Blue Frog

» see bluesecurity.com as it lived, on the wayback machine

~ the last words ~

Blue Security's product was a piece of arithmetic. Spam is profitable because sending it costs almost nothing and answering it costs the recipient a few seconds. Reverse the direction and the numbers stop working: if every message a spammer sends comes back as one automated complaint on the website he is advertising, then volume becomes his problem instead of yours. Blue Frog was the client that did the reversing. You installed it on Windows or added the browser plugin, registered up to ten addresses in a hashed list called the Do Not Intrude Registry, and it went to work on your behalf.

The registry was hashed on purpose, so the list itself was not a fresh set of addresses for anyone who stole it. Spammers could download a free tool to scrub Blue Security members out of their own lists, which was the entire point: the company wanted compliance, not revenge. By early 2006 the registry held somewhere around 450,000 addresses and the company was claiming half a million. Several large spam operations had actually started cleaning their lists rather than absorb the complaints.

Spam in 2006 was a fact of the inbox the way weather is a fact of the street. My mail lived on TTNet at home and on hotmail and yahoo accounts that filled up faster than anything I actually wanted to read, and the only defense anybody I knew practiced was a second throwaway address for anything that asked for one. Blue Frog was a thing you had to go looking for, in English, on the sites where people argued about the problem rather than just deleted it. I never installed it. The fight it started was invisible from where I sat, and so was the fact that it lost.

~ the record ~

~ the retaliation ~

On 1 May 2006 Blue Frog users began receiving threatening mail claiming the software was really harvesting their details for identity theft. Blue Security denied it. The messages were the opening move: whoever sent them had the member list, or a large part of it, which meant somebody had done the work of reversing the hashes against a dictionary of addresses they already owned.

Then came the flood. A spammer using the handle PharmaMaster pointed a botnet at bluesecurity.com and held it there. CEO Eran Reshef said he had been told directly, over ICQ, that Blue had found the right solution and would not be allowed to keep it. Security researchers later matched the planning chatter to names already sitting in Spamhaus's ROKSO register, among them Christopher Brown and Joshua Burch.

~ the actual end ~

With its own servers buried, Blue Security repointed its DNS records at the company weblog, which was hosted on blogs.com, a Six Apart property. The attack followed the record. Six Apart's server farm went over and took something like 2,000 unrelated blogs with it, plus outages across TypePad and LiveJournal for people who had never heard of Blue Frog and had no stake in any of this. A Renesys engineer described the maneuver as pushing a burning couch out of your house and into your neighbor's, which is unkind and roughly accurate. Blue Security's position was that it did not know an attack was in progress when it made the change, having been cut off from its own network in Israel.

On 16 May the decision leaked, and on 17 May Reshef made it public. His reasoning was not that the company had run out of money or nerve. It was that continuing meant a fight the company had no standing to conduct: quitting was the only way to avoid a full-scale cyber-war that Blue Security did not have the authority to start, and its users had never signed up for one. That is a strange and honest thing for a founder to say out loud. It is also the only correct answer, given that the other side had bandwidth and no legal exposure and Blue Security had neither.

~ the long tail ~

Scott Berinato's account for Wired ran that November under a headline about how one company fought the new internet mafia and lost, and it is still the fullest telling. A former member wrote a tool called Complainterator that did a smaller version of the same job by hand, without a central registry to attack. The Blue Security founders went on to build Collactive, which did something else entirely.

The idea did not come back, and the reason it did not is worth naming plainly. Every later approach to spam moved the cost somewhere the spammer cannot reach: filters running inside Gmail and Hotmail, reputation scoring at the mail server, authentication records in DNS. All of that is defensive and invisible, and nobody running it ever gets a threat over ICQ. Blue Frog was the last serious attempt at the offensive version, and what it demonstrated is that a company with half a million volunteers and a good argument still cannot survive contact with somebody who owns a hundred thousand compromised machines and does not care what happens next.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »