Spam War Takes Out Blog Services

munchola writes "Following on from the story about spammers attacking Blue Security's anti-spam system, CBR is reporting that Six Apart, which runs the popular LiveJournal and TypePad blogging services, has become a collateral victim. Six Apart told its millions of bloggers it had experienced 'intermittent and limited availability for TypePad, LiveJournal, TypeKey, sixapart.com, movabletype.org and movabletype.com', before resolving the issue in the early hours of Wednesday. '[The spammers are] trying to rip apart the internet just to make our community stop fighting back against spam,' Blue Security's chief executive Eran Reshef said, adding that he knows who's behind the attack."

Comments

Is Blue Security going public with who's behind it

[ciscoguy01]

Is Blue Security going public with who's behind it?
He should, so we can put on the pressure.

Fighting abuse with abuse is bad

[Pig Hogger]

Fighting abuse with abuse is bad.

Swamping a spammer is not a good idea, because he can either redirect the attacks to an innocent third party, or simply pointless because they use stolen ressources, like trojaned computers that host illegal sites.

The best way to eradicate spammers would simply be to go after their clients.

Re:Fighting abuse with abuse is bad

[ciscoguy01]

The best way to eradicate spammers would simply be to go after their clients.

That hasn't worked yet. If you have some idea how that could be accomplished and effective against spam and spammers, please feel free to elaborate.

Blue security seems to be causing pain to spammers, enough to get a rise out of them at least. Aren't they actually reflecting the spam back to the source? I think that was their tactic.

If they are effective, that's a net positive in the spam fight.

Re:Fighting abuse with abuse is bad

[jtdennis]

isn't that counter to what you have in your signature?

Re:Fighting abuse with abuse is bad

[Whiney Mac Fanboy]

Blue security seems to be causing pain to spammers, enough to get a rise out of them at least. Aren't they actually reflecting the spam back to the source? I think that was their tactic.

I'm not so sure - read the last paragraph of the article:

Neither Reshef nor TypePad's Sippey were comfortable talking about the technical details of the attack. Sippey said he did not believe it used the potent "DNS amplification" technique that emerged earlier this year.

It seems a little...vague.

I'm thinking there's at least the possibility that Blue Security's 'swamping' program is being used against them (hitting some innocent bystanders on the way).

Even if that's not the case here, it's certainly possible for someone malicious to subvert Blue Security's agent in such a manner.

Re:Fighting abuse with abuse is bad

[isaacklinger]

This would be possible if more resources were diverted to fighting organized crime (and spam). Some countries do it, some don't.

Re:Fighting abuse with abuse is bad

[nox6xul]

I'm thinking there's at least the possibility that Blue Security's 'swamping' program is being used against them Well. It IS open source.........

Re:Fighting abuse with abuse is bad

[suv4x4]

Fighting abuse with abuse is bad.

Agreed, it's bad. Also when someone kicks you or hits you or whatever, if you beat him up, that's really bad.

But you know what? It works. And in the end of the way, that's all that matters.

Re:Fighting abuse with abuse is bad

[PopeRatzo]

Fighting abuse with abuse is poetic justice. Maybe Blue Security's technique wasn't perfect, but I think the idea of "taking down" spammers using the same tools that they use to steal our bandwidth is a very appropriate idea. And the clients of spammers should DEFINITELY be targeted. Anybody who believes they have the right to force us to see their advertisements, whether we want them or not, is among the worst kind of internet criminal. We know that spammers are tied to organized crime, which indicates they might also be involved with politicians, so I'm not surprised that the people who we count on to keep us safe from this kind of abuse have been ineffective. That internet users have decided to take matters into their own hands does not surprise me, nor do I worry about some spammer getting a little bruised, financially or otherwise, in the process. That's how little respect I have for those who would use spam.

Re:Fighting abuse with abuse is bad

[ciscoguy01]

Even if that's not the case here, it's certainly possible for someone malicious to subvert Blue Security's agent in such a manner.

It seems blue security has been compromised by the spammers.
I can't see why blue security should be blamed- except for their security problem.
The problem is spam and spammers, and it is ludicrous to think otherwise.

I have been working on the spam problem for >10 years.

The problem is lax ISPs and network operators who don't pay attention to their mail. Who don't jump on the trojaned machines on their network that are causing >90% of the spam problem in the world.

I have had the same trojaned machine sending me the same spam every 15 minutes, from a school district. It took me days to finally get a shitty response out of the network operators there to get that machine shut down until it could be cleaned. They didn't seem concerned at all, it was like I was "bothering them" to ask them to stop that machine from spamming.
I bet it was sending 150,000 messages between the ones I received. Obviously a major problem. They couldn't care less.
Now THEY should have been DOS'd.

Ya know, several years ago I asked one of the principles of Akamai to get involved, to provide some of the bandwidth and hosting in a fault tolerant fashion, which they reportedly are in a unique position to provide on their monitored distributed network. Practically cannot be effectivedly DOS'd. They thought my proposal "interesting" but didn't want to get involved for the good of the internet, because they didn't want to attract attention from the bad guys.
It wasn't 5 or 6 months before they were DOS'd and extorted.

EVERYONE is involved now. We are all being extorted by the spammers. If you cross them they will attack you, even if you just ask them to please stop spamming you.

The only possible answer is responsibility. Networks being responsible for what goes on over their network. Shut down spammers. Don't rent them servers. Don't sell them bandwidth. Jump on problems, even on weekends and holidays, and you have to do it FAST.

Nothing is going to stop spam completely, we can only increase the cost to spammers, and increase the costs for networks to sell to spammers. Make it uneconomical to have spammers as customers.

When the cheapest T-1 a spammer can find is $250,000 a month, spam will stop.

Re:Fighting abuse with abuse is bad

[deroby]

Actually, I very much doubt that the BS client (aka 'the frog') is causing all the traffic. Most likely it's the spammer's bot-net (aka zombies) that's responsible for all the traffic causing the DDOS. Not quite like it's costing the spammer a lot , but on the other hand he probably would rather have that infrastructure being used for other things.

Don't know why but there seems to be a lot of posts going around pointing at BS as if they're /Modus Operandi/ is to DDOS other sites. I'd like to repeat : IT ISN'T ! Simply put : a user gets a spam mail in his in-box, forwards it to the BS-server and BS finds out which company is being promoted. Next, the user has a client running that downloads the name of the relevant website and a script on how to fill in the opt-out request and executes it. That's it. A simple 1 to 1 relation.

All this could easily be done manually, but it would take quite a lot of time for the user. Automating it like Blue Security did makes it so that more people will end up actually sending the opt-out request (rather than simply letting out a sigh and pressing the delete button) and hence the owners of given websites will hopefully start to understand that they rather should revert to different strategies than spam for making money. Apparantly these websites are usually hosted on low-cost infrastructure that is not happy receiving hundreds, thousands, if not ten-thousands opt-out requests the day after one of there spam-puppets send out a couple of million emails.

My 2 cents

PS: I've been using the BS client for quite some time now and I'm very pleased with it actually. Like on of the posters said : "If the spammers are starting to feel it enough to react, than BS must be doing something right.." Couldn't agree more.

Re:Fighting abuse with abuse is bad

[leuk_he]

Blue security seems to be causing pain to spammers, enough to get a rise out of them at least. Aren't they actually reflecting the spam back to the source? I think that was their tactic.


That logic is wrong. But in that tradition:

The ememy is increasing it effort and sending more troups to us to fight us, we must be winning!

-- Mohammed Saeed al-Sahaf Iraqi Minister of Information. 8)

Re:Fighting abuse with abuse is bad

[QuietLagoon]

That hasn't worked yet.

It hasn't been started yet. There have been no large-scale operations to find those companies/entities who pay the spammers money to send spam. I saw one investigative report in a MSM newspaper that actually tracked some of the spam money. The companies who were purchasing the services of the spammers were not companies you might think would do it. However, beyond that one article, I've never seen anything that goes after those who pay the spammers for their services.

You want to get rid of spam? Go after those who give the spammers money.

Re:Fighting abuse with abuse is bad

[prgrmr]

I've been using the BS client for quite some time now and I'm very pleased with it actually

I'm guessing you are professional managment, yes?

Re:Fighting abuse with abuse is bad

[Jett]

I do agree this is a clever method and puts some hurt on the spammers (and is fully legal under the stupid CANSPAM opt-out provision) - but does it actually reduce spam? To me it looks more like BS has poked a hornets nest here, do we have any evidence the spammers have really been hurt at all?

Re:Fighting abuse with abuse is bad

[Kadin2048]

Well, one assumes that if it wasn't hurting them in some way, then they wouldn't be wasting a lot of time, money, and resources (albeit stolen ones) to attack Blue Security. Their response alone is enough to make want to continue this. Obviously they're doing something right if they've gotten somebody evil this pissed.

Re:Fighting abuse with abuse is bad

[Kadin2048]

Actually it was pretty conclusively said in the last Slashdot article on this topic that Blue Security wasn't compromised, what happened is that some spammer (which apparently they know but aren't releasing? That doesn't make much sense...anyway) took their spam-list, ran it through Blue's list-cleaning program which removes all BS subscribers, and then ran a diff on the result in order to get a list of people who'd signed up for Blue Security.

Then he/she/it sent the people on this resulting list a lot of threatening emails, implicating a breach of BS's security, when in truth nothing like this had to have happened. The people who got "compromised" were already on the spam lists anyway.

The rest is just a DDoS attack, nothing about that reflects on BS's security one way or the other.

Re:Fighting abuse with abuse is bad

[Just Some Guy]

They didn't seem concerned at all, it was like I was "bothering them" to ask them to stop that machine from spamming. I bet it was sending 150,000 messages between the ones I received.

And you didn't redirect the flood to their personal accounts why? Nothing seems to get a problem fixed quite as quickly as putting it back on the people causing it.

Re:Fighting abuse with abuse is bad

[ender-]

I do agree this is a clever method and puts some hurt on the spammers (and is fully legal under the stupid CANSPAM opt-out provision) - but does it actually reduce spam? To me it looks more like BS has poked a hornets nest here, do we have any evidence the spammers have really been hurt at all?

Do you not think that the fact that the spammers are angry enough to try to retaliate gives evidence that they have been hurt, or are at least fearful of being hurt by this method?

Re:Fighting abuse with abuse is bad

[DavidTC]

Poking hornet's nest is a good thing if the hornets get so riled up the start stinging everyone, including the fucking owner who lets them run wild and sting everyone, aka, the people paying the spammer.

Re:Fighting abuse with abuse is bad

[bezzeb]

Guys, I'm growing tired of the high moral argument that "it's not right to fight abuse with abuse" or "eye for an eye still leaves you blind".

War and drama asside: I keep waiting for someone to make this point but I'm not seeing it yet.

Spam is a solicitation to contact the advertised party in the hopes that you will give them money. Otherwise known as an advertisement. THEY CONTACT US. It's called the free market. In turn we all have the right to use the communication path they supply to request that they leave us alone.

Is it illegal to contact some company you see on a billboard or in a TV commercial? What absurdity! What is this world coming to where everyone gets sucked into DDoS drama at every chance? Blue Froggers are just doing business within the realm of the law. No stretching the rules. No sensationalism.

The only reason spammer servers crash is because they aren't prepared and are poorly designed. They have two options:
1. Seriously upgrade their infrastructure to handle whatever degree of responses their advertisements generate & hire more staff to process the hits their ad generates.
=or=
2. Seriously decrease their advertisements to be in line with their capacity to manage their generated trafic.

It's just economics and common sense. This DDoS talk is a waste of time - the Blue Frog client is much nicer to the spammers than they are to us. And this huge amount of anger directed at Blue Frog is proof that it bites into their freedom to be irresponsible.

They can keep their pill pushing sites - I don't care if there are suckers out there dumb enough to give them money. I just want them to stop bothering ME. They will never get one red hot cent from me. They WILL get endless trouble from me as long as they continue to disrespect my privacy.

All the best folks!
B.

Re:Fighting abuse with abuse is bad

[daniel_mcl]

I can think of plenty of ways to go after the clients. For instance, start a spam site selling "V1agra." Simultaneously produce a product called "V1agra" which consists of cyanide and strychnine, with instructions in fine print saying that it's only for pesticide use. Or or a message saying, "Guess what we did with your credit card number." Personally, I'd take credit card numbers, and then use their credit cards to run ads in their local papers announcing in huge type that this person was supporting the people who send you all that spam.

Re:Fighting abuse with abuse is bad

[spyrochaete]

Best reply I've seen on /. all month!!! Concise and irrefutable!

Re:Fighting abuse with abuse is bad

[deroby]

Not even close, and happily staying away from it too =)

Re:Fighting abuse with abuse is bad

[BLKMGK]

What makes you say they have been compromised?

I've been running their client for MONTHS now and the most recent upgrade is much improved. It integrates with GMAIL and HotMail to make reporting SPAM quite easy. The result has been my reporting lots more SPAM to the system. It's no wonder to me that they are feeling the heat - my client has been working overtime submitting opt-out requests :-) I'm happy to use the bandwidth to help this cause out and would encourage others to do so too...

Re:Fighting abuse with abuse is bad

[iminplaya]

That hasn't worked yet.

Is it even being attempted? The prevailing attitude is when you show that the customer is every bit as responsible for the problem, you're labeled as a "pro-spammer". Revenge is the word of the day. That's what people are always calling for. So any real solution is buried in the chaff. The subject of spam is just like Middle East politics. Emotion rules the day, and logic and reason get thrown out the window. Look for this to be the next power grab by the government in their quest to control the internet. Well, that and "kiddie porn". The public's cry of, "Do something!" will only result in more bad, unenforcable law. You aren't going to stop a guy from separating a fool from his money. As long as spam is profitable, there will always be spam. Just because we haven't found an effective way to deal with the customer yet, doesn't mean we can't. This is the direction we need to look. We need to reduce the demand. So, the next time a spam house gets raided, the authorities ought to take a good look at the list of clients and send out notices that they can be fined for purchasing from a known spammer. Most customers, while greedy and ignorant, aren't hardened criminals, and will be fairly easy to "scare straight".

Re:Fighting abuse with abuse is bad

[arodland]

Those aren't the "clients", those are the "idiots". Spammers are people who send the messages. Clients are people who pay spammers to send their messages. Victims are people and ISPs who have to cope with the useless load that spam causes. Idiots are the people who get spam, think "This $5 Rolex is just what I need so that I'll always know when to take my prescription-free C,41iS" and click on the link.

Re:Fighting abuse with abuse is bad

[thrillseeker]

in that tradition: The ememy is increasing it effort and sending more troups to us to fight us, we must be winning!

Well, if you quit - then you've certainly lost.

Re:Fighting abuse with abuse is bad

[deroby]

It's an indirect approach.

The spammer does not get 'hit' directly, but his "sponsors" (as they were called somewhere) are.
I'm sure the "sponsor" won't be pleased once this system gets enough momentum to actually interfere with his commercial activities, and hopefully he will think twice before giving another "incentive" to the spammers.
Hence, the spammer will see his income diminish and either has to focus on other "sponsors", or find a different means of income.
I'm sure some of these guys are not stupid and will find a way to put their IQ to some other, hopefully a bit less anti-social, means. Those that wish to fight the battle to the bitter end, well, good luck to them but I'm convinced that in the long run they're fighting a losing war...

Re:Fighting abuse with abuse is bad

[Joebert]

If you have some idea how that could be accomplished and effective against spam and spammers, please feel free to elaborate.


I think it hasn't worked because, spammers are their own biggest clients.
I'd be intrested in seeing records for every credit card & payment system fraud case in the last 5-10 years, I'd like to see the companies theese cases are linked to, how long the companies involved stay in business, I think there's alot more going on than meets the eye with spam.

Re:Fighting abuse with abuse is bad

[From A Far Away Land]

While it's not ethical or legal to launch a DoS attack on spammers, it might in theory prompt the people with the hosed computers to seek professional help to get fixed.

Re:Fighting abuse with abuse is bad

[Mister Whirly]

Because 99.999% of the time they are coming from either forged or "borrowed" email accounts.

Re:Fighting abuse with abuse is bad

[Mister Whirly]

"Agreed, it's bad. Also when someone kicks you or hits you or whatever, if you beat him up, that's really bad.

But you know what? It works. And in the end of the way, that's all that matters."
sounds like someone is gunning for a Bush cabinet position...
"The end ALWAYS justify the means" is a crap statement....

Re:Fighting abuse with abuse is bad

[c0sine]

Well, $250,000 for a T1 isn't possible, because of the free market competition and everything. However, if there will be an FCC regulation asking every ISP to set a limit of free emails coming out of a person each months it might help.

Say, one can send 2000 emails a month for free and can have unlimited number of incoming emails. Then every email message above the limit will cost you $0.20 or something. So, if you're a spammer and are sending 150K+ messages every day - your business won't pay back.

One of the main historic lessons we can learn from, is that the crime is getting faint when there are no favorable economic conditions for it to blossom. E.g. US (and Russia lately) had the restrictions on distribution of heavy liquors. As the result - a lot of bootleggers' activity, huge wave of the crime in that field, and so on. Is there many bootleggers around nowadays when you can go to Safeway and get yourself whatever you feel like right now almost 24/7 ?

I think you got the idea.

Re:Fighting abuse with abuse is bad

[Anne Thwacks]

Its easy ... All products advertised via spam require payment by credit card. All the credit card companies are American owned. If the US governrment told the credit card companies their banking licences would be revoked if any of their merchant account holders were caught advertising through spam, Spam would stop within 7 days.

However, I prefer the alternative approach involving drive-by shootings.

A combination of both might be better :-)

Re:Fighting abuse with abuse is bad

[Just Some Guy]

Because 99.999% of the time they are coming from either forged or "borrowed" email accounts.

No, not the accounts of the alleged senders, but the accounts of the mailadmins that refuse to fix their systems. Something along the lines of

if topmost-received-from == 'brokenhost.example.com' {
redirect 'lazyadmin@example.com';
}

in the mail filtering language of your choice.

Re:Fighting abuse with abuse is bad

[suv4x4]

sounds like someone is gunning for a Bush cabinet position...

I thought I'm replying to an article about spammers, but of course just come here, take my statement and apply it to your political views, it should make enough sense so you can say your thing, right?

Or maybe not.

There's times when you gotta keep quiet or try diplomacy, or try legislation and arguing with words. There's also times when you gotta fight back.

But maybe you think the world is black and white and everything falls in one category.

Re:Fighting abuse with abuse is bad

[ciscoguy01]

Actually it was pretty conclusively said in the last Slashdot article on this topic that Blue Security wasn't compromised, what happened is that some spammer (which apparently they know but aren't releasing? That doesn't make much sense...anyway) took their spam-list, ran it through Blue's list-cleaning program which removes all BS subscribers, and then ran a diff on the result in order to get a list of people who'd signed up for Blue Security.

In other words, the spammers harvested the contents of the Blue Security server.

Which explains why people don't leave VRFY on anymore, nor do they send more than a few NDRs (non delivery reports). To prevent that. Oops.

Re:Fighting abuse with abuse is bad

[ciscoguy01]

Uh, the welcome greeting from my inbound server:

"250 xxxxx.net there will be a $9.78 charge for spam attempts, continued attempts confirms your agreement" Or some such.

Re:Fighting abuse with abuse is bad

[ciscoguy01]

Not quite like it's costing the spammer a lot , but on the other hand he probably would rather have that infrastructure being used for other things.

Not so sure about that. I have had actual examples of bounce messages generated by the spammer's own server because the recipient server was down, for 2 years, and they kept pounding away. They never ever took the bad domains out of their spam list. And this was a pseudo legit spammer. (Snotty Scotty)

Obviously at least some spammers can't be bothered to even remove invalid addresses. Bandwidth to burn.

Re:Fighting abuse with abuse is bad

[Buran]

If your computer is bombarding me with spam, I will have no qualms about reporting you to your ISP and getting you cut off. Why? Because you are sending spam in violation of the terms of service. But you claim it's not your fault? Yes, it is, because you are responsible for your own equipment. It is up to you to not allow strangers to install stuff, and if they do, you are expected to remove it.

So no, it's not pointless to take out the resources the spam is coming from. Don't want to be taken out? Don't fucking spam people.

Re:Fighting abuse with abuse is bad

[Buran]

In other words, the spammers harvested the contents of the Blue Security server.

Which is precisely what they got stung for. They are specifically told that if they spam those addresses, there will be consequences. They are supposed to be able to figure out who is on the list. They abused it. So of course they're in deep shit now. It's like a baby who does something just because you tell them not to. But then, we all knew that spammers were childish assholes ...

Re:Fighting abuse with abuse is bad

[hughk]

The best way to eradicate spammers would simply be to go after their clients. A long time ago, the UK had a lot of problems with pirate radio stations. Rather than go for the station which was situated conveniently offshore, they went for the advertisers. Without advertising the stations collapsed.

With spam, the key is to follow the money. Obviously someone is making serious dollars out of the C1alis, etc. They need credit card clearing and bank accounts. Nobody can tell me these are untraceable these days.

As someone once said, follow the money.

Re:Fighting abuse with abuse is bad

[budgenator]

Most customers, while greedy and ignorant, aren't hardened criminals, and will be fairly easy to "scare straight".
I don't believe that Expenses incured in criminal endevors are tax deductable, so maybe an IRS Audit would scare up some money to pay down the debt and scare a few others put of the business. It's been a while since I got a spam that I actually saw that didn't seem illegal in some ways like illegal drug distribution or mis-represented produces or even outright fraud.

Re:Fighting abuse with abuse is bad

[budgenator]

PigHogger has been on my foes list for years now, and he still hasn't gotten a clue.

Re:Fighting abuse with abuse is bad

[torokun]

Two steps to solve the problem:

1. An automated verification service for your ownership of domains.

2. An automated system that allows you to send requests to ISPs to block packets from certain people to your domains. The system would use a service to verify your ownership of your domains (with digital signatures), then add rules to block that spammer's traffic to your domains.

Re:Fighting abuse with abuse is bad

[Gary W. Longsine]

From your post:

Fighting abuse with abuse is bad. Swamping a spammer is not a good idea, because he can either redirect the attacks to an innocent third party, or simply pointless because they use stolen ressources, like trojaned computers that host illegal sites.

From your sig:

Swamp the US Justice dept. with Google sex searches. [zapto.org]

I laughed out loud! Cognitive Dissonance

Re:Fighting abuse with abuse is bad

[cparker15]

The best way to eradicate spammers would simply be to go after their clients.

Darn! So, the guns, knives, beatings, mailbombs, cyanide, anthrax, botulism, molotov cocktails, psychic attacks, creepy phone calls at inappropriate times of day, DDoS attacks, avian flu, electric chair, sledgehammers, drive-by shootings, cement shoes, slow dismemberment, asphyxiation, bloodletting, faulty parachute, waterboarding, [...goes on for a few days...] won't do it, huh? Shame...

I'd like to see a spammer redirect those attacks!

Re:Fighting abuse with abuse is bad

[bockafer]

In a world where ACLs were free but we live in the real world where ACLs consume memory and processor.

Re:Fighting abuse with abuse is bad

[fusion9290991]

Just a thought: If a zombie PC is hosting a spam website, then surely a DoS of any type aimed at that PC might just wake the user up to the fact that they're infected (coz their net access goes tits up). Maybe then they'd sit up and take notice?

user - OMG!!11!. I can't get onto my blog about ponies LOL!!!!?!!. OMG!!!1
isp - well sir, there's an inordinate amount of what appear to be mailing list unsubscription requests aimed at your IP address
user - eh? what's an IP address????
isp - we strongly recommend that you call your local IT support people and get someone to secure things for you.
user - will I be able to see pictures of ponies again?!?!?!?!??!!!!!!

etc.

Re:Fighting abuse with abuse is bad

[dodobh]

Spam is a solicitation to contact the advertised party in the hopes that you will give them money. Otherwise known as an advertisement. THEY CONTACT US. It's called the free market. In turn we all have the right to use the communication path they supply to request that they leave us alone.

Spam is unsolicited bulk messaging. The problem with spam is that the recipient pays. In terms of hardware, in terms of time, in terms of network resources.

Sender pays doesn't scale to email.

People who use content filters compound the problem.

Re:Fighting abuse with abuse is bad

[AdamD1]

You have just crystallized what I have been thinking about this issue. Thanks for being so succinct. Hear hear!

ad

Re:Fighting abuse with abuse is bad

[torokun]

That cost would be borne by the ISP. They would then have a good incentive to get rid of the problem.

Re:Fighting abuse with abuse is bad

[bockafer]

This would simply not scale. It isn't a consideration of money but of available resources on the routers.

Re:Fighting abuse with abuse is bad

[torokun]

Well, China seems to be able to do it somehow.

Blame fest

[LiquidCoooled]

fta:
The spammer also launched a conventional bandwidth-consumption DDoS attack against bluesecurity.com. It was around this time that the company opened its new blog, which meant TypePad got whacked.

This blue security article has been running for a few days now and the site hasn't been responding any time I've tried recently.

Isn't it just another DDOS blame fest when in reality its just the news spreading around the world and all the collective users of all the collective news sites are clicking the links to try to read the story?

A total slashdotting/digging/farking and general newsing all at once.

It was the same when word spread about google going down.
"OMG have you heard, google is dead?"
*CLICK* "Yer, its not working here either" *CLICK* *CLICK* *CLICK*
*CLICK* "Hey, its loaded here." *CLICK* "Oh crap, its broken again now.."

We are all guilty of assisting this DDOS attack. shame on us.

It will ease up once something else comes and takes our attention away from it.

Re:Blame fest

[plaid_piper]

I heartily agree with you on this. We all joke about giving something a good /.'ing, but when it happens to something we don't like or is a secuity risk, then it's a DDoS.

I, for one though, try never to check on a site that is said to be down. Simple IT concept: If the bandwidth is overloaded, checking it remotely is not going to help the problem.

Re:Blame fest

[caluml]

And you didn't even link to the site so we could see if it was back up yet.

Re:Blame fest

[shark72]

" Isn't it just another DDOS blame fest when in reality its just the news spreading around the world and all the collective users of all the collective news sites are clicking the links to try to read the story?"

No. Here's what happened:

1. The spammer DDOSed bluesecurity.com. Quite well, in fact.
2. After a few days, Blue Security managed to get a redirect going to a blog they put up on blogs.com, which is run by TypePad.
3. The spammer then DDOSed TypePad.

Believe me, TypePad gets Farked/Dugg/Slashdotted every day. They can handle the normal traffic spikes. This was deliberate, and it was well documented.

"We are all guilty of assisting this DDOS attack. shame on us."

A drop in the ocean. TypePad can absorb these sorts of things. Make no mistake: TypePad was taken down by a deliberate, coordinated DDOS attack.

Re:Blame fest

[forevermore]

the site hasn't been responding any time I've tried recently.

That would be because SixApart got the registrar/dns host to point bluesecurity.com to localhost (127.0.0.1) so unless you're running a webserver on your own box, you won't get anything.

The main news behind this story isn't that a spammer is attacking SixApart, but that bluesecurity, which claims to be a consumer-friendly anti-spam service, in its time of crisis chose not to just take the hit, but instead shared their misfortune with a huge community of unrelated people. Their solution was to repoint the DNS entry for bluesecurity.com to their blog. They did not ask, the didn't even inform SixApart that it would be happening. They completely took out the network of an uninvolved company for 4 hours, and until SixApart got the bluesecurity DNS record changed, service for their customers was minimal at best.

I don't care what the motives were behind bluesecurity's stunt. Anyone dumb enough to pull a trick like this deserves whatever they have coming to them from SixApart's lawyers.

Re:Blame fest

[Spy der Mann]

...bluesecurity, which claims to be a consumer-friendly anti-spam service, in its time of crisis chose not to just take the hit, but instead shared their misfortune with a huge community of unrelated people.

Sure, they make a mistake ONCE, and suddenly they're a bunch of hypocrites. Go ahead, blame the victim.

Re:Blame fest

[DavidTC]

I just checked. It's not.

Re:Blame fest

[Buran]

That would be because SixApart got the registrar/dns host to point bluesecurity.com to localhost (127.0.0.1) so unless you're running a webserver on your own box, you won't get anything.

Not according to dig, they didn't. And SixApart doesn't own bluesecurity.com so they have no authority to change the DNS entries anyway.

Re:Blame fest

[Buran]

And what about people like me who had only vaguely heard of this service, weren't sure how effective it was, and decided it was worth the time to go sign up after all while it was still on our minds? So now the blame is on people who want to -- OMG -- patronize a business that wants people to sign up for what it offers!? Good heavens, then, if that is bad then why does anyone run a business!?

Pistols at dawn.

[Anonymous Coward]

"'[The spammers are] trying to rip apart the internet just to make our community stop fighting back against spam,' Blue Security's chief executive Eran Reshef said, adding that he knows who's behind the attack.""

Too bad dueling is dead.

Let the bloggers blog! Set my people free!

[xmas2003]

Quote from Anil Dash, VP of Six Apart

Re:Let the bloggers blog! Set my people free!

[Spy der Mann]

Yeah, I loved it. Specially the part that starts with "Dear Attackers". Isn't that SWEET? ^_^

Kill the spammers

[pete6677]

I don't think spam will stop, or even slow down, until a spammer is seriously hurt or killed. Right now, they know there is no consequence to their actions. I'm not saying I personally advocate killing spammers, but it certainly wouldn't make me feel bad to hear about it being done. Spamming would be a lot riskier if there were an element of harm attached for the spammer.

Re:Kill the spammers

[Moqui]

Let me say it here first, when the legal hurdles are cleared, and my Running Man-styled reality show hits the market from the gulag in Iceland, the main "competitors" will be spammers and adware coders.

Re:Kill the spammers

[OrangeTide]

I'm not sure I would like an internet where my online activities could result in physical bodily harm. I would never become a spammer, but still I don't like the idea. If you hate spam so much that you want to commit assault or murder you could just sign off, quit using email, etc.

I know you were just kidding, but some people aren't :(

Re:Kill the spammers

[future assassin]

I dont think hurting spammers will do anything. In fact this would make spamming more lucritive as the price would go up because of the danger/fine factor. All of a sudden if its worth enough and its more dangerous more fishy/criminal organizations would get into it.

I think going after companies and websites advertised in SPAM woudld do more damage. Get a 1 mil dollar fine and they wont be making the same mistake twice.

Taking away the source of funds/content for spammers will at least minimize spam.

Re:Kill the spammers

[MMaestro]

All of a sudden if its worth enough and its more dangerous more fishy/criminal organizations would get into it.

Aren't there already professional (crime) organizations already set up for hacking and spamming purposes? Yeah; hear no evil, see no evil, speak no evil.

I think going after companies and websites advertised in SPAM woudld do more damage. Get a 1 mil dollar fine and they wont be making the same mistake twice.

If I made just one PENNY for each spam e-mail I sent out, I'd quit my day job and just become a spammer. $1 million is NOTHING these days. (This is tax-free as well.)

Re:Kill the spammers

[future assassin]

If I made just one PENNY for each spam e-mail I sent out, I'd quit my day job and just become a spammer. $1 million is NOTHING these days. (This is tax-free as well.) Im not talking about fines for spammers. I'm talking about huge fines for websites/companies mentioned in the spam.

Re:Kill the spammers

[Slashcrap]

If you hate spam so much that you want to commit assault or murder you could just sign off, quit using email, etc.

Yes, quitting e-mail is a very realistic solution. And I suppose that if your home phone starts getting flooded by unwanted sales calls you should just stop using the phone?

And if someone starts flooding the emergency services with spam calls?

Basically, your solution to people deliberately abusing an essential service seems to be rolling over and letting them fuck you like a bitch.

I know you were just kidding, but some people aren't :(

I'm certainly not fucking kidding and I hope that makes you as sad as that fucking gay emoticon you used suggests.

Re:Kill the spammers

[zx75]

Yes, because that *so* worked with doctors who perform abortions.

Re:Kill the spammers

[Kenshin]

Can we at least smash their computers and cars (which are probably very nice) with sledgehammers?

Re:Kill the spammers

[erroneus]

I won't say I advocate the death of a spammer either, but I will say that I would dance in the streets if I saw such a headline in the papers. I'm not suggesting or even hoping that someone actually murders a spammer, but I am saying that I would not mourn their passing at all.

Do I want them dead? I can't say. I can say I want them to STOP in whatever form it takes.

Re:Kill the spammers

[Punk Walrus]

I don't think spam will stop, or even slow down, until a spammer is seriously hurt or killed.

If that were true, drug running would have stopped LONG ago.

The Mafia? "Man, I could get hurt!"

"I stopped robbing houses after that one guy got shot by the owner. I mean, I thought they'd just accept the inevitable if I waved a gun at them, and now... I'm not so sure. To hell with my heroin addition, I'm gonna go straight before something awful happens to me! Community College, here I come!"

Money does funny things to a person. Even the promise of money does. Killing spammers would be like fighting the Hydra. A majority of spam is flash-in-the-pan, "Thought it would work," goofballs who have that one pipe dream of being the new Spam King, of which there ore only about a dozen or so that can live off the income comfortably. Consequence happens to other people, or they don't even think about it because they have no long-term strategies in life. Amway snatches up these people daily.

Re:Kill the spammers

[fleck_99_99]

You're not SERIOUSLY saying that hitting the delete key, or any amount of bandwidth, is actually equal in value to a person's life, are you? If so, you may want to re-evaluate your worldview somewhat.

Should there be fiscal and/or technological repercussions to spamming? Sure. But death seems a little bit ridiculous for an act that, at most, costs someone money.

Re:Kill the spammers

[Just Some Guy]

You're not SERIOUSLY saying that hitting the delete key, or any amount of bandwidth, is actually equal in value to a person's life, are you?

I'm certainly not. I want to see them in PMITA prison and destitute, but not dead.

However. According to a report from 2004, spammers sent about 12.4 billion messages per day. If it takes one second per email to delete, then that consumes 393 person-years to remove from our collective inboxes. Assuming an average lifespan of 75, that means spammers use the entire lives of over five people each and every day.

Put in the context that they're effectively killing 1900 unwilling people per year, that proposal doesn't seem quite as unthinkable.

Again, I don't encourage violence against spammers. Still, I can see the point of people who do, even though I don't reach the same conclusion.

Re:Kill the spammers

[DavidTC]

Aren't there already professional (crime) organizations already set up for hacking and spamming purposes?

Organized crime does not produce the demand for spam, because they do not spam their products and services. (Their products and services are illegal, and hence providing contact points to the general population would be stupid.)

'Legitimate' companies produce the demand. Crime, organized or not, steps in to provide this illegal service to them.

Worrying about the actual people producing the spam and who they work for is not that useful. The people to go after are the people purchasing their services.

Re:Kill the spammers

[HansF]

It's been done and spam hasn't stopped.
Russia's Biggest Spammer Brutally Murdered in Apartment
Vardan Kushnir, notorious for sending spam to each and every citizen of Russia who appeared to have an e-mail, was found dead in his Moscow apartment on Sunday, Interfax reported Monday. He died after suffering repeated blows to the head.

Re:Kill the spammers

[Intron]

Suppose it takes one second for every spam email that you delete. There are 2.2 billion seconds in 70 years. That's how many spam emails it takes to use up one average human life. Personally, every second I spend deleting spam is a second stolen from my life.

Re:Kill the spammers

[Professr3]

Why destroy what you can 419 scam away from the spammers? :P

Re:Kill the spammers

[starling]

I dont think hurting spammers will do anything.

It'd make a lot of people very happy.

Not sayin' it should happen, just sayin'.

Re:Kill the spammers

[Buran]

If I made just one PENNY for each spam e-mail I sent out, I'd quit my day job and just become a spammer. $1 million is NOTHING these days. (This is tax-free as well.)

I guess you didn't notice the line on the IRS forms where you have to declare illegal income. It is not tax-free, and if you fail to declare you will go to jail for a very long time. Just ask Al Capone. I know you were trying to be funny, but at least do some damn research first!

Re:Kill the spammers

[Mister Whirly]

And while we are at it, let's make shoplifting and jaywalking capital offenses also. Rip the tag of your mattress - electric chair. Forgot to use a turn signal on a turn - gas chamber. Drink alcohol before you are 21 - firing squad. Spray paint graffiti - lethal injection. Starting to sound ridiculous yet??? Violence should never be the solution to non-violent offenses. The penalty for ANNOYING someone should certainly never be DEATH.

Re:Kill the spammers

[Gojira Shipi-Taro]

Deterred the hell out of him though, didn't it?

I'm fairly certain he hasn't been directly responsible for more spam since then.

Re:Kill the spammers

[Mister Whirly]

Have you considered a career in the military?? You are pretty much exactly what they are looking for..

Re:Kill the spammers

[lgw]

You're not SERIOUSLY saying that hitting the delete key, or any amount of bandwidth, is actually equal in value to a person's life, are you?

Absolutely. I understand that some people believe that all life is magical and valuable and filled with unicorn giggles. Whatever. A spammer's life is of negative value. Everyone benefits if the spammer stops being a spammer. If the spammer simply stops being, I won't shed a tear.

Re:Kill the spammers

[is as us Infinite]

To be fair, I have fantasized about vigilante rule being imposed on spammers; ("... and this is for those 1.2 billion e-mails you sent about V1agr4 , and this is is for those .4 billion e-mails you sent about 'finding your s00ul mate' , and this is for those 1.4 billion e-mails you sent about vi4GGrA " etc.) however, I would say that it's really the same as any other immoral action and should be judged and prosecuted along those lines in the way that we as a society have agreed to. Just because spamming is an international crime doesn't mean it's worse than racketeering, serial murder, rape, etc. Consider your statement in a different context, as it would have been given before murder had been defined in law (and long before spamming was even a twinkle in immoral assholes' eyes):

"Subject: Kill the murderers
Body: I don't think murdering will stop, or even slow down, until a murderer is seriously hurt or killed. Right now, they know there is no consequence to their actions. I'm not saying I personally advocate killing murderers, but it certainly wouldn't make me feel bad to hear about it being done. Murdering would be a lot riskier if there were an element of harm attached for the murderer."

We have a body of laws intended to deter those who would partake in these actions, it is just that the laws are currently lacking for spamming (in both definition and jurisdictional prosecution.) Basically, we need an international justice body to define and prosecute these laws. I guess the first step is to define and prosecute these laws locally, and then lobby other governments to do the same. If only we had a global body that worked towards the common good. Something that united all the nations of the world in peace and harmony and bad will towards spammers. I think I would call this body, "Nations United" or something to that effect. But I know nothing like this would ever get implemented.

Sigh.

Re:Kill the spammers

[yfkar]

Huge fines for websites/companies mentioned in the spam? Would be great if it was that simple. That would be a great opponity for abuse. Company A could pay spammers to send spam advertising Company B and Company B would pay the huge fines.

Re:Kill the spammers

[Epi-man]

I think going after companies and websites advertised in SPAM woudld do more damage. Get a 1 mil dollar fine and they wont be making the same mistake twice.

What an excellent idea. Then, anyone who is running a website or ecommerce business who wants to put their competitors out of business can simply hire out a bot-net and fire off spam in their competitors' names. Brilliant! More ways for bot-nets to generate income for their masters.

Re:Kill the spammers

[MMaestro]

It took the IRS 4 years to nail a known murderer for tax evasion. The only reason Al Capone's was caught (relatively) early was because he had a rap sheet the length of a short novel. Don't forget, he was only sentenced 11 years (it was shortened to 6 years) so he DID get off fairly easily. Considering he was a BILLIONAIRE when you account for modern day inflation, thats a pretty small price to pay when you consider what else he could have been charged for. (Murder, violation of the 18th Amendment, impersonation of police officers, etc.)

Re:Kill the spammers

[MMaestro]

Or, illegitmate companies send messages to companies saying 'if you don't pay us, we'll send spam out claiming to be from you just to ruin your company's name.' You must really lack an imagination to simply grasp the concept of extortion. Its a very common, very old form of organized crime. (Smear campaigns anyone?)

Re:Kill the spammers

[Buran]

Which is true; however, back then it was harder to track someone down and harder to gather evidence. You leave a lot more of a trail these days than you did in the 1920s.

Re:Kill the spammers

[OrangeTide]

Yes, quitting e-mail is a very realistic solution. And I suppose that if your home phone starts getting flooded by unwanted sales calls you should just stop using the phone?

If the choices are "kill the phone solicitor" or turn the ringer off on your phone, guess what the ethical solution is...

And if someone starts flooding the emergency services with spam calls?

Basically none of us run an emergency service, and there is criminal punishment for someone who disables an emergency service. (I met a man who helped investigate a case where a war dialer walked through a block of pager numbers, back when pager systems were slow and used mainly by doctors. the kid responsible indeed have charges filed against him).

I'm certainly not fucking kidding and I hope that makes you as sad as that fucking gay emoticon you used suggests.

I'm positive you were kidding. Good troll attempt there though.

Re:Kill the spammers

[OrangeTide]

I have no ethical problem with that. Smash their computers first. And file a bunch of fake credit reports to ruin their credit rating making it much more difficult for them to buy a highspeed connection used to controlling bot-nets (common) or directly spamming (rare).

Different take...

[michrech]

Techdirt has a different story on what caused the outages. The info they have came from here.

Re:Different take...

[Slashcrap]

Techdirt [techdirt.com] has a different story on what caused the outages. The info they have came from here [digg.com].

The info they have came from digg.com? Wow, if I'd seen it on the BBC or CNN I might doubt the veracity, but if it's really from digg.com, I don't think there can be any doubt. Anyway, it would never have been repeated on a blog if it wasn't true.

Re:Different take...

[michrech]

Errr.. I'm having some difficulty discerning where I said the story as submitted was incorrect, or even where I stated that what I posted was more correct than the submitted story.

I guess you'll have to help me with that.

Ass.

Spammers are taking over...its sad really.

[kcbanner]

I once went onto a support wiki for a company's website, all the articles had been cleared and multiple new ones had been added, something to the effect of: Free sample! Prescription drugs... Its sad, they took over a support wiki and filled it with spam.

Re:Spammers are taking over...its sad really.

[Jett]

I've seen similiar things on lots of comment/forum systems - they've either got the process automated or have some third-world spammer sweatshops running (which would explain how they seem to get around captcha systems these days)

Two birds with one stone?

[3.5 stripes]

Taking out spammers and bloggers?

I can't see any down side to this, honestly.

Re:Two birds with one stone?

[dndfan]

Yes, you do. The amount of spam one gets is proportional to one's importance as an internet and email user. What will I do if I won't be able to show everyone my 300+ spam/day? ;)

Self-hosting

[AKAImBatman]

Ah, it's so nice to be self-hosted. Back when I was on Blogger.com, myself and many other users who received links from Slashdot stories or news sites became the target of a spammer who's sole purpose was to screw up the service for everyone. He had a script that would bomb a blog with hundreds of racist messages, overloading the system in the process. (Sorry, blogger.com's software isn't that good.) I was forced to disable the comments, delete the entry, and recreate it. Thankfully, there were only a few anonymous comments on the current entry which were easy to recreate.

While Blogger eventually added a captcha to solve the problem (after being non-responsive to support requests), it left a bad taste in my mouth. It was at that point that I decided to go self-hosted. I've never looked back. For the cost of a cheap hosting provider, you can setup a Wordpress installation that looks better, is more feature-rich, and automatically queues suspcious messages rather than allowing them to pass through. So while my site could be DDOSed if it was specifically targetted, it can't be overloaded with spam or used to take down other bloggers.

Re:Self-hosting

[acherrington]

I am self hosted as well.... That doesn't mean the tools I am using is getting blasted with this same attack, whereas infact it is. I am finding b2evolution is getting slammed with this same attack. *sigh* RFC 1087 needs to be given teeth.

RFC 1087 Ethics and the Internet January 1989

At great human and economic cost, resources drawn from the U.S.
Government, industry and the academic community have been assembled
into a collection of interconnected networks called the Internet.
Begun as a vehicle for experimental network research in the mid-
1970's, the Internet has become an important national infrastructure
supporting an increasingly widespread, multi-disciplinary community
of researchers ranging, inter alia, from computer scientists and
electrical engineers to mathematicians, physicists, medical
researchers, chemists, astronomers and space scientists.

As is true of other common infrastructures (e.g., roads, water
reservoirs and delivery systems, and the power generation and
distribution network), there is widespread dependence on the Internet
by its users for the support of day-to-day research activities.

The reliable operation of the Internet and the responsible use of its
resources is of common interest and concern for its users, operators
and sponsors. Recent events involving the hosts on the Internet and
in similar network infrastructures underscore the need to reiterate
the professional responsibility every Internet user bears to
colleagues and to the sponsors of the system. Many of the Internet
resources are provided by the U.S. Government. Abuse of the system
thus becomes a Federal matter above and beyond simple professional
ethics.

IAB Statement of Policy

The Internet is a national facility whose utility is largely a
consequence of its wide availability and accessibility.
Irresponsible use of this critical resource poses an enormous threat
to its continued availability to the technical community.

The U.S. Government sponsors of this system have a fiduciary
responsibility to the public to allocate government resources wisely
and effectively. Justification for the support of this system
suffers when highly disruptive abuses occur. Access to and use of
the Internet is a privilege and should be treated as such by all
users of this system.

The IAB strongly endorses the view of the Division Advisory Panel of
the National Science Foundation Division of Network, Communications
Research and Infrastructure which, in paraphrase, characterized as
unethical and unacceptable any activity which purposely:

(a) seeks to gain unauthorized access to the resources of the
Internet,

(b) disrupts the intended use of the Internet,

(c) wastes resources (people, capacity, computer) through such
actions,

Re:Self-hosting

[jlgolson]

Ah, it's so nice to be self-hosted. Back when I was on Blogger.com, myself and many other users who received links from Slashdot stories or news sites became the target of a spammer who's sole purpose was to screw up the service for everyone.

I disagree on this point... I got Drudged when I was hosting tsunami videos and got something in the realm of 7 million hits in the span of a week. Were I on my own server I would have gotten slammed with nasty overage charges if my server were to stay up. Blogger took the traffic and didn't even blink.

There are times when it's nice to be on someone else's system...

Re:Self-hosting

[AKAImBatman]

That doesn't mean the tools I am using is getting blasted with this same attack, whereas infact it is. I am finding b2evolution is getting slammed with this same attack.

How so? Were you on the same sub-net as SixApart, or did you get explicity targetted?

RFC 1087 needs to be given teeth.

RFC 1087 is an antique, a response to the November 1988 attack of the Morris Worm. The federal government no longer owns and operates the Internet, and thus doesn't have the rights to prosecute under destruction of private property. The owners of the backbones still have that option, and Congress can always pass new legislation. Neither option would help because many of the guilty parties are located in areas like the Russian Federation. Going international instantly makes the laws a thousand times harder to enforce. In areas like the Russian Federation, there's still enough corruption for officials to be bribed to look the other way.

Re:Self-hosting

[AKAImBatman]

I got Drudged when I was hosting tsunami videos and got something in the realm of 7 million hits in the span of a week.

You got seven million hits on a single line of text? How did you know that you received 7 million page loads? (Blogger doesn't provide statistics, the last I knew.)

Granted, if you actually got 7 million hits, the lousy templates of Blogger would have cost you about 34K * 7,000,000 = 226GBs for that single line of text. That's still well below what a service like Lunarpages includes in its basic package.

Re:Self-hosting

[jlgolson]

Actually there used to be a lot more there until I too moved to my own server for my new blog. To generate more PV's over there, I redirect the video viewers.

Here is my SiteMeter account for that page. 7m PV's.

http://www.sitemeter.com/?a=stats&s=sm7jlgolson&r= 0

Content wise, it was very similar to what I have here: http://thestormtrack.com/archives/2004/12/tsunami_ videos.html

While I am sure "bandwidth-wise" I would have been fine (except for the actual video which used up over a petabyte of BW), would their basic account have been able to handle 1m PV's a day for a week straight? I doubt it, since so many pages go down when merely Slashdotted which sends a significant amount of traffic, but nothing like what I got.

Re:Self-hosting

[AKAImBatman]

Actually there used to be a lot more there until I too moved to my own server for my new blog. To generate more PV's over there, I redirect the video viewers.

Ah, I see. Page-wise, that would have hurt a lot more. Not critically, mind you, but a lot more. I imagine that it's nice to be rid of that overweight Blogger page. :-)

While I am sure "bandwidth-wise" I would have been fine (except for the actual video which used up over a petabyte of BW), would their basic account have been able to handle 1m PV's a day for a week straight? I doubt it.

I dunno. I've been hit pretty hard in the past, and LunarPages has always come through. They're the largest hosting service on the market, so they've got the bandwidth to spare. They even offer temporary increases in monthly bandwidth for situations like Slashdotting. I don't know what it costs, but presumably it's less that the $3.95/GB they normally charge.

Re:Self-hosting

[AKAImBatman]

Sorry, I forgot to ask. Where were you hosting the videos before? Up until recently, Blogger wouldn't even host images, much less files. (Another reason why I wanted to move.)

Re:Self-hosting

[jlgolson]

For a while I had them on my .Mac account until I crippled their servers and they asked me to remove them. I think I cost them thousands in burstable bandwidth charges.

After that I put up a plea for mirrors and I had the videos mirrored across a number of places and then a company offered to put them on a new data center they had just built as a stress test. We had almost 30Gbps sustained for 3 days straight. Moved over a petabyte in total is my best guess.

I'm the reason .Mac now has bandwidth limits. Sorry y'all!

I'm moving them over to Google Video slowly but surely, now that .Mac has actually started enforcing their bandwidth limits.

Here's the wsj article about me: http://jlgolson.googlepages.com/wsj.html

Shifting attack

[Billosaur]

"He's trying to rip apart the internet just to make our community stop fighting back against spam," Blue Security's chief executive Eran Reshef said of the spammer he believes launched the attack.

LiveJournal and TypePad found themselves suffering the brunt of the attack when Blue, which says it has been targeted by a "top four" Russian spammer, redirected the front page of its website to a blog hosted at TypePad's data center.

Reshef said Blue replaced the front page of its site with the TypePad blog to keep its users up to date with events, and disagreed with commentary that said Blue acted irresponsibly by passing the DDoS burden to Six Apart.

"We didn't offload any DDoS," he said. "That's like blaming the victim of a crime."

Since they were apparently in contact with this dirtbag, didn't they see this coming? Perhaps they were just being well-intentioned by shifting their front page to a blog with information for their users, but since they don't host the blog, that seems like dirty pool. Spammers are not known for being the most easy-going people in the world and sure he made threats about a DDoS. Seems a bit iffy. It could all be above board but without more info, who knows?

I find it interesting that they supply spammers with the addresses of their clients, so the spammers can avoid emailing them. Wouldn't a spammer get that info when they get bombarded by unsubscribe requests? Seems like handing the fox the keys to the henhouse while you slip off for a brewski.

Re:Shifting attack

[egamma]

No, it's more like Blue Security recieves the spammers mailing list, removes Blue Frog addresses, and sends the list back. What the spammer did in this case is take the original list and subtract the one they recieved back, to reveal all the Blue Frog users on the list.

Re:Shifting attack

[MrDoh1]

They don't supply spammers with the addresses of their members. What they do is offer a tool that cleans our email addresses (which are contained in an encrypted database) out of their spam address databases. So all that was done is the spammer in question compared a pre-cleaned version with a post-cleaned version and any addresses that no longer appeared were obviously members of BlueSecurity.

Also, the spam reports that are sent out are sent from a proxy type email address. My normal address wouldn't show up, but username@reports.bluesecurity.com is where it would come from.

Personally, I see nothing wrong with sending 1 unsubscribe request per piece of spam I get. BlueSecurity has just automated this method so I don't have to take the time, and they also handle escalation to the proper authorities if the situation isn't resolved.

If the spammer perceives getting 1 unsubscribe request per spam he sends a DDOS attack then I would think the best course of action would be not to send to those people. Heck, we are the ones who wouldn't buy anything from them anyway.

Also, based on what I have read in the blog itself (when it was still accessible) it was a user in the comments that suggested redirecting the site and error pages to the blog so users would at least have some clue what was going on. It's likely they took the advice without contemplating the potential outcome.

Re:Shifting attack

[anagama]

Does Bluesecurity have a linux or mac client yet? Spammer is an idiot. 1) he raises awareness of what bluesecurity does. 2) he makes it look like BS works -- why else would he waste resources he could be using to spam or extort people, it must be hurting him. Effectively, this is great for PR Bluesecurity -- how much would a worldwide advertising campaign have cost?

Re:Shifting attack

[hotdiggitydawg]

I don't know, but I agree with you. This is the first time I've heard of BlueSecurity, and as soon as the site comes back I'm joining, and recommending to everyone I know to do the same.

Re:Shifting attack

[mailman-zero]

I know they have a linux client because I use it. I don't know about Mac, but I know that they provide source code to compile your own. It's not FOSS, but the source is there for compilation purposes.

I signed onto this about five days before the war began. I just hope they get it back up and running again soon. I think critical mass could be reached with all the publicity they've gotten.

Re:Shifting attack

[Sigg3.net]

Seems like handing the fox the keys to the henhouse while you slip off for a brewski.

In real life, naturally, the fox wouldn't be able to open the door, even with keys. That's because he didn't join the evolutionary joy-ride providing him with an opposable thumb. And I don't understand why you'd hand over the keys to a fox at all, no matter how much brewski you'd had.
Unless the brewski made you believe that the fox could, in fact, open the door with the keys, but that he seemed like such a nice feller that you appointed him the doorman title.
But at that point, you wouldn't really be fit to look after the hens anyway.
And they'd start their own civilization, developing advanced technology on their own, accumulating scientific knowledge, and eventually take over the world. Cockily kicking mankind out of existence, solving the spam problem once and for all.

Re:Guilty of what?

[ptomblin]

I think SixApart is being far too generous in not laying the blame for this fully at the feet of Blue Security. Basically Blue Security decided that their web site couldn't stand the DDOS, so they pointed the URL for their company to their blog.com blog. Thus DDOS'ing all of SixApart.

If I were SixApart, I'd sue the fuck out of Blue Security for deliberately DDOSing them.

hahaha

[paladin7]

So, they fucked up SixApart and now are trying to divert the attention from the real problem?

Everyone keep's knocking blue...

[ZSpade]

But have they got any better suggestions. The federal government is a *Joke* about bringing any kind of justice down on this filth, and so the masses remained *outraged* and *victimized*. To me a (A computer tech) I see people's computers every day that have been turned into Zombies. Some so bad that they have to be reformated. They are bringing in their computers to me, and paying hard cash for me to fix it and prevent it from happening again. That's real money, real damages everyone is having to pay every day. I guess you could spin it in a positive light and say it's good for the tech industry, but not if people start becoming afraid to even get on the internet because of what might happen to their computer. This is theft, this is vandilism and the governements of the world are practically standing by and watching it happen.

So, do you have any better suggestions, if not then I kindly ask you to ommit your views until you can add something to the cause.

Re:Everyone keep's knocking blue...

[spyrochaete]

I'm a PC repair consultant and I can't even recall how many heartfelt thanks I've gotten, not to mention unsolicited cash bonuses from ma and pa residential clients, just for installing Mailwasher or Thunderbird or some other free and simple spam filter. Governments don't realize that people are DESPERATE for a solution as email is the primary means of telecommunication for more and more citizens each day. How long until governments and ISPs realize that it takes way less effort to buy an umbrella than to keep throwing wet clothes in the dryer?

Re:Everyone keep's knocking blue...

[robogun]

The federal government is a *Joke* about bringing any kind of justice down on this filth

It can if it wants.

The gov't had Junk Faxers shut down before the Bush Administration opened the floodgates for them again this year.

Big fines with an active vigilante^H^H reward system (private lawyers suing junk faxers) will defeat spam.

Re:Everyone keep's knocking blue...

[Kelson]

So, do you have any better suggestions, if not then I kindly ask you to ommit your views until you can add something to the cause.

OK. Here's one. Summary execution for spammers and their families. It would solve the problem more effectively than anything else we've got.

You don't have any better suggestions? Then don't you dare criticize this one!

Sorry for the Modest Proposal (I do not advocate killing people over spam!), but the point I'm trying to make is: it's entirely legitimate to criticize an idea without suggesting an alternative. Unless you're making a split-second decision, it's worth looking at the downside before you implement a plan. Sometimes you'll decide it's worth it, at least for now, and other times you'll decide you're better off going back to the drawing board.

Re:Everyone keep's knocking blue...

[Mister Whirly]

Don't knock your meal ticket man. Think if all those people's computers were working great - you (and I) would be out of a job...

Re:Everyone keep's knocking blue...

[Moofie]

If you rely on the incompetence of others to keep yourself employed, you are incompetent.

Opting out is *NOT* abuse!

[Spy der Mann]

All blue frog does is requesting to be opted out. One form send per spam received. No more, no less.

4 of the 10 major spammers had already excluded the blue security list from their mass mailings, and their problem was solved. But this particular spammer, instead of complying, shut down Blue Security.

Just because Blue Frog causes A SIDE EFFECT of disminishing the bandwidth of the spammer's website, is not Blue Security's fault. (It is our LEGAL RIGHT to request for opt-out, and to keep requesting it UNTIL IT IS FULFILLED).

To say opting out is abuse, is nothing but legitimizing illegal (non CAN-SPAM complying) spam.

Re:Opting out is *NOT* abuse!

[Tim C]

Just because Blue Frog causes A SIDE EFFECT of disminishing the bandwidth of the spammer's website, is not Blue Security's fault.

Well,I have to disagree there. Anyone with half the technical know-how required to put together something like Blue Frog should have realised the likely effect immediately. Hell, it was only created in the first place because spam is such a huge problem because there's so much of it - it's entire reason for existing is because there's a flood of the stuff! Therefore, there will necessarily be a flood of responses, therefore a (partial) DDoS on the target site is all-but inevitable.

Now, I'm not saying that it's a bad thing (or a good thing, although a rather large part of me is saying "sounds like just deserts to me..."), just that with a side effect this damn obvious, it most certainly is their fault.

To say opting out is abuse, is nothing but legitimizing illegal (non CAN-SPAM complying) spam.

Opting out most certainly is not abuse. I think Blue Frog is in a rather greyer area than you're making out, but I'm not convinced that it constitutes abuse either - and if it does, I'm not convinced that it isn't a warranted, reasonable response in any case.

After all, if the opt-out link worked, and the spam stopped, so would the response. To stretch an analogy, if I hit someone every time they hit me, I don't think they'd get too far complaining that I was hitting them back. (Although of course in real life, a lot depends on the context)

Re:Opting out is *NOT* abuse!

[davygrvy]

To stretch an analogy, if I hit someone every time they hit me, I don't think they'd get too far complaining that I was hitting them back. Good imagery on that, thank you. BlueFrog punches spammers, join the fight :)

Re:Opting out is *NOT* abuse!

[gbjbaanb]

I'm sorry to reply like this because you make a valid point, but consider your comment
"Now, I'm not saying that it's a bad thing (or a good thing, although a rather large part of me is saying "sounds like just deserts to me..."), just that with a side effect this damn obvious, it most certainly is their fault."

with

"He walked into the biker bar and said that only poofters rode bikes, he should have known he'd end up in hospital. Definitely was his own fault."

or

"My girlfriend asked if her bum looked big in the dress she wore, and I told her the truth that it did. Its my own fault I'm sleeping on the couch now.

but also

"She was wearing a really short skirt and revealing top, she should have known she'd get raped, it most certainly was her own fault"

or

"That Guardian Angel guy stepped in to stop the old lady being mugged by the gang, he should have known he'd get stabbed, it was his own fault"

Just because the world is a bad place, filled with bad people, doesn't mean we shouldn't support the victim, especially if they have put themselves in harms way for our benefit.

Re:Opting out is *NOT* abuse!

[Buran]

spam is such a huge problem because there's so much of it - it's entire reason for existing is because there's a flood of the stuff! Therefore, there will necessarily be a flood of responses, therefore a (partial) DDoS on the target site is all-but inevitable.

So you basically claim that we are not able to ask people to leave us alone but have to bend over and take it? This client automatically sends an opt-out request in response to unwanted junk email. That's all it does. All a site has to do to not get a flood of unsubscribes is to not spew floods of unwanted email. It's that simple. They're bringinging the resulting response on themselves. It's like being warned that breaking into my house is dangerous because I have a shotgun, and then whining that you got shot.

Just post these guys' addresses and photos...

[csoto]

If a kneecap or two happens to get broken, well, so be it...

For those of you Blue Frog users...

[Spy der Mann]

I've devised a method to keep opting out while Blue Security's down. I posted it on my journal.

The next step is automating the process, perhaps making a new version of Blue Frog that doesn't rely on a centralized server. Do that, and we'll regain our mailboxes.

Best way to eradicate spammers

[metamatic]

The best way to eradicate spammers would simply be to go after their clients.

No, there's a much better way.

Re:Best way to eradicate spammers

[Spy der Mann]

Sorry to disagree with you...

But killing people does not solve crime (which is my reason to be against the death penalty).

To put it in other words, shutting down an abuser does not shut down the system that promotes such abuse. The only way to stop spam is to make it non-profitable for spammers. And this is done by cluttering their sales forms with opt out requests (which is what Blue Frog does).

Of course, if SPAM had been declared illegal in the first place... we wouldn't have to deal with this mess.

Re:Best way to eradicate spammers

[penix1]

"Of course, if SPAM had been declared illegal in the first place... we wouldn't have to deal with this mess."

You don't honestly believe that do you?!?!

Most spam (in the true sense of the word) IS ALREADY ILLEGAL in that it is fraud.

Spam doesn't operate in a vacuum. There is profit to the ISP hosting spam sites as well as the email accounts of known spammers. Add to that the security exploited machines and it makes email unusable.

To put it in the words of spamhaus.org:

"Although all networks claim to be anti-spam, some network executives factor revenue made from hosting known spam gangs into corporate policy decisions to continue to sell services to spam operations. Others simply decide that closing the holes in their end-user broadband systems that allow spammers access would be too costly to their bottom lines."

In short, if the ISPs were forced to be held accountable for what is on their network, THEN maybe they would take it seriously.

B.

Re:Best way to eradicate spammers

[Ryan Amos]

Yeah, but if this happens to enough of them, it might get rid of some of the get-rich-quick types.

I'm not advocating murder in any way, and honestly I doubt this had anything to do with spam (if you're involved in illegal activity in Russia, you're usually involved with organized crime. Piss them off and these things happen.)

Re:Best way to eradicate spammers

[Kadin2048]

The only way to stop spam is to make it non-profitable for spammers.

Well, if sending spam results in your immediate and painful death, that sort of influences the risk versus profit equation, now doesn't it?

Sure, people would still do it -- people smuggle drugs in places where that earns you a one-way ticket down a trapdoor followed by an abrupt ending -- but you're naive if you don't think that the threat of punishment is a large disincentive to crime.

I don't go around robbing banks and stealing cars because I don't much enjoy the idea of becoming butt-buddies with a guy named Bubba down at the State pen, for the next decade or two.

If you don't hurt other people or steal things because of a lot of high-minded ideals regarding the value of human life, fine. Whatever works for you. But you're deceiving yourself if you think that's what drives everyone.

People commit crimes because the perceived gains outweigh the perceived risks. Thus you can reduce the number of a particular crime in two ways: you can lower the perceived gains or raise the perceived risks. You'll never reduce crime to zero (since there will always be people who will do crimes even when there isn't really any perceivable benefit, and always someone desperate enough to try something no matter how high the risks are for even miniscule gain), but you can certainly affect it.

Re:Best way to eradicate spammers

[metamatic]

But killing people does not solve crime

True, but it sure as hell cuts down on the rate of re-offending.

Re:Best way to eradicate spammers

[billstewart]

As the fictional Vlad Taltos put it, killing people doesn't solve anything, but it does keep them out of your hair until you figure out what you need to do next. A few years ago a couple of Russian-immigrant spammers in New Jersey were also murdered - the general guess was that they'd burned somebody with the pump&dump stock scam they were running.

Spam isn't going away until the economics make it no longer profitable. Laws can sometimes affect the economics (opportunity cost of being in jail, etc., but only if you're caught.) If BlueFrog helps, great, or if techniques like tagged email addresses make the spammer need to send out a million times more messages per sucker, that may be economic leverage enough. Zombie hunting is a fairly critical need for current anti-spam work, but just as relay blocking a few years ago pushed spammers to other techniques, if we kill all the zombies, they'll find something new.

Re:Best way to eradicate spammers

[Random Destruction]

It also makes pardoning someone of a crime a real hassle.

Re:Best way to eradicate spammers

[Spy der Mann]

You don't honestly believe that do you?!?!

After CAN-SPAM was declared law, spam rates skyrocketted. I believe this gave illegal spammers the opportunity to sneak in. This is because you HAVE to get a second offense to prove that a spammer doesn't comply with CAN SPAM. This means giving them a 3 or 4 day window, providing illegal spammers with the tools they need to remain impune (To distinguish the "good" from the "bad" spammers, you'd need to enter ALL the websites, and opt out to see which ones did not comply).

If an alternative law (say, CANTSPAM) had been approved, we would only need a FIRST offense to sue the spammer, and the authorities would be much more organized than they are right now. Offenses would be persecuted immediately, and more effective measures could have been taken.

Re:Best way to eradicate spammers

[lazarusdishwasher]

You say that the death penalty does not solve crime, and you also say that you have to get a second offense before you can invoke the can spam act. It apperas that someone was able to come up with a punishment that prevented a repeat offense.

I might be wrong but under any set of laws you will always find at least one person willing to break the law thus you will always have crime.

If you will always have crime you need a way to discourage repeat offenders. With the death penalty the person being punished is prevented from breaking any more laws.

Once you establish that they have broken a law what deterrent would you suggest?

If you fine someone who has broken the law are they required to prove they money they pay with was gained legally, perhaps by mandatory irs audits for several years before and after the event.

If you imprison them do they lose more then they gain, in prision all of your basic needs are met you have food shelter clothing and medical treatment, would this work better if we had a situation like cool hand luke http://www.imdb.com/title/tt0061512/

Since we already have a minimum wage that is supposed to be enough to make a living that will provide all of the basics of life lets use that figure to our advantage.

Change the legal system so that crimes aren't punished by jail time but by a fine.
Stipulate that the only way to pay the fine is by going to a prison work camp.
Instead of paying them by writing them a check, give them payroll deductions that pay for room, board and all of the other expenses of running a prison and the rest goes to thier fine.
when the fine is paid off they are released.

Under this system they are at least helping the rest of society, because the goverment won't have to hire or contract out the jobs that could be done by the criminals and the money we would have used goes to paying the criminals.

Re:Best way to eradicate spammers

[Spy der Mann]

If you will always have crime you need a way to discourage repeat offenders.

Yes, but the main problem is that this is NOT society. This is the INTERNET. There are THOUSANDS of websites promoted by one same anonymous offender. My point is that WAITING for a repeated offense is TOO MUCH. We need to strike at the FIRST offense.

Re:Best way to eradicate spammers

[penix1]

"After CAN-SPAM was declared law, spam rates skyrocketed."

That was due to happen anyway. The spam growth chart at most spam monitoring sites show the curve is logarithmic starting way before this legislation. This is what prompted the need for legislation in the first place. That the legislation got all fouled up is credited to our messed up politicians listening to the marketing lobby who feared it would spawn other restrictions if this was made opt-in (as was originally written in the legislation). Remember, at the same time was the big push for the national do-not-call list as well.

B.

Re:Best way to eradicate spammers

[Gary W. Longsine]

I don't have any direct evidence to support your claims, but I know that we have approached two ISP, one national, one regional, to get them to try our novel anti-worm / anti-botnet system, to no avail. (They do understand that botnets produce spam.) I suspect that they really don't want to do anything about the problem.

Going after spam clients

[discHead]

Actually, that's exactly what I understood Blue Frog to be doing--going to the Web sites offering the products advertised in the spam, then filling out the order forms with words to the effect of "stop spamming Blue Frog users."

Let's not forget guys...

[Spy der Mann]

*Puts on asbesto suit*

That most DDOS attacks right now are done using botnets. If we should blame someone (besides our mediocre congress), it's Microsoft for having such a weak security in their desktop OS. And for not updating pirated copies, which are used as botnets too!

Re:Let's not forget guys...

[CashCarSTAR]

Actually, there are OS X botnets as well.

Quite frankly, the only real security laxes that Microsoft has had over the last few years (after the OE preview patch, and limiting ActiveX componenets), were the Sasser/Blaster type things, I blame the IT people who ASKED for those services (the ability to run code remotely) to be included.

What people don't realize, is that once you run a malicious program on your computer, it doesn't matter what OS you're using. It can get its grips and do what it wants into anything. Short of running your OS off a read-only image, that is. (Which really isn't a bad idea)

Re:Let's not forget guys...

[Big_Lamer]

And for not updating pirated copies, which are used as botnets too!

Please re-read the article you are referencing and find where it states that Microsoft does not offer their security updates to unregistered versions of Windows. I just re-read the Steve Nash Q&A and the only thing I can find is where he specifically states the following:

Nash: This is a great question and one that we struggled with as we established the policy. First, I should clarity one thing. While the Windows AntiSpyware offering is only available to users of licensed copies of Windows, we do make our high priority security updates available to unlicensed users of Windows, primarily in order to prevent unlicensed Windows systems from posing a threat to the Internet if they get infected. Although, we do remind unlicensed users of Windows to get genuine.

If I am wrong about this response from Microsoft, please post the relevance section of the response from Steve Nash. The problem is not Microsoft, the problem is the standard computer user is not computer literate enough to update their system on their own. The number of botnets in existence is the simple proof of this. The lack of updated systems is not a problem with the operating system, as you would have just as many users who would have no idea how to update a rival OS as Microsoft.

All of the OS vendors I have used lately now provide some functionality for automatically updating the OS. However, none of them provided a completely automated system to update the OS without user intervention at the time of Windows XP's release. User education is the key to eliminating the botnets that cause so much of the SPAM.

Tucows DNS attack?

[buserian]

Does anyone know if there's a connection between this and the attack on Tucows managed DNS service? The timing seems too close for this to be a coincidence...

Cheers,
Graham

Re:Tucows DNS attack?

[coaxeus]

Yep..
; > DiG 9.2.2 > bluesecurity.com ns ;; ANSWER SECTION:
bluesecurity.com. 46534 IN NS ns1.mdnsservice.com. (tucows/opensrs)
bluesecurity.com. 46534 IN NS ns2.mdnsservice.com.
bluesecurity.com. 46534 IN NS ns3.mdnsservice.com.

I use tucows/opensrs for DNS hosting of about 400 domains and needless to say I'm not too pleased. This kinda puts a dent in their Fully redundant architecture hosted in a world-class facility, 100% uptime guarantee ensures that authoritative and slave nameservers will always resolve policy.

One interesting step they've taken is now bluesecurity.com resolves to 127.0.0.1 on their servers. Wonder who's decision that was.

Re:Tucows DNS attack?

[buserian]

Thanks.

One interesting step they've taken is now bluesecurity.com resolves to 127.0.0.1 on their servers. Wonder who's decision that was.

I don't know, but I applaud them!

I use tucows/opensrs for DNS hosting of about 400 domains and needless to say I'm not too pleased.

To be fair, I've been using Tucows's services for about six years, and this is the first time I've had any problems.

Cheers,
Graham

Re:Tucows DNS attack?

[coaxeus]

I monitor and trend the performance and availability ns1-3.mdnsservice.com the quality assurance DNS tests (failrly infrequent and lenient oness) and it's actually pretty rare for them all to be functioning, and I've had a few instances of them all being broken. This is of course the worst.

I've switched to another provider for now.

Re:Tucows DNS attack?

[vladj]

Are those publicly available tests? If so, could you point me in the right direction?

Re:Tucows DNS attack?

[coaxeus]

Sorry, just my internal monitoring servers which I can't publish. I just ran a query on historical availability excluding this month, so not taking these 2-3 days or whatever of downtime into account and show that over a year's time the servers have been up and responding properly 98.121% of the time, 6.8 days total downtime (downtime = none of the 3 redundant servers responding) Mostly very short amounts of downtime, adds up to be a lot. These monitoring servers have a system of dependencies that exclude any of their own system/network/internet problems and are in multiple datacentres.

Re:Is Blue Security going public with who's behind

[DaHat]

Agreed! I've got my pitchfork and torch right here... I dunno about you but I'm up for some mob rule and a lynching to take care of this mess.

Backbone Subversion

[wehup]

From TFA:

"...the company has been in contact with the spammer via ICQ and that the spammer had claimed that he had carried out what he called a "backbone subversion" attack against a tier-one IP backbone."

So what might "backbone subversion" be?

Re:Backbone Subversion

[Alioth]

Why, a better implementation of "backbone CVS" of course!

Re:Backbone Subversion

[bockafer]

I hear "backbone CVS" is harder to "Trac".

Honey vs. Vinegar

[GenericDefect]

What we really need are incentives for advertisers to focus on permission marketting rather than broad spectrum annoyance. I can't think of anything offhand, but I am certain that easing costs in some way to channel behavior will be more effective than penalties on the whole profession. I am not likely to click on your link for a free ipod or ringtones. But if you send adds for discount printer toner because I am subscribed your premade business forms site, then yeah, I might just click on that. Maybe we could focus on making overhead on advertising expenses a part of the tax deductible business development column provided that the company doing the advertising itself produced some kind of commodity besides advertisement. Maybe not foolproof, but it rewards advertisers that are on the level and encourages clients to seek out providers in the formal economy.

Re:Is Blue Security going public with who's behind

[Anonymous Coward]

I guess we'll just have to figure out Blue's clues.

(Because we're really smart)

Breaking point

[Stray1]

Speaking as one of the people who helped start the last bluesecurity article, I think we've all had enough time to reflect and debate on the 'fight fire with fire' technique that blusecurity has enacted. What this new DDOS attack has brought to the table is something a little different. Before the attack, Bluesecurity would send an equal amount of opt out requests as spam. THIS DDOS attack on bluesecurity, which is clearly illegal, is the breaking point. I'm not sure WHAT going to break, (of than someones ISP) but it has shed light on spammers intentions. Spam artists have always relied on the fact that their activities arent spefically illegal. With this attack they have really crossed the line- This event could be the event that got some sort of anti spam- legislation rolling, (or it might have the opposite effect). Something should come out of this though, if only to be remembered the 'bluesecurity incident'. Personally I was pretty pissed having some jackass hold my gmail account for ransom, especially since bluesec. was so ridiculously effective. FYI, despite the threats, I have recieved no greater amount of spam than when I was first threatened on monday (sunday). I dont think their database was compromised despite what joe spammer tells us.

Go open source

[djcatnip]

Wordpress is an excellent open source blogging tool. Couple that with Bad behavior and Spam Karma 2 and you've got yourself a near impenetrable blog to spam in your comments. The new version of Wordpress has tools to migrate from some popular blogging systems, so.. go check it out.

Take them out

[Anonymous Coward]

The spammer is in Russia. Let's hire the mafia nd take him out. Blue security has 500,000 members. If we all put in $1.00 each, we should manage to hire someone to take the spammer out. He won't be a problem after that, and he won't send any more spam.

500 000 is nothing

[suv4x4]

They need more people so that it becomes non-viable to attack the community.

I've not heard of BlueSecurity before, but after those stories, I'm signing up with them. I urge anyone who wants to help fight against spam and vandalism on the Internet do the same.

After all, when noone can take care of a problem for you, it's time to step up and solve it yourself.

Stop Being Cute About This

[Nom du Keyboard]

He says he knows who's behind it. He would not give a name, but said it was a "top four" spammer, who speaks Russian.

Stop being cute about this and just tell us who. Information in power, and you're only facilitating this person's ability to continue to hide until you unmask him/them.

Re:Stop Being Cute About This

[anagama]

There may be enough clues in the article.

1) it is a top 4 spammer who speaks Russian.
2) in the top 4 spammers are two Russians and one Ukranian
3) the top two spammers have decided to avoid bluehost customers

Assuming Ukranian guy speaks Russian, if the bottom 2 of the top 4 include only one Russian speaker, then he's your guy. At worst, you narrow it down to two people.

Re:Stop Being Cute About This

[bezzeb]

Legal actions are a very likely result of this criminal attack. With luck it won't be between the bloggers and Blue Sec, but rather a joint action suit with BOTH the bloggers and Blue Sec. team on one side, and Joe Spam King on the other.

The Blue Security team must be very careful what they say over the next weeks so that they don't tamper or invalidate any of their evidence or generate negative legal claims that could be used against them.

To name this criminal and direct all of our righteous rage against him... To goad us into hirig hit men, and otherwise tar and feathering the bastard.. All that would look bad in court.

They are doing the right thing by playing it cool. Definitely acting professional. Courts love professionals and hate those who fly off at the mouth all the time.

So sit tight fellow froggers! I too have about 1500 spam saved up from the last 3 days - just ITCHING to get into Blue Sec's mail servers. My last few submissions were bounced back as undeliverable due to the DDoS thing. But I'm saving my precious special ham for it's day of glory...

All the best folks,
B.

Re:Stop Being Cute About This

[davygrvy]

http://home.businesswire.com/portal/site/google/in dex.jsp?ndmViewId=news_view&newsId=20060504006094& newsLang=en Some guy who calls himself 'PharmaMaster'

Re:Is Blue Security going public with who's behind

[mikesd81]

If they really do know who's behind the attack, don't they have the ethical duty to report them if not to prevent it from happening to other companies, but for themselves? The fact they know who and won't tell makes them no better than the spammers themselves.

That's like hearing a domestic abuse fight in your apt building, but don't call the cops.

Re:Is Blue Security going public with who's behind

[Tripster]

We best keep an eye on Blue's News then! :)

SixApart should sue them

[MikeRT]

Need an analogy to understand why SixApart should sue? It'd be like a corrupt police unit grabbing a school bus full of kids to use as human shields in the middle of a gun battle with a gang while the cops try to fall back and call for backup.

Re:SixApart should sue them

[Spy der Mann]

OH c'mon. We're talking about mistakes here. Nobody was harmed and the damage to Six Apart was temporary, it's fixed now. They should focus on fighting the enemy instead.

Blue Security are idiots

[Anonymous Coward]

Let's review, shall we?

First, these idiots set up an "anti-spam" service whose response to abuse is...abuse.

Second, they use a fraudulent corporate name. (Use Google and search Usenet.)

Third, they locate themselves on a network also happens to house one of the scummiest spammers on the planet.

Fourth, they decide to redirect an incoming attack at an innocent third party.

The only surprising thing is how many morons have actually DEFENDED these idiots.

Recommendations:

1. Permanently blacklist their domain(s).
2. Firewall off their network.

Re:Blue Security are idiots

[wiskers69]

Recommendations: 1. Permanently blacklist their domain(s). 2. Firewall off their network. 3. Bend over and continue to take it in rear

Re:Blue Security are idiots

[bezzeb]

Okay. Yet another Spammer hiding as anonymous.

And Whisker69 seems to be another pro-spam advocate I've seen cruising around. At least Whisker is brave enough to have a name though - hats off to him/her. You are indeed welcome to your opinions and I respect that and agree to disagree with you.

But for the rest: See earlier post on Google Groups - looks like a match:
http://groups.google.com/group/24hoursupport.helpd esk/browse_frm/thread/9bbfff5777bf9ef6/

The grass roots pro-spam propaganda ring doesn't have many participants... I say let them speak so we can get to know them and profile their little rears.

Re:Blue Security are idiots

[Fordiman]

"First, these idiots set up an "anti-spam" service whose response to abuse is...abuse."

Not exactly. First, abuse or not, it's my response to spam, not Blue Security's. Just because I have them doing it for me doesn't make it any less my action. Anyone in the Blue Community would agree. Second, it's one-for-one. For each spam from a given spammer, one opt out is sent. The fact that it often ends up in a DoS for that spammer from only the Blue subset of his spam list tells you how much abuse he's doling out himself.

"Second, they use a fraudulent corporate name. (Use Google and search Usenet.)"
I'm curious as to how you came to this conclusion. Please enlighten.

"Third, they locate themselves on a network also happens to house one of the scummiest spammers on the planet."
Spammers collect at the point of cheapest bandwidth. I see no reason this shouldn't be true for an anti-spam business as well.

"Fourth, they decide to redirect an incoming attack at an innocent third party."
I'm pretty sure that was erroneous judgement, rather than human-shielding. For example, consider the possibility that the attacker was attacking via IP. The defender's DNS/CN redirect should have left the attack still going after Blue's servers. Unfortunately it didn't.

Meanwhile, I don't know if you've ever watched any horror flicks, but I seem to rememeber that guys with your attitude always seem to be killed off just after the large-breasted slut - usually to the great satisfaction of the audience.

Re:Blue Security are idiots

[RedToad]

First, these idiots set up an "anti-spam" service whose response to abuse is...abuse."

Not exactly. First, abuse or not, it's my response to spam, not Blue Security's. Just because I have them doing it for me doesn't make it any less my action. Anyone in the Blue Community would agree. Second, it's one-for-one. For each spam from a given spammer, one opt out is sent. The fact that it often ends up in a DoS for that spammer from only the Blue subset of his spam list tells you how much abuse he's doling out himself.

Careful with our terminology here. Miss out a word or two and the whole meaning changes. Instead of For each spam from a given spammer, one opt out is sent let's try For each spam from a given spammer, no more than one opt out is sent.

In practice, when the Blue Frog opt-out requests were being sent to spamvertised websites, asking them to clean their lists, the average number of forms filled in was around 500 to 600. Now, try turning that into a DDOS attack.

Let's look at the math. Two million spams sent advertising a web site. If everyone decides immediately after reading the ad that they will indeed visit that site, again, is that another DDOS attack? And if so, who is responsible for that DDOS attack?

Send your answers to The CAN of SPAM contest. First prize, a year's supply of scrumptious canned spam.

Tucows services still recovering from DDoS

[Jayfar]

"Reshef indicated that a few thousand domains managed by a top-five domain name registrar may have been impacted by the attack too, but an executive at the registrar told us that it had seen some upstream troubles but no direct attack."

Ha! All of Tucows services, including the managed dns and email defense services were completely down most of yesterday. The managed DNS service is still impaired until the new IPs of ns1.mdnsservice.com and ns2.mdnsservice.com propagate (they just this morning changed the TTL to 1200 secs %-).

status.tucows.com

Managed DNS Service Degraded Performance - restore time is currently unknown Beginning at approximately noon Wednesday May 3rd the Tucows network was under a severe DDOS attack. To stop the attack, we have changed the IP addresses of the servers. If you are using IP addresses in order to connect to MDNS, you will have to update your records. Also, any nameserver with a long TTL should be updated in order to use the new info. Next Update Time:15:20 UTC, 04 May 2006",/i>

bluesecurity.com domains

[zenzizi]

nobody commented yet that Blue Security have now mapped all their domains to "localhost" (127.0.0.1) ?

Re:bluesecurity.com domains

[davygrvy]

Yes, the good data can be found with dig:

> dig.exe @dns.netvision.net.il wd.bluesecurity.com +all
; <<>> DiG 9.3.2 <<>> @dns.netvision.net.il wd.bluesecurity.com +all
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1439
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;wd.bluesecurity.com. IN A

;; ANSWER SECTION:
wd.bluesecurity.com. 3600 IN A 66.197.244.213
wd.bluesecurity.com. 3600 IN A 72.36.247.11
wd.bluesecurity.com. 3600 IN A 206.225.91.121
wd.bluesecurity.com. 3600 IN A 64.15.139.81

;; AUTHORITY SECTION:
bluesecurity.com. 3600 IN NS nypop.elron.net.
bluesecurity.com. 3600 IN NS dns.netvision.net.il.

;; ADDITIONAL SECTION:
dns.netvision.net.il. 86400 IN A 194.90.1.5
nypop.elron.net. 86400 IN A 199.203.1.20

;; Query time: 234 msec
;; SERVER: 194.90.1.5#53(194.90.1.5)
;; WHEN: Thu May 04 11:21:20 2006
;; MSG SIZE rcvd: 196

Re:bluesecurity.com domains

[CCFreak2K]

www.bluesecurity.com
Server: UnKnown
Address: 192.168.1.1

Non-authoritative answer:
Name: www.bluesecurity.com
Address: 72.52.6.7

>

Appearently not.

To Stop Spam

[plaid_piper]

As always needs mentioned, Spam would not exist if it didn't have a market. The base problem is, as it has always been, that people respond to this.

People could stop clicking, but that is unlikely to happen. Especially in America, people are always looking for the easier path: be it cheaper medication, promises of enhanced "performance," tales of rapid weight loss while sitting on your couch, or the constant get-rich-quick scheme.

If people actually thought... yes, used higher brain functions... they may realize that it is virtually all just BS.

It could also be that the general masses don't realize that everytime they click on a link or reply to an email, someone is making money. And that is a problem with awareness of how the internet works. Most seem happy to just know that it works.

Re:To Stop Spam

[plaid_piper]

Perhaps Blue should consider a promotional education package at signup... You have to make it economically unfeasible for the spammers to continue. To do that, you'd have to have an enormous number of "aware" people actively working against them.

Re:To Stop Spam

[plaid_piper]

As if that were a comment that even needs said.

Webster's definition of Especially:
2 a : in particular : PARTICULARLY b : for a particular purpose
...and Particular:
4 a : distinctive among other examples or cases of the same general category

So yes, "Especially in America" is entirely appropriate.
Next time, try to understand the meaning of words a bit more before you attack a comment. :)

And you know mafia isn't involved?

[Lead Butthead]

The spammer is in Russia. Let's hire the mafia nd take him out. Blue security has 500,000 members. If we all put in $1.00 each, we should manage to hire someone to take the spammer out. He won't be a problem after that, and he won't send any more spam.

And you know with certainty that the (insert least favorite ethnicity) Mafia isn't involved in some ways with the "local" spam racket?

Re:And you know mafia isn't involved?

[wiskers69]

But being the mafia they work on free market principle. If they are making less than $500,000 from spam they'll do it. If they're making more than that mabe I'm in the wrong business

Re:And you know mafia isn't involved?

[tinkerghost]

Don't know where you are, but here in the states, we see news articles about people doing murder for hire for $50 & a blowjob, I think $500,000 would get the job done even if the Russian Mafia is involved. What't the $->Ruble rate nowdays?

Re:Is Blue Security going public with who's behind

[Maximum Prophet]

A riot is an ugly thing.... And I think it's about time we had one!

http://imdb.com/title/tt0072431/

the dude abides

[everphilski]

I don't know about you, but I take comfort in that. The dude abides.

Just not trying hard enough

[wiskers69]

I'm really disappointed in this mysterious top 4 spammer. I've been a member of blue security for somewhere around 4 months and I haven't recieved a single threatening email from him/her/it. I mean come on. I must have forwarded thousands and thousands of pieces spam to blue securtiy and yet he hasn't tried to black mail me once. Whats wrong with me? Maybe I'm just not trying hard enough, I only have 3 email addresses registered with the frog. OK mysterious spammer you've made your point. Only the best anti spammers get your attention so I will redouble my efforts and add add 6 new addressess to the protected registry. That will learn you to ignore me.

Re:Guilty of what?

[NitroWolf]

I wouldn't necessarily say you are wrong that it's Blue Security's fault, either through negligence or intentional thought... but to say they are the ones causin the DDoS is ridiculous.

They are not sending out the offending packets, the spammer is.

Is it unethical to redirect the DDoS you are getting hit with? Yep, I'd say so if you do it intentionally.
Is it illegal? Nope, not in any sense of the word. The people perpetrating the crime are the spammers, and they are the ones performing the illegal act.

It's no different than someone calling you up on the phone and telling you that you're going to be robbed tonight while you're out on the town. Before you leave, you switch the address on your house to your neighbors, and when you leave, the robbers break into your neighbors house. You sure are a dick, but you didn't do anything illegal. Your neighbors probably won't be happy with you, but they have no legal recourse, except to perhaps fling dog poo in your yard.

Re:Guilty of what?

[orkysoft]

Blue Security didn't DDoS them, the spammer did.

Spam SHOULD BE a crime

[D4C5CE]

Spamming is one crime (...) not a legit way to make a living yet he thinks he has some sort of right to live off other people's hell. I hope he's taken out soon.

"Merely" sending unsolicited bulk eMail is still not (yet) a crime in too many jurisdictions.

Which is incomprehensible and irresponsibly lenient for the law, given that spam is so obviously annoying (and costing so much of everyone else's time and money) that the burden of proof for using only a legitimate opt-in list, as well as for providing full and true contact details of the spamvertised entity (to bear the brunt of complaints to the extent that it misbehaves!) should be on the offender deciding to employ such a parasitic way of "marketing" in the first place. And, no, the myth that there was any First Amendment issue about it has been debunked for more than a decade already.

We cannot have to wait for the authorities to painstakingly have to prove further mischief by the spammer, in every single case, such as harassment, sabotage, identity theft, not honoring opt-out requests, failing to deliver paid p***s pills ;-), or making bogus claims in general: Spam itself should suffice to land the perpetrators in jail right away (and forfeit their fortunes - equipment and earnings).

You'll have to talk to your congresscritter about it (in most nations actually).

Why not...

[spyingwind]

Just pull the plug on the web server... or
redirct the domain name to 127.0.0.1(taking up to 24-48 hours to update) as one of the other posters posted...

Why I ask is because where I work we had a similar problem and sence I maintain our web server we had no choice but to unpluge the network cable. Waited 5 minutes and pluged it back in and vwala! no more DOS.
My best guess was that as soon as the DOS'er saw that our site was "down" they/it thought that there task was completed.

It is almost( but not quite the same) as if some one took a ethernet cable and created a loop on the same pair of switchs. (i.e. two switches are connected to each other. Then some random idiot looks at them and plugs in a spare cable in to both, creating a network loop.)

BlueSecurity on holiday? Unacceptable

[Animats]

Six Apart mitigated the attack to the point where it was no longer causing major availability problems, but had been unable to contact Blue. The anti-spam firm is headquartered in Israel, where May 3 was a public holiday.

This is a 24/7 business. A serious online service vendor can't have company holidays. Least of all in the security business.

Re:BlueSecurity on holiday? Unacceptable

[wiskers69]

On their website, well the blog really i supose, they said they were working yesterday despite it being a holiday.

Re:Guilty of what?

[NitroWolf]

Don't be fucking pedantic. It's an analogy, buy a clue.

Redirecting a URL is not vandalism.

Re:Guilty of what?

[Tim C]

It's a crap analogy though. A better one would be that you tell the guy who phones you that you actually live next door now, and he believes you. I'm not sure what legal recourse your neighbours would have, if any, but I'd be very surprised indeed if the police didn't want a few words with you. You may even find yourself facing charges for conspiracy or aiding and abetting, although that's probably a stretch.

On the other hand, your neighbour could almost certainly sue you for damages - look at OJ, acquitted by a criminal court then sued in a civil one for the same crime.

Back on topic, here in the UK intentionally redirecting a DDoS to someone else's servers is almost certainly covered by the Computer Misuse Act, so if you were to do it, you may well find yourself in court explaining your actions just as the original idiot does. I'd be surpried if a simmilar law didn't exist in the US.

Re:Don't let Blue Security fool you...

[bezzeb]

Another Spammer posing as an anonymous coward?

Claiming that Six Apart should take legal action against Blue Security because criminals were attacking Blue Security is absurd. It's like blaming the rape victim for getting raped.

All us Frog users have been desperate for news about our pals at Blue Sec. I appreciate the effort they took to get word out to us. The fact that the spammers then directed their attack towards SixApart shows just how desperate and belligerent they are. They are greedy godless bastards. And their actions shall undo themselves.

Blue Security's Blog

[smokeslikeapoet]

Blue Security Blog

Netcraft Article on DDoS

My original article on the attack 4/1/06

The DDoS started with invalid PHP requests. I think the spammer is using a combination of methods to disable Blue Security now, but that's just an assumption. The question is, how long are spammers going to focus their efforts on the counter attack? Using their resources to attack Blue Security means less resources to send profitable spam. The spammer wants me to unregister from Blue Security's site, but at the same time, disabled it. Don't get me wrong, I'm not about to cave in to extortion. Right now I'm happy to have Gmail intercepting spam so others don't have to deal with it. I guess you can say I and the rest of the Blue Security community are drawing fire for the rest of ya'll.

Re:Guilty of what?

[Neoprofin]

Your analogy is also crap.

The best I've got is running a business out of your home that does tit for tat retaliation on organized crime businesses. They rough up one of your boys you rough up one of theirs. They get upset so they burn your house to teh ground. You escape and leave a note on the burnt out ashes that you'll be staying at the Middlebury Hotel in case your clients need to get a hold of you. The mobsters see the note and procede to burn the hotel to the ground as well.

Re:Is Blue Security going public with who's behind

[Mister Whirly]

No, ethical would be getting the proof before going public. Knowing who is behind the attack is not the same as being able to prove who is behind the attack.

Taking out bloggers?—start with yourself

[dananderson]

Taking out spammers and bloggers? I can't see any down side to this, honestly.

Since you're a blogger, the best thing to do is to start with taking out yourself. Seriously though, nobody has to read blogs—spam is forced on people.

Re:Guilty of what?

[7ft_Big_Guy]

Sounds like you're one of the spammers attacking them... trying to redirect blame. BlueSecurity had EVERY RIGHT in the world to redirect their web site to their Blog when their servers went down to keep their members informed of what was happening, DDoS attack or not. the SPAMMERS are responsible, not BlueSecurity.

Re:Guilty of what?

[ekimminau]

Actuall, the moment I saw the DDOS I would have downed their BLOG and been downe with it.

Thank you!

[jfengel]

Hey, thanks. I use TUCOWS has my host provider (via DomainDirect) and I had no idea why they were down. All their page said was "Intermittent issues with the loading of any and all services through DomainDirect.com. This is affecting all services including domain registration, management and navigation. There is no ETA to a resolution time. We apologize for the inconvenience. "

Thanks for letting me know what's up, guys.

Re:Guilty of what?

[HTTP Error 403 403.9]

Don't be fucking pedantic. It's an analogy, buy a clue.

Redirecting a URL is not vandalism.
--
Fast, Reliable webhosting for online communities [communityhosting.net]

Is it okay for Blue to redirect the next DDOS to communityhosting.net? I hear it is fast and reliable.

What will the emo kids do?

[spun]

Come to slashdot and mod you down, obviously.

Re:Is Blue Security going public with who's behind

[RareButSeriousSideEf]

I think there were (are?) two overlapping but potentially unrelated attacks going on; there's the Blue Security incident as reported here, and there's also a defacement attack going on against certain bloggers, seemingly done by Islamicists angry over the bloggers' vocal championing of some Danish cartoonists who, for better or worse, insist on publishing mocking (or potentially defamatory) cartoon images of Muhammed.

"Instapundit" Glenn Reynolds had a sketchy report that one of those attacks originated in Saudi Arabia - http://instabackup.blogspot.com/. That of course doesn't necessarily mean anything, but the nature of the defacements involved are consistent with the theory: http://www.google.com/search?q=neEeO_hack

Related or not, it'll be interesting to see if & who Blue Security names.

Re:Guilty of what?

[Kelson]

Had BlueSecurity chosen to temporarily route their domain name to empty IP space, or to localhost, they could have mitigated the attack on their servers without offloading the problem onto someone else's network. Yes, they would still have been offline, but at least their servers wouldn't be melting, and Six Apart wouldn't have been taken down with them.

Now, I've read several articles on this, and it's not clear whether (a) Blue knew that the DDoS was targeting them by domain name (rather than by IP), or (b) whether they redirected their website before or after that phase of the DDoS started.

The way I see it -- assuming Blue did this with thir eyes open -- it's like deflecting a punch. You can deflect a punch so that it doesn't hit you, and deal with where it does hit later. Or, if you're in a kung fu movie, you can deflect the punch specifically so that it hits someone else instead. Pointing the domain name at Six Apart's network was deflecting the attack with the intention that someone else would get it.

Maybe they figured 6A had enough resources to handle it. (Hmm, anyone remember whether ./ has ever been DDoSed?) Maybe they figured the attack wouldn't follow the DNS change. While Blue Security is not responsible for launching the attack, they are arguably responsible for where the attack ended up. And that's something that could be the target of a civil lawsuit, even though it's (probably) not a criminal offense.

Would Six Apart would want to sue? Would a judge accept the case? Would a jury would actually award them anything? Who knows.

Bluesecurity DNS entries are poisoned

[davygrvy]

C:\Documents and Settings\davygrvy>NSLOOKUP -type=any BLUESECURITY.COM
Server: cns.sanjose.ca.sanfran.comcast.net
Address: 68.87.76.178

Non-authoritative answer:
BLUESECURITY.COM internet address = 127.0.0.1
BLUESECURITY.COM
primary name server = ns1.mdnsservice.COM
responsible mail addr = hostmaster.mdnsservice.COM
serial = 743954502
refresh = 10001 (2 hours 46 mins 41 secs)
retry = 7200 (2 hours)
expire = 2419200 (28 days)
default TTL = 86400 (1 day)
BLUESECURITY.COM nameserver = 127.0.0.1
BLUESECURITY.COM MX preference = 100, mail exchanger = 127.0.0.1
BLUESECURITY.COM MX preference = 10, mail exchanger = 127.0.0.1

It seems the MDNSSERVICE.COM is responsible for the data entries. The good data is this:

C:\Documents and Settings\davygrvy>"c:\Program Files\Dig.exe" @dns.netvision.net
.il reports.bluesecurity.com +all

; <<>> DiG 9.3.2 <<>> @dns.netvision.net.il reports.bluesecurity.com +all
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;reports.bluesecurity.com. IN A

;; ANSWER SECTION:
reports.bluesecurity.com. 3600 IN A 67.15.111.240

;; AUTHORITY SECTION:
bluesecurity.com. 3600 IN NS nypop.elron.net.
bluesecurity.com. 3600 IN NS dns.netvision.net.il.

;; ADDITIONAL SECTION:
dns.netvision.net.il. 86400 IN A 194.90.1.5
nypop.elron.net. 86400 IN A 199.203.1.20

;; Query time: 234 msec
;; SERVER: 194.90.1.5#53(194.90.1.5)
;; WHEN: Thu May 04 10:43:24 2006
;; MSG SIZE rcvd: 153

Re:Guilty of what?

[Jesus IS the Devil]

Blue Security IS partially guilty of causing the DDOS, because they KNOWINGLY redirected DDOS traffic to a third party. It's the same as if I owed you money, but when we're being both robbed, I give the money owed back to you, knowing full-well that we're just about to be robbed. Under the law, I will still owe you this money.

Re:Guilty of what?

[grrrgrrr]

More logical would be that they directed the url to have a internet page hoping the ddos was using ip addresses or something. They could have just pulled the plug as nobody can find your server if are not in the dns so it did not help them. Maybe it was very stupid but not the deliberate kind of guilty like the spammers.

Re:Guilty of what?

[Anonymous Coward]

"Is it unethical to redirect the DDoS you are getting hit with? Yep, I'd say so if you do it intentionally.
Is it illegal? Nope, not in any sense of the word."

Well, I *could* call it "aiding and abedding". Someone does not need to be a robber to be tried as one (think of the guy driving the getaway car).

And I can surely see a case where the provider of the packets causing a DDos would be convicted, and another conviction for someone who directed the flow of those packets to a known party ....

Maybe you could look at it like this : You might get hit by a large quantity of water, which threatens to damage your property. You are surely permitted to try to get rid of that water. But to transfer the water to a known other person, resulting in his property getting damaged like you where afraid it would do yours is premeditation.

The second, damaged person is then surely within his rights to claim damages. And if the judge is willing, he won't permit the redirector of that water to re-claim those damages from the person who send it in the first place.

Re:Guilty of what?

[jo42]

Genuis Moron at Blue Security should have redirected to 127.0.0.1 instead of a blog hosting service.

What they did was wrong. Period.

awright ... fess up...

[nblender]

I don't associate spammers with the sort of people who have brains. This means that the spammers are hiring brains (not that it takes much brainpower to write php but I digress)... The sort of brains they'd hire are probably slashdot geeks....

So which of you scumbags is responsible for this.

Re:awright ... fess up...

[dodobh]

A lot of spammer code is in VB/VC++ (toolbars, cursors, viruses, trojans, winodws desktop based proxies for DNS and HTTP and SMTP clients).

Re:Guilty of what?

[sholden]

Which law is that? Statute and section numbers please.

Re:Is Blue Security going public with who's behind

[Fordiman]

*contented sigh*

There ain't no justice like angry mob justice...

Re:Is Blue Security going public with who's behind

[Fordiman]

C'mon, would you want to send the guy into hiding before you could get the authorities to string him up, tar and feather him?

They are going after the clients...

[Eric Damron]

"The best way to eradicate spammers would simply be to go after their clients."

That's exactly how it works. Most spam comes with a link to a website that is used to sell their "products." It might be cheap drugs, watches or snake oil. The Blue Frog software analyzes the website for the input form and fills the text boxes with requests to be removed. Further ALL PCs using the Blue Frog software and are on the Internet at the time send the spammer's website opt out requests. So it IS the clients i.e. people using the spammer's service who get hit. Spammer's must pay for the bandwidth that they use and so this makes their spamming activities less profitable. That's why they're so pissed off.

Re:Staged by BlueSecurity for publicity

[davygrvy]

Oh, get real... you're asumption is FOS

Re:Guilty of what?

[michrech]

You buy a clue. Your analogy was incorrect. You made it sound as if it was perfectly OK to swap house addresses so the other house had (insert bad thing happen here). What BS did was wrong and I'm sure the US has laws that will cover such an act. To "fix" a DDoS, you don't point your address to someone elses server. At the very least, I (and I'm sure "the law") consider that THEFT OF SERVICES.

So no, redirecting a URL isn't vandalism technically (though I consider it to be so), but it is illegal (as far as I can tell).

Move along, you are obviously too young to be here with the rest of us.

community.bluesecurity.com back online?

[davygrvy]

;; ANSWER SECTION:
community.bluesecurity.com. 3600 IN A 64.62.177.88

http://64.62.177.88/

It loads, but the forums are missing.

Re:community.bluesecurity.com back online?

[lrowland]

The link takes you to apge that LOOKS like a Blue Security page but it is not the right IP for them. This almost looks like someone trying to get people to try to login to BlueSecurity so they can capture their account info.

I personally would not trust this IP.

Re:community.bluesecurity.com back online?

[RedToad]

Ta Da!

Hey, lookathis.

From the Prolexic web site, the big blurb babbles blissfully, and I quote -

Distributed Denial of Service (DDoS) attacks have rapidly become a commonplace threat to doing business on the internet. With over 2,000 distinct attacks per week, denial of service has quickly become the most costly form of cyber-crime businesses face today.

Then lookie here, lookie here -

bluesecurity.com. SOA IN 300

Primary DNS server: gdc.prolexic.net.
Serial: 2006050403
Refresh: 86400 (1d)
Retry: 900 (15m)
Expire: 1209600 (2w)
Minimum/NegTTL: 7200 (2h)

There are no lapses in your synapses. Zip-pe-de-doo-dah!

Spammers = Mafia?

[Anubis_Ascended]

Seems to me that when people try to shut down the spammers, the spammers strike back, ala the Mafia

Remember SPF?

[killjoe]

SPF would have put a serious dent in this problem. Too bad MS singelhandedly killed it by refusing to implement it and pushing their proprietary framework instead.

I say we go back to SPF, and start refusing email from anybody who does not have an SPF record. It won't solve the problem but it will reduce it greatly.

Re:Guilty of what?

[NitroWolf]

My analogy was spot on. You are a clueless noob who can't fathom that an analogy is to illustrate the faliciousness of the arguement in question, it is not meant to be a 1:1 comparison.

You also appear to have a reading comprehension problem in so far as I said nothing about it being OK to swap house addresses, that's a product of your own limited ability to understand written English. I said the person swapping house numbers is not committing the crime; the person robbing the house is. Regardless of whether or not the act of switching addresses is illegal in the physical world, the act of redirecting your URL to another IP is not illegal anywhere in the world. Thus, the analogy is spot on and your limited mental facilities are unable to comprehend the difference between an analogy and a direct comparison.

I'm sorry that you are unable to understand simple concepts like this, but the failure is in yourself (or education) not in the analogy.

Lets see who the young one is here... your UserID is 468134, mine is 72977. Yeahhh... I'm gonna have to go with you being the one that's too young to be here with adults. In fact, I'm gonna go so far as to say I've been working in the computing industry longer than you've been alive. So scat, noob, you aren't allowed at the adult table anymore.

Re:Kill the spammers? Maybe.

[Roadkills-R-Us]

In some cases I *do* personally advocate the death penalty for spammers. I don't even care if it's vigilante justice so long as it's proven they got the right guys. Spam costs billions of dollars in wasted time and money. It's already wasted several months of my life between work (I work in IT) and home (I've had the same email address for years, since before spam was a big problem, and I get *at least* 1K spams a day hitting my mailserver). That's like killing me before I would have died. The money and effort wasted on spam last year in the USA alone would probably have taken care of all the hurricane victims in the USA, if not world-wide.

Spammers suck. The worst ones should be made examples of. Put their heads on the fence posts of the Whitehouse or main building of the government of whatever country they're caught in.

If not the death penalty, they should at the very least spend the rest of their lives in public stocks, where passersby can mock and whack them. Send 'em on an international tour (semi trailer, slowboat, etc) and charge people to see 'em. Use the revenue to round up the others.

We're waaaay to "civilised" for our own good.

bloody thieves!

[budgenator]

The bloody thieves at bluesecurity.com stole my webpage! ;) seems the splash page is redirecting to localhost; at least their not letting a blog site get hammered anymore.

Re:Guilty of what?

[HTTP Error 403 403.9]

Show me one place in this thread that I've said it was ok, and I will agree that it's ok.

Ummm ok as a "newbie" I shall bow down and remind that you stated in your GP, "Redirecting a URL is not vandalism." So redirecting a DDOS attack from Blue Security to communityhosting.net seems to be consistent with your statement that it is not harmful or wrong - oh so great one, of which I am not worthy to dwell in your cyberspace.

Again, another idiot with zero reading comprehension skills! Yay for the iNtarW3b!

God, I wish you idiots would go back to AOL and leave the people with intelligence alone.

Your disapproval haunts me and leaves me flaccid, I fear I will not be able to perform my carnal duties to your wife. That saddens me because I so dearly wanted to be your friend.

Re:Is Blue Security going public with who's behind

[Achromatic1978]

"Instapundit" Glenn Reynolds had a sketchy report that one of those attacks originated in Saudi Arabia - http://instabackup.blogspot.com/. That of course doesn't necessarily mean anything

How surprising, a pro-war conservative blogger jumps all over a "sketchy" report that perhaps one of the DDoS attacks originated in an Islamic country. Could it perhaps be that some zombied computers were there? Or is this the towelheads "hating our Freedom" again? You be the judge!

Golly, colour me shocked that such a thing would happen.

My froggie can't join the pond :(

[davygrvy]

BF needs two servers to function: members.bluesecurity.com and wd.bluesecurity.com. It appears that sixapart.com is hosting a dummy members.bluesecurity.com for the moment @ 204.9.178.12

Re:My froggie can't join the pond :(

[bezzeb]

My frog is also incommunicado... But on the good side - the reports that Blue Security has been online and available in Isreal and some parts of europe seem to be true.

Go to watchmouse and punch in a blue security url. I've been doing this all week, and it seems that server in Frankfurt has had no problem resolving and pinging Blue Sec. since the start. But global DNS propogation certainly seems jacked.

DDoS is manageable but DNS tamper? I'd say this is an effective lesson that the net is extremely vulnerable to criminal interruption. The smart heads need to get together and fix this.

If you want to try a global ping:
http://www.watchmouse.com/en/checkit.php

& punch in a URL. www.bluesecurity.com is still alive in Frankfurt.. Not sure if they're able to dish out web pages though...

Re:Is Blue Security going public with who's behind

[mikesd81]

You don't have to make it public who it is, just notify the authorities. If I see a person on the most wanted list, I'm gonna call the authorities, not broadcast to everyone that he's on the most wanted so he goes running.

Re:Guilty of what?

[NitroWolf]

Jesus H. Christ on a crutch... are you fucking dense or what? I didn't think anyone could possibly be as obtuse as you seem to be and still be capable of operating a computer.

How on earth do you possibly equate the statement that "Redirecting a URL is not vandalism" with "It's ok to be a dick to your neighbor." Are you just pretending to be stupid to troll, or are you really that incapable of critical thinking?

There are two statements made here, that you seem to have tried to graft together to support your ludicrous point.

The first statement is "Redirecting a URL is not vandalism." It's not. Please tell me how you think it's vandalism. Once you have that thought in your head, try to keep it there while you go look up what exactly vandalism is. Now compare what it IS and what you THINK it is. Are they the same thing? Go ahead, give it a shot, I'll wait.

Now that you've done that, I could have saved you some time, the correct answer is 'No, they are not.'

Good, now that we've got that fact out of the way, lets see the other statement you are using in conjunction with the above, "So redirecting a DDOS attack from Blue Security to communityhosting.net seems to be consistent with your statement that it is not harmful or wrong."

Where did I say that it is not harmful or wrong? Oh... that's right, I didn't. I said it wasn't illegal. I said "your neighbors will probably think you are a dick." I also said that it is unethical (read: NOT OK, duh) to do so.

oh so great one, of which I am not worthy to dwell in your cyberspace.

You're goddamned right you aren't worthy to dwell in my cyberspace. Fucktards like you should not be allowed anywhere near a computer, much less on the internet.

Your disapproval haunts me and leaves me flaccid, I fear I will not be able to perform my carnal duties to your wife. That saddens me because I so dearly wanted to be your friend.

Ahh, a wife joke. That's almost as good as a "Yo mama" joke! Wow... dude, do you write your own material, or does someone from the 3rd grade write it for you?

I know you wanted to be my friend, but I am far, far too manly for you. My balls are so huge they dwarf the largest ball of twine in Minnesota like the earth dwarfs the moon. They are so large, they have their own gravitational pull. There is simply no way a mere mortal like yourself could ever comprehend the entire granduer of my sac in one lifetime; it would take you at least ten. I don't have that kind of time... so no, you can never be my friend, nor can you ever know me. You are simply not evolved enough; you are not on the same plane of existence. You can not comprehend even a fraction of my awesomeness. I am sorry. I truely am... but you should probably just go kill yourself now... the crushing depression you will feel after reading my words that I have deigned to bestow up on you will eat at you for the rest of your short and pitiful life.

Bow before me, and I may allow you to gaze upon a small portion of my granduer for a moment longer.

Re:that is what Bluesecurity is doing

[QuietLagoon]

The Bluesecurity concept is one approach, but I was thinking that going after companies like Bank of America, SBC Communications and Sprint who actually sponsor the sending of spam may be more productive.

Re:Guilty of what?

[michrech]

You know how many people like you I've run into that are all talk and no brains?

I very much doubt you've been working in the computer industry longer than I've been alive. What you have experienced that far back, IF it is true (still HIGHLY unlikely) has little to no bearing on what is going on in the industry today, anyway. The fact you had to resort to name calling proves me correct.

To touch on your point about redirecting a url not being a crime: If your redirection causes the target to loose communication (as was the case here), it is theft of services. VERY MUCH illegal. The ends do NOT justify the means.

Your UID being lower than mine also means nothing. Small slahsdot UID's have appeared on ebay in the past. How am I to be sure you haven't purchased it?

This is the end of the conversation. You are worth no more of my time.

Re:Guilty of what?

[NitroWolf]

You know how many people like you I've run into that are all talk and no brains?

I very much doubt you've been working in the computer industry longer than I've been alive. What you have experienced that far back, IF it is true (still HIGHLY unlikely) has little to no bearing on what is going on in the industry today, anyway. The fact you had to resort to name calling proves me correct.

Judging by your comments, I'm betting the chances are increasing dramatically that my first statement is true. Go back to school, Junior!

To touch on your point about redirecting a url not being a crime: If your redirection causes the target to loose communication (as was the case here), it is theft of services. VERY MUCH illegal. The ends do NOT justify the means.

This is what you are clearly incapable of understanding. Redirecting a URL is simply that... redirecting a URL. They are not generating any traffic to the target site... someone else is. THOSE people are responsible for theft of service, not Blue Security. Why can't you get the fact of root cause through your thick skull? As I said, if Blue Security did it intentionally, they are guilty of being dicks, nothing more. The criminals are the ones orchestrating the DDoS.

So no, it's not "VERY MUCH illegal," no matter how much you want it to be, the law states otherwise. Sorry to burst your bubble.

Your UID being lower than mine also means nothing. Small slahsdot UID's have appeared on ebay in the past. How am I to be sure you haven't purchased it?

Because you can read back through my post history and see that my posting style has remained pretty much the same since the beginning. Duh.

This is the end of the conversation. You are worth no more of my time.

Ahh yes, the tired old response to someone who's been pwned. GG sir! Plzdrivethru thx.

Re:Guilty of what?

[HTTP Error 403 403.9]

Jesus H. Christ on a crutch... are you fucking dense or what? I didn't think anyone could possibly be as obtuse as you seem to be and still be capable of operating a computer.

How on earth do you possibly equate the statement that "Redirecting a URL is not vandalism" with "It's ok to be a dick to your neighbor." Are you just pretending to be stupid to troll, or are you really that incapable of critical thinking?

There are two statements made here, that you seem to have tried to graft together to support your ludicrous point.

The first statement is "Redirecting a URL is not vandalism." It's not. Please tell me how you think it's vandalism. Once you have that thought in your head, try to keep it there while you go look up what exactly vandalism is. Now compare what it IS and what you THINK it is. Are they the same thing? Go ahead, give it a shot, I'll wait.

Now that you've done that, I could have saved you some time, the correct answer is 'No, they are not.'

Good, now that we've got that fact out of the way, lets see the other statement you are using in conjunction with the above, "So redirecting a DDOS attack from Blue Security to communityhosting.net seems to be consistent with your statement that it is not harmful or wrong."

Where did I say that it is not harmful or wrong? Oh... that's right, I didn't. I said it wasn't illegal. I said "your neighbors will probably think you are a dick." I also said that it is unethical (read: NOT OK, duh) to do so.

oh so great one, of which I am not worthy to dwell in your cyberspace.

You're goddamned right you aren't worthy to dwell in my cyberspace. Fucktards like you should not be allowed anywhere near a computer, much less on the internet.

Your disapproval haunts me and leaves me flaccid, I fear I will not be able to perform my carnal duties to your wife. That saddens me because I so dearly wanted to be your friend.

Ahh, a wife joke. That's almost as good as a "Yo mama" joke! Wow... dude, do you write your own material, or does someone from the 3rd grade write it for you?

I know you wanted to be my friend, but I am far, far too manly for you. My balls are so huge they dwarf the largest ball of twine in Minnesota like the earth dwarfs the moon. They are so large, they have their own gravitational pull. There is simply no way a mere mortal like yourself could ever comprehend the entire granduer of my sac in one lifetime; it would take you at least ten. I don't have that kind of time... so no, you can never be my friend, nor can you ever know me. You are simply not evolved enough; you are not on the same plane of existence. You can not comprehend even a fraction of my awesomeness. I am sorry. I truely am... but you should probably just go kill yourself now... the crushing depression you will feel after reading my words that I have deigned to bestow up on you will eat at you for the rest of your short and pitiful life.

Bow before me, and I may allow you to gaze upon a small portion of my granduer for a moment longer.

Tim, I'd write something witty but honestly I think you have a serious rage disorder that needs immediate psychiatric attention.

Get help.

Re:Guilty of what?

[NitroWolf]

Tim?

Rage Disorder? Ahh... you meant to say "I am incapable of coherent thought and thus can not come up with anything suitably witty to retort with."

I understand, sir. It's ok... there's always the Special Olympics for you!

Re:Guilty of what?

[HTTP Error 403 403.9]

Tim?

Rage Disorder? Ahh... you meant to say "I am incapable of coherent thought and thus can not come up with anything suitably witty to retort with."

I understand, sir. It's ok... there's always the Special Olympics for you!

Get some help.

Re:Guilty of what?

[NitroWolf]

You've provided me with all the help I need... knowing that there are people out there more stupid than a boiled banana warms my heart.

At least I know that no matter what happens to me in life, even if I become a vegetable in a hospital bed, drooling all over myself and unable to comprehend even basic shapes... you'll still be out there, making me look like Stephen Hawking when compared to you.

I can now rest, knowing that there will always be a bigger idiot out there, somehwere, on the internet.

Thank you for that, sir. Thank you for that!

Re:Guilty of what?

[HTTP Error 403 403.9]

You've provided me with all the help I need... knowing that there are people out there more stupid than a boiled banana warms my heart.

At least I know that no matter what happens to me in life, even if I become a vegetable in a hospital bed, drooling all over myself and unable to comprehend even basic shapes... you'll still be out there, making me look like Stephen Hawking when compared to you.

I can now rest, knowing that there will always be a bigger idiot out there, somehwere, on the internet.

Thank you for that, sir. Thank you for that!

Bellevue Hospital Center
462 First Avenue
New York, New York 10016
(212) 562-1000

Get help - n00b.