Here we go again - FDF Spam

If you're like me - you've never heard of the FDF file format.

FDF stands for Forms Data Format. It's part of Adobe's PDF file format specification. Not surprisingly, it's used when working with forms.

For all practical purposes, an FDF is a slight variation on the PDF format. In fact, you can rename a PDF file to have an FDF extension, and Adobe Acrobat will open it just fine. Even though they don't know it, most users can readily view FDF files.

Do you see where this is going?

Yes, spammers are now hiding their spam content inside FDF files.

While everyone has figured out not to bother opening PDF files, attached FDF files are something new. Odds are that most users will open an FDF, at least once. All this before many programs to stop spam have even started to deal with the recent waves of attachment-based spam.

Since we haven't received any FDF spam in-house yet, we can't report if SpamButcher's method for dealing with PDF spam will work against it or not. We usually wait to get some evidence first-hand before writing any new code to prevent spam of a certain format. This lets us keep the program streamlined.

The XFDF file format can also be opened by Adobe Acrobat. I'm not sure what it's supposed to be used for, but the smart money says it'll be promoting Chinese penny stocks shortly.

Back