The Blue Frog vs PharmaMaster

I’ve been trying to make some sense of this recent drama involving Blue Security, an anti-spam registry that effectively tries to deter uncooperative spammers by overwhelming their servers, and recent outages at TypePad and LiveJournal apparently caused by a revenge attack by spammers on Blue Security. (Here’s some more information on Blue Security and the Blue Frog.) The outages were caused when Blue Security redirected the spammers’ attacks on its website to the company’s blogs which were hosted on TypePad and LiveJournal.

So what really happened?

• Blue Security’s web site has been under attack for most of this past week, via a distributed denial-of-service (DoS) attack which basically tries to overwhelm a site with traffic sent from as many computers as possible (the site is now back up);
• To try to deflect the attack, which effectively suspended its service, Blue Security changed its Internet address to its TypePad blog;
• This overwhelmed SixApart’s servers, temporarily affecting all its blogging services, including TypePad and LiveJournal;
• Meanwhile, spammers presumably linked to the DDoS attack sent threatening emails to, apparently, anyone on the list of the Blue Security do-not-intrude registry. Blue Security works by building a network of users who report spam. The source of the spam is then contacted and then asked to remove all email addresses of its members from their spam lists. If they fail to do so, software installed on users’ computers fills out forms on websites linked to in any subsequent spam, creating a wave of traffic to the spammer’s web site, that, in theory, brings the spammer’s activities to a stop.
• The spammer, or another spammer, then contacted Blue Security via ICQ instant message, to taunt and threaten the company, apparently in a bid to stop its activities.
• The spammer, or another spammer, has also been sending emails containing Blue Security contact and registration information. This might have been done in the hope of getting recipients to complain to those email addresses and phone numbers to further overwhelm the company’s resources.

This account is not uncontested. According to a Blue Security press release:

• Blue Security claims that it was not the victim of a DDoS attack, but that the spammer — identified as PharmaMaster –– persuaded a staff member of a top-tier Internet Service Provider to block Blue Security’s IP address at the backbone. This would have blocked all traffic from outside Israel, where the Blue Security web site is located.
• Blue Security then closed its web site and posted a note on its blog (hosted elsewhere.)
• Shortly afterwards, Blue Security says, PharmaMaster launched a DDoS attack on any site associated with Blue Security, causing outages at five top hosting providers, a major DNS provider and a popular blog site.
• Blue Security has denied reports, including one by the Associated Press, saying that its do-no-intrude lists have been compromised. Blue Security works by allowing compliant spammers to run its email list through a program which compares it with a special encrypted list of Blue Security members. While the spammer is not able to see or access the Blue Security list, Blue Security members’ email addresses will be removed from the spammer’s list. This is done, in part, so individual Blue Security members are not then known to a spammer, and so the spammer cannot gain access to the Blue Security registry for spamming purposes. The AP report suggests the spammer has figured out a way to work out which email addresses belong to Blue Security members by merely comparing its own list before and after running it through the Blue Security removal process. Those email addresses no longer on the spammer’s list must be Blue Security members, the report says.

This account is contested by some security analysts, who point out what they say are some inconsistencies in Blue Security’s account:

• Elsewhere Blue Security’s Eran Reshef acknowledges that Blue Security didn’t just post a note on its blog, but it redirected traffic from its bluesecurity.com URL to the TypePad blog. He is quoted as saying he didn’t anticipate that the spammer would launch a DDoS attack on such a large player. “I didn't think he was so crazy as to attack them,” said Reshef. This raises the question: Was this done before or after the DDoS began? Rashef says it was.
• If Blue Security’s routing was changed internally, as Blue Security suggests, there should be a record. One analyst says he can find no record of anything “fishy.”

Blue Security clearly has its supporters. An article on one website has received, at the time of writing, more than 200 comments. The Blue Security blog’s single post received more than 100 before comments were closed.

Perhaps one of the most interesting aspects to all this is how clearly at least one spammer perceives Blue Security as a threat to its business. Not only is it trying to scare the company and members of its registry into abandoning their approach, but it is also adopting more open tactics: contacting the target directly via ICQ, perhaps in an effort to intimidate or negotiate, and to email and post comments to the above websites to try to scare members into removing their names from the registry and uninstalling the software that returns spam to the sender’s servers.

You don’t need to agree with Blue Security’s tactics to acknowledge they must be making some kind of impact for this to happen. What is perhaps a little bit scary is that Blue Security don’t seem to have been ready for this attack, and reveal some naivety and lack of understanding about how the Internet works by merely redirecting the assault to other servers. Not only would this not solve their problem, it also exposes them to legal action by the companies behind the redirected servers if it emerges that they were not informed beforehand. Still a lot of questions to be answered on this one.

Comments

[Spy der Mann]

There was a mail sent by the Blue Security CEO to SANS.

http://isc.sans.org/diary.php?storyid=1311

There he explains everything that happened. The original DDOS attack was on Blue Security's anti-spam servers, NOT the www server (the www server was disconnected by other means).

An hour AFTER they redirected their www server to the blog, the spammer attacked the blog services. So no, it wasn't a simple redirect. The DDOS on Six Apart was a separate attack perpetrated by the spammer.

[johnquepublic]

It's interesting to note that the original attacks were on the ip address: 194.90.8.20, which was formerly www.bluesecurity.com, and reachable via Netvision's 2 upstream ISP's (look for AS1680 connectivity via routeviews or fixed-orbit). Certainly BlueSecurity noticed the traffic which peaked at over 2 million packets per second to this single ip address.

BlueSecurity's timeline for switching to their 'blog' (CNAME for www.bluesecurity.com pointed to bluesecurity.blogs.com) and the 'lag' of the attack of over a half hour is interesting as well. Take a look at BlueSecurity's comment's regarding 'there was no active attack because people were placing comments on the blog for the first 30 minutes of it being in service'... Interesting to point out that their www.bluesecurity.com DNS resource record had a 1 hour time-to-live as well, so on average 30 minutes or so would have elapsed before anyone (zombie bots included) would have switched over to their 'new' site.

BlueSecurity is clearly at fault and should pay damages for the actions to sixapart.

[Brian]

Blue Security is NOT at fault "johnquepublic" you moron. Why are you defending the spammer that started this attack? Maybe you should do the internet a favor and quit using it to post stupid comments on blogs.

[PFMC]

I just want to say that PharmaMaster place is @ six feet under the ground... what fuc..... guy, i can't find the right words to describe this thing that call's himself PharmaMaster... maybe is just another one who was abused @ childwood, rapped, or something like that, or just another empty head...

I hope i read this nad enjoy my opinion ;)

[Denial of Service Attack]

I like this blog very much keep it up