Comments on World's Smallest PDF

Julia Wolf commented on 'World's Smallest PDF'

2010-07-02T09:33:44Z

> Do you want to make a post / analysis about this http://seclists.org/fulldisclosure/2010/Jul/7 case?

I suppose I could, though it's not terribly new or interesting. There is a ton of this sort of activity every day, and has been for years. This particular spam campaign was also pretending to be from wordpress.com, also saying that you'd just signed up for an account, with all links leading to that infectious PDF. (Which used one of three possible exploits, all at least a year old.)

Using the message attached to that FD post, this particular article of spam was send from 202.13.62.5. Observe:
[...]
> Received: from TUHWJATY (unknown [202.133.62.5])
> by stg.iki.fi (Postfix) with ESMTP id 26EC819D5C
> for ; Thu, 1 Jul 2010 13:25:28 +0300 (EEST)
> Received: from 202.133.62.5 (port=0267 helo=[swaraj])
> by mail.ragoarts.com with asmtp
> id 981EFE-000841-91
> for ______hack.fi; Thu, 1 Jul 2010 15:56:02 +0530

> Someone from the IP address 202.133.62.5 has registered the account "fgeek" with [...]

The IP address of the spam drone is included in the body text, as well as the recipient username. Every single message is like this, just with the corresponding values filled in.

If it wasn't 2:30am, and I didn't have something else to be finishing right now, I'd probably lookup the name of whichever particular spam bot this is.

(I've redacted the email address of the recipient, just to avoid that much more spam sent to them.)

I think you'll find this illuminating:
http://www.google.com/search?q=http%3A%2F%2Fchipsnchils.com%2Fwordpress.html

Henri Salo commented on 'World's Smallest PDF'

2010-07-01T17:19:54Z

Do you want to make a post / analysis about this http://seclists.org/fulldisclosure/2010/Jul/7 case?

Comment commented on 'World's Smallest PDF'

2010-06-24T22:17:09Z

ePDFViewer on Ubuntu show "encrypted document. Enter password" popup.

Julia Wolf commented on 'World's Smallest PDF'

2010-06-22T01:15:25Z

Yeah, I expect that *everything* except for Adobe Acrobat 9.1.3 is going to error out. This PDF file is way-way-way out of spec. Older versions of Acrobat won't even read this.

joe blow commented on 'World's Smallest PDF'

2010-06-22T00:50:04Z

Same for okular on gentoo.

Error: PDF file is damaged - attempting to reconstruct xref table...
Error: Couldn't find trailer dictionary
Error: Couldn't read xref table

Robin commented on 'World's Smallest PDF'

2010-06-21T21:20:31Z

evince in Debian fails to read the 71 byte version:

Error: PDF file is damaged - attempting to reconstruct xref table...
Error: Couldn't find trailer dictionary
Error: Couldn't read xref table
Error: PDF file is damaged - attempting to reconstruct xref table...
Error: Couldn't find trailer dictionary
Error: Couldn't read xref table