A new form of spam using MP3 audio files to send a stock
pitch has surged today. Today this audio form of spam has risen
from being virtually nonexistant to become 10 percent of all
spam traffic, according to several security researchers
tracking the phenomenon.
MORE ON MALWARE
Audio Spam Sample (126KB)
How Image Spam Works (via CSOonline.com)
Who’s Stealing Your
Passwords? And How?
PDF Spam on the Rise
Four Plead Guilty to Pump and
Dump Stock Fraud
The outbreak is the latest in a string of tactics from the
past six months which avoid filters by using file formats not
generally blocked or difficult for filters to disassemble and
search. It started with “image spam” which used picture files
to bypass filters. That was followed by spam that used the PDF
file format. Now the audio MP3 version of the spam is spreading
In each case, the primary use of the spam is for a
pump-and-dump stock scheme. The message tries to entice its
viewer (or listener) into investing in a penny stock. If enough
recipients decide to invest, the price surges, sometimes
doubling. The originators of the scheme then dump their shares
at the peak price. The tactic was so effective with image spam
that the SEC halted trading on many penny stocks to stop the
In the audio version, the user receives an MP3 file that is
socially engineered with a name that invites
clicking—either because it is a popular band name or
title that seems personal. Some documented titles include:
dadsong.MP3, oursong.MP3, weddingsong.MP3, santana.MP3,
sayyousayme.MP3, smashingpumpkins.MP3, bbrown.MP3, bspears.MP3,
gloriaestefan.MP3, beatles.MP3; answeringmachine.MP3,
coolringtone.MP3, listentothis.MP3 and elvis.MP3, according to
researchers at Cyberoam, who are tracking the problem.
The files range in size from 88KB to 150KB.
When opened, the user hears a synthesized voice pitching the
penny stock. The quality is extremely poor. Here’s a sample (126KB)
from the labs at SecureWorks, which are also tracking the
SecureWorks senior security researcher Joe Stewart says his
first reaction was that audio spam, while clever, is probably
destined for a lower success rate, both because of the poor
quality of the audio and because of the amount of end user
intervention required. “Who’s going to open a stranger’s MP3
and listen, and what’s the chance they’ll repeat that action?”
says Stewart. “With visual spam, all you have to do is glance.”
What’s more, in many inboxes the visual is displayed as the
message is selected, making it hard to avoid seeing.
Still, these tactics tend to evolve from crude to
sophisticated rapidly. Stewart acknowledges this could simply
be a test run for a better audio spam attack in the future. He
also notes that there didn’t appear to be any malware packed
into the audio file that would download onto a PC, but that
“feature” could certainly be added.
Also, regardless of how many people fall for it, MP3 spam
presents a more basic problem: bandwidth consumption in
transit. As spam evolves to take advantage of bigger files, it
chews up more bandwidth just trying to get to its destination.
This was a significant problem when image and PDF spam peaked,
and researchers now report that MP3 spam is arriving as even
bigger files than image spam.