is able to scan within PDF files and is successfully identifying the "stock spam" embedded in them. This new filter is enabled by default and inherits the same settings as the "standard" image filter.

Please note that this new release also includes several major internal improvements and bug fixes. In addition to the new PDF filter, the most notable change involves a bug we discovered with all the triggers in the database (see release notes below). To fix it, SpamFilter will automatically delete ALL triggers and recreate them when it is started for the first time.


// New to VersionNumber = '3.5.4.692';
{TODO -cNew : Added new filter to scan images within PDF attachments for spam}
{TODO -cFix : In SFE, triggers in the database were not identifying multiple updates to the same tables, if they occurred within 5 seconds of each other. A DB patch SQL script will be automatically downloaded and executed once by SpamFilter upon startup. The script will delete all triggers and recreate them}
{TODO -cFix : In installations with multiple SpamFilter Enterprise, changes made directly against the database may not be visible by other servers}
{TODO -cFix : A specific set of circusmtances involving "unfiltered Emails" with the "tag" or "tagsubject" modifiers, and multiple, separate emails within the same SMTP session, could cause emails to be delivered to some unfiltered users if a recipient is in the unfiltered list}
{TODO -cFix : Exception occurred during TFilterObject.ReadFilterFromFile (2): Access violation at address 00401981 in module 'SpamFilterSvc.exe'.}
{TODO -cFix : SpamFilter Enteprise GUI *appeared* frozen during startup when processing several customized domain. The ativity windows now scrolls to show current status during startup}
{TODO -cNew : When adding duplicate entries in the blacklist/whitelists, SpamFilter will automatically remove the duplicate from the database as well, not just in the GUI as before (except for MAPS and Keywords blacklists)}



Edited by LogSat

Has anyone noticed a drop off on the effectiveness of this? I was catching like 25 a day and now its not catching any. Why is that? I also notice in the log it says Scanning PDF for spam:    with no filename after it. Im guessing all those are definately spam.

Is there anything I can do about these? Any suggestions are welcome.

 

I have many samples as well that I can contribute :)

The pdf spam coming in to me contain encrypted text based pdf's with full security turned on. Are these still being scanned, and can you even scan these for keywords?

Thermo

I sent you an email with the pdf attached, this pdf has 128 bit encryption enabled per the document properties in Adobe reader.

Thermo