Audio Spam: The Latest Twist on a Never-Ending Security Threat

Researchers say that small MP3 attachments pitching penny stocks are the latest wave in the ocean of unsolicited e-mail.

MORE ON MALWARE

How Image Spam Works (via CSOonline.com)

Four Plead Guilty to Pump and Dump Stock Fraud

The outbreak is the latest in a string of tactics from the past six months which avoid filters by using file formats not generally blocked or difficult for filters to disassemble and search. It started with "image spam" which used picture files to bypass filters. That was followed by spam that used the PDF file format. Now the audio MP3 version of the spam is spreading rapidly.

In each case, the primary use of the spam is for a pump-and-dump stock scheme. The message tries to entice its viewer (or listener) into investing in a penny stock. If enough recipients decide to invest, the price surges, sometimes doubling. The originators of the scheme then dump their shares at the peak price. The tactic was so effective with image spam that the SEC halted trading on many penny stocks to stop the problem.

In the audio version, the user receives an MP3 file that is socially engineered with a name that invites clicking—either because it is a popular band name or title that seems personal. Some documented titles include: dadsong.MP3, oursong.MP3, weddingsong.MP3, santana.MP3, sayyousayme.MP3, smashingpumpkins.MP3, bbrown.MP3, bspears.MP3, gloriaestefan.MP3, beatles.MP3; answeringmachine.MP3, coolringtone.MP3, listentothis.MP3 and elvis.MP3, according to researchers at Cyberoam, who are tracking the problem. The files range in size from 88KB to 150KB.

When opened, the user hears a synthesized voice pitching the penny stock. The quality is extremely poor. Here's a sample (126KB) from the labs at SecureWorks, which are also tracking the audio spam.

SecureWorks senior security researcher Joe Stewart says his first reaction was that audio spam, while clever, is probably destined for a lower success rate, both because of the poor quality of the audio and because of the amount of end user intervention required. "Who's going to open a stranger's MP3 and listen, and what's the chance they'll repeat that action?" says Stewart. "With visual spam, all you have to do is glance." What's more, in many inboxes the visual is displayed as the message is selected, making it hard to avoid seeing.

1 | 2 |next page »

Comments

Share [+]

Digg This

SlashDot

TOOLS

Comments

Digg This

SlashDot

CENTER OF EXCELLENCE

Security

» New 2008 Report: Outbound Email and Data Loss Prevention in Today's Enterprise
Email, blogging and mobile devices are important business tools, but they expose enterprises to legal, financial and regulatory risks.

» Regulations Shift Focus on Outbound Email Security
Outbound email is essential to running any business today — allowing us to share information, work with partners and even interact with customers.

» Messaging Security Goes Virtual
When it comes to technology investments, virtualization demonstrates drop-dead-obvious ROI.

» Encryption Made Easy: The Advantages of Identity Based Encryption
Growing regulations are pressuring enterprises to find effective, affordable and easy email encryption solutions.

» The Great Email Security Debate: Appliances, SaaS, or Virtual?
Today, there are many ways to approach email security — the question is: what deployment model is right for you?

Center sponsored by