Getting DoS'd? Offload it onto someone else!

[Steve]

Blue Security came under a DoS attack lack week, most likely over their controversial anti-spam service. Their website came under fire, so what did they do? They redirected traffic to their blog, hosted by blogs.com, taking down TypePad and LiveJournal.

Blue Security has established a ‘Do Not Intrude Registry’ (akin to the Do Not Call Registry for telemarketing) with around 450,000 members. Participants download a small tool, called Blue Frog, which systematically flood the websites of spammers with opt-out messages. Depending on your point of view, this initiative can either be viewed as community action or vigilantism.

[The Register]

[stmok]

So let me get this straight...(analogy time!)

The water main has burst (DoS) and its flooding your place. To make the flooding subside, instead of trying to reduce the water main's ability to completely flood your home, you duct the flow to your surrounding neighbours! So everyone gets flooded!

Not only is this irresponsible, you basically have demonstrated your incompotence to the world! (This is the Internet remember!)...It makes things worse because this is a security company acting in this manner! (Do you really expect to get more users/customers in the future?)

As Trump says: You're Fired!

[herulach]

Its not a security company, they basically run a ddos system, then claim its ok because theyre targetting spammers.

[Paranoid2000]

Its not a security company, they basically run a ddos system, then claim its ok because theyre targetting spammers.

Hardly - they just provide a means for members to send unsubscribe emails that actually reach the spammers, who normally employ every means they can to avoid complaints (forged sender addresses, forged email headers, falsified domain registration details, etc).

However this redirection of incoming DDoS traffic to an innocent third party was either utter incompetence or criminal carelessness - more likely the first. The question is whether the publicity ends up benefitting them long term? Most users would value the service they offer and this incident simply shows how effective they are against spammers - this one is doubtless losing thousands in potential extortion on other websites in trying to keep BlueSecurity offline.

[Jonny M]

No sympathy for Blue here at all, they are going about it the wrong way. DDoS is not something that can ever be justified.

[Synergy6]

I don't like spam, but spam is better than DoS. Classify it how you will, but flooding anybody's systems, even for the most noble of purposes, is DoS. Hell, they've managed to move to the realms of DDoS with their little program. If they get their own medicine in return, so be it.

[Paranoid2000]

Hell, they've managed to move to the realms of DDoS with their little program. If they get their own medicine in return, so be it.

If you are referring to Blue Security (rather than the spammer which is doing the DDoS) then you are greatly misinformed - they send unsubscribe emails to the spammers' real addresses, one for each spam received by their members.

If you view this an unjustified inconvenience to spammers, then consider the trouble that they themselves cause - hijacking PCs for use as spam zombies, forging sender address and email headers (and using innocent users' email addresses so that they get hit by any bounces), flooding networks with traffic, hijacking open relays, crippling email servers with dictionary and brute-force attacks to obtain addresses and wasting many man-years of effort on the part of ISP abuse desks, network and email administrators and end users in trying to counter this problem. Already many businesses have become uncontactable by email due to spam - for other effects see Thank Spammers.

Blue Security's response is a drop in the ocean compared to the network disruption these spammers cause - but it is clearly upsetting the scum of the Internet and should be praiseworthy for that alone.

[RedPutty]

I have seen typepad brag how they can cope with massive surges of traffic so I am guessing blue thought they would be able to cope rather than it being malicious.

[UltraMagnus]

thats why i was having trouble connecting.

oh well, personally i like what blue security is doing, it has cut the amount of spam i was receiving on my gmail account to 1/16 of what it was.

oh, and before anyone starts feeling sorry for the spammers, remember, they mainly target people with their e-mail public on places like this

[BeoWulf]

When it comes down to it. If a man is going to kill 5 other people, should you kill that man?. It all comes down to morality. What would you do?.

[RedPutty]

Getting a lot of emails is almost never fatal.

[[H]omer]

You could chastise C/R (Challenge/Response) Email systems for similar behaviour - i.e. causing more spammy traffic to innocent victims than it removes.

I've been using SpamArrest for over a year now, and I'm afraid I just could not live without it. I just never get spam now ... ever ... ever.

So flooding some spammer's mail/web server with "unsubscribe" messages does cause a lot of traffic, but until we figure out a way of permanently shutting down these scum, I'm happy to resort to other methods, however extreme.

[Paranoid2000]

You could chastise C/R (Challenge/Response) Email systems for similar behaviour - i.e. causing more spammy traffic to innocent victims than it removes.

The problem with C/R is that they bounce spam (which mostly contains forged sender addresses) onto innocent third parties - that makes them totally different from Blue Security's system where they investigate spam websites (even to the extent of placing an order) to find a real address to complain to. They are also easy for spammers to break - or even use for Joe Job attacks (by listing anti-spam activists and groups as senders). See Challenge-Response Anti-Spam Systems Considered Harmful for more details.

I've been using SpamArrest for over a year now, and I'm afraid I just could not live without it. I just never get spam now ... ever ... ever.

Since it just redirects your spam to someone else - thank you very much. I get a few "challenges" every week from people I've never emailed and always report them to SpamCop. If your email server (or your ISP's if you use theirs) ever ends up on a blocklist, you now know the likely cause.

[Synergy6]

but flooding anybody's systems, even for the most noble of purposes, is DoS.

Paranoid2000, I had basically replied to your own reply in the above part of my initial post. I'm well aware of what Blue Security do. Thank you, but I do not need it explained once more. I don't view it as an "inconvenience", I view it as illegal. 2 wrongs decidedly do not make a right.
I also know what spammers do, but again thank you for re-explaining that to me. As for upsetting anyone, I find quite a few people that partake in DDoSing actually take a rather misguided pleasure in it. So, in effect, Blue Security are providing a worthless service for their members, and just asking some of the world's foremost users of DDoSing to hit them. Nice work chaps.

[UltraMagnus]

just to clear up the crap, heres what happend http://www.bluesecurity.com/announce...k_timeline.asp

blue security sends the opt out requests to the spammers original address, not the spoof address.

quite frankly, all i can say is, that, if spammers are responding this way, it has to be pissing them off, and anything that will piss off scum like this, is a good thing.

somtimes you have to fight spam with even more spam..... somtimes you have to do evil in the short term for good in the long term....

make no mistake, these people are scum, and dont deserve our pity...

[Steve]

You'll never guess what spam I've started getting:

Simulated DDoS Network Attacks and Network Intrusions

Customer Challenge:
Large corporations often hire consultants to conduct quarterly penetration (DDoS)
testing on specific segments of their corporate network. This testing can cost over
hundreds of thousands of dollars, and also exposes the network to many potential
disruptions. These disruptions are the result of the intense DDoS attacks testers
can impose on live networks in order to isolate vulnerabilities and weaknesses.
Since the network is constantly changing, and DDoS attacks are rarely dispersed
from a centralized location, the penetration test results often become nullified and
end up being limited to a small portion of the total network.

The Skybox Solution:
Skybox Security performs accurate and non-intrusive DDoS attacks across a larger
portion of the corporate network. The tests are modeled and analyzed through an
automated process via our large botnet network rather than manually performed on a
live network. As a result, the tests are repeated rigorously on a scheduled basis
without any fear of network disruption. Through DDoS attack and access simulation,
vulnerability exposures as well as security control weaknesses are revealed instantly.
DDoS attack simulation discovers all possible attack scenarios and reveals the step
by step process that an attacker or worm may follow. It illustrates specific vulnerabilities
to be exploited and network access traversed for each exploitable path. Access simulation
calculates network access privileges determined by firewall and routing configuration.
Our botnet helps characterize the interconnectivity between any two given points, reporting
not just whether access is possible, but also the detailed path to reach a final destination.
Based on these combined results, security personnel are able to determine what additional
DDoS attacks are necessary and where to deploy our organizations penetration testers.

Awards:
Info Security - Info Security Hot Companies 2006
The Wall Street Journal - One of the most innovative companies in 2005
Information Security Magazine - Product of the year
Network Magazine - Most Visionary Security Product
Network Magazine - Best of the Best in all categories
Secure Enterprise Magazine - Editor's Choice
Gartner - " Cool Vendor " in the security & privacy space
SC Magazine Awards 2006 Winner - The Best Security Solution for Financial Services
IM2005 Award finalist - Information Security and Product of the Year

Company Profile:
Eran Reshef
Founder, Chairman & CEO of Blue Security ( www.bluesecurity.com )

A serial entrepreneur, Eran is currently the founder, chairman & CEO of Blue Security,
the do-not-disturb registry pioneer. Prior to Blue, Eran co-founded Skybox Security and
served as its Chairman. Prior to Skybox Eran founded and managed Sanctum (acquired
by WatchFire), the leader in web application security. Eran holds a variety of security-
related patents that are based on his inventions.

Rina Shainski
General Partner at Carmel Ventures ( www.carmelventures.com )

Following a successful career leading business development and R&D operations in
high-growth software companies, Rina has been investing in software companies ever since.
Before joining Carmel she served as the VP Business Development at Clal Industries and
Investments where she was responsible for software investments. From 1989 to 1996, Rina
held several managerial positions in Tecnomatix including VP Business Development and
R&D Director. Rina serves on the boards of Followap Communications, Skybox Security,
mFormation and Silicon Design Systems. Rina holds a B.Sc. degree in Physics from Tel
Aviv University and a Master of Science degree in Computer Science from Weizmann Institute.

Surely this isn't a coincidence? Then again, it's to my personal e-mail, not my work account.