Slashdot Mirror
Spam War Takes Out Blog Services
munchola writes "Following on from the story about spammers attacking Blue Security's anti-spam system, CBR is reporting that Six Apart, which runs the popular LiveJournal and TypePad blogging services, has become a collateral victim. Six Apart told its millions of bloggers it had experienced 'intermittent and limited availability for TypePad, LiveJournal, TypeKey, sixapart.com, movabletype.org and movabletype.com', before resolving the issue in the early hours of Wednesday. '[The spammers are] trying to rip apart the internet just to make our community stop fighting back against spam,' Blue Security's chief executive Eran Reshef said, adding that he knows who's behind the attack."
Swamping a spammer is not a good idea, because he can either redirect the attacks to an innocent third party, or simply pointless because they use stolen ressources, like trojaned computers that host illegal sites.
The best way to eradicate spammers would simply be to go after their clients.
fta:
The spammer also launched a conventional bandwidth-consumption DDoS attack against bluesecurity.com. It was around this time that the company opened its new blog, which meant TypePad got whacked.
This blue security article has been running for a few days now and the site hasn't been responding any time I've tried recently.
Isn't it just another DDOS blame fest when in reality its just the news spreading around the world and all the collective users of all the collective news sites are clicking the links to try to read the story?
A total slashdotting/digging/farking and general newsing all at once.
It was the same when word spread about google going down.
"OMG have you heard, google is dead?"
*CLICK* "Yer, its not working here either" *CLICK* *CLICK* *CLICK*
*CLICK* "Hey, its loaded here." *CLICK* "Oh crap, its broken again now.."
We are all guilty of assisting this DDOS attack. shame on us.
It will ease up once something else comes and takes our attention away from it.
liqbase
I don't think spam will stop, or even slow down, until a spammer is seriously hurt or killed. Right now, they know there is no consequence to their actions. I'm not saying I personally advocate killing spammers, but it certainly wouldn't make me feel bad to hear about it being done. Spamming would be a lot riskier if there were an element of harm attached for the spammer.
But have they got any better suggestions. The federal government is a *Joke* about bringing any kind of justice down on this filth, and so the masses remained *outraged* and *victimized*. To me a (A computer tech) I see people's computers every day that have been turned into Zombies. Some so bad that they have to be reformated. They are bringing in their computers to me, and paying hard cash for me to fix it and prevent it from happening again. That's real money, real damages everyone is having to pay every day. I guess you could spin it in a positive light and say it's good for the tech industry, but not if people start becoming afraid to even get on the internet because of what might happen to their computer. This is theft, this is vandilism and the governements of the world are practically standing by and watching it happen.
So, do you have any better suggestions, if not then I kindly ask you to ommit your views until you can add something to the cause.
Go ahead and call me unreliable; reliable is just a synonym for predictable.
All blue frog does is requesting to be opted out. One form send per spam received. No more, no less.
4 of the 10 major spammers had already excluded the blue security list from their mass mailings, and their problem was solved. But this particular spammer, instead of complying, shut down Blue Security.
Just because Blue Frog causes A SIDE EFFECT of disminishing the bandwidth of the spammer's website, is not Blue Security's fault. (It is our LEGAL RIGHT to request for opt-out, and to keep requesting it UNTIL IT IS FULFILLED).
To say opting out is abuse, is nothing but legitimizing illegal (non CAN-SPAM complying) spam.
Speaking as one of the people who helped start the last bluesecurity article, I think we've all had enough time to reflect and debate on the 'fight fire with fire' technique that blusecurity has enacted. What this new DDOS attack has brought to the table is something a little different. Before the attack, Bluesecurity would send an equal amount of opt out requests as spam. THIS DDOS attack on bluesecurity, which is clearly illegal, is the breaking point. I'm not sure WHAT going to break, (of than someones ISP) but it has shed light on spammers intentions. Spam artists have always relied on the fact that their activities arent spefically illegal. With this attack they have really crossed the line- This event could be the event that got some sort of anti spam- legislation rolling, (or it might have the opposite effect). Something should come out of this though, if only to be remembered the 'bluesecurity incident'. Personally I was pretty pissed having some jackass hold my gmail account for ransom, especially since bluesec. was so ridiculously effective. FYI, despite the threats, I have recieved no greater amount of spam than when I was first threatened on monday (sunday). I dont think their database was compromised despite what joe spammer tells us.
The spammer is in Russia. Let's hire the mafia nd take him out. Blue security has 500,000 members. If we all put in $1.00 each, we should manage to hire someone to take the spammer out. He won't be a problem after that, and he won't send any more spam.
First, these idiots set up an "anti-spam" service whose response to abuse is...abuse.
Second, they use a fraudulent corporate name. (Use Google and search Usenet.)
Third, they locate themselves on a network also happens to house one of the scummiest spammers on the planet.
Fourth, they decide to redirect an incoming attack at an innocent third party.
The only surprising thing is how many morons have actually DEFENDED these idiots.
Recommendations:
1. Permanently blacklist their domain(s).
2. Firewall off their network.
As always needs mentioned, Spam would not exist if it didn't have a market. The base problem is, as it has always been, that people respond to this.
People could stop clicking, but that is unlikely to happen. Especially in America, people are always looking for the easier path: be it cheaper medication, promises of enhanced "performance," tales of rapid weight loss while sitting on your couch, or the constant get-rich-quick scheme.
If people actually thought... yes, used higher brain functions... they may realize that it is virtually all just BS.
It could also be that the general masses don't realize that everytime they click on a link or reply to an email, someone is making money. And that is a problem with awareness of how the internet works. Most seem happy to just know that it works.
Just pull the plug on the web server... or
redirct the domain name to 127.0.0.1(taking up to 24-48 hours to update) as one of the other posters posted...
Why I ask is because where I work we had a similar problem and sence I maintain our web server we had no choice but to unpluge the network cable. Waited 5 minutes and pluged it back in and vwala! no more DOS.
My best guess was that as soon as the DOS'er saw that our site was "down" they/it thought that there task was completed.
It is almost( but not quite the same) as if some one took a ethernet cable and created a loop on the same pair of switchs. (i.e. two switches are connected to each other. Then some random idiot looks at them and plugs in a spare cable in to both, creating a network loop.)
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation. Social exper
This is a 24/7 business. A serious online service vendor can't have company holidays. Least of all in the security business.
Does Bluesecurity have a linux or mac client yet? Spammer is an idiot. 1) he raises awareness of what bluesecurity does. 2) he makes it look like BS works -- why else would he waste resources he could be using to spam or extort people, it must be hurting him. Effectively, this is great for PR Bluesecurity -- how much would a worldwide advertising campaign have cost?
What changed under Obama? Nothing Good
"Is it unethical to redirect the DDoS you are getting hit with? Yep, I'd say so if you do it intentionally.
....
Is it illegal? Nope, not in any sense of the word."
Well, I *could* call it "aiding and abedding". Someone does not need to be a robber to be tried as one (think of the guy driving the getaway car).
And I can surely see a case where the provider of the packets causing a DDos would be convicted, and another conviction for someone who directed the flow of those packets to a known party
Maybe you could look at it like this : You might get hit by a large quantity of water, which threatens to damage your property. You are surely permitted to try to get rid of that water. But to transfer the water to a known other person, resulting in his property getting damaged like you where afraid it would do yours is premeditation.
The second, damaged person is then surely within his rights to claim damages. And if the judge is willing, he won't permit the redirector of that water to re-claim those damages from the person who send it in the first place.