Blue Frog

Blue Frog

Developer(s)	Blue Security
Operating system	Microsoft Windows Extension for Mozilla Firefox
License	Open Source
Website	Template:Dlw

For a real blue frog see Dendrobates azureus.

The Blue Frog software tool, produced by Blue Security Inc., operated as part of a community-based anti-spam system which tried to persuade spammers to remove community members' addresses from their mailing-lists by automating the complaint process for each user as they receive spam. Blue Security maintained these addresses in encrypted form in a Do Not Intrude Registry, and spammers could use free tools to clean their lists.

Information

Community members reported their spam to Blue Security, which analyzed it (to make sure it met their guildelines) then reported sites sending illegal spam to the ISPs which hosted them (if it could be found, contacted and were willing to work with them), to other anti-spam groups and to law-enforcement authorities in an attempt to get the spammer to cease and desist. If these measures failed Blue Security sent back a set of instructions to a Blue Frog client. The client software used these instructions to visit the websites advertised by the spam messages and leave complaints on those websites. For each spam a user received, their Blue Frog client would leave one generic complaint, including instructions on how to remove all Blue Security users from future mailings. Blue Security operated on the assumption that as the community grew, the flow of complaints from tens or hundreds of thousands of computers would apply enough pressure on spammers and their clients to convince them to stop spamming members of the Blue Security community.

The Blue Frog software included a Firefox and Internet Explorer plugin allowing Gmail, Hotmail, and Yahoo Mail electronic-mail users to report their spam automatically. Users could also report spam from desktop email applications such as Microsoft Office Outlook, Outlook Express and Mozilla Thunderbird.

Users who downloaded the free Blue Frog software registered their email addresses in the "Do Not Intrude" Registry. Each user could protect ten addresses and one personal email domain name.

Blue Frog was available as a free add-on within the Firetrust MailWasher anti-spam filter. It was also compatible with SpamCop, a tool with different spam-fighting methods.

Blue Security released all its software products (including Blue Frog) as open source: the developer community could review, modify or enhance them.

Spammers' backlash

File:Blue Frog discredit a.png

A screenshot of one of the emails.

A variation of the hoax emails.

On May 1, 2006 Blue Frog members started to receive intimidating emails from sources claiming that the software was actually collecting personal details for identity theft, DDoS attacks, creating a spam database, and other such purposes. Blue Security has dismissed these claims [1].

One variant of the email stated that they had found a way to extract addresses from the database for malicious purposes. Due to how the Blue Security software works, this is not possible; however, spammers can identify BlueFrog member email addresses in lists they already possess. Blue Security provides spammers a free tool that allows them to 'clean their lists'. Extracting addresses directly from the program would be impossible as they are just hashes, but a spammer can run a list through the BlueSecurity filter and then compare the results with an unaltered list, and thus identify BlueSecurity users and target them. This method can only identify Blue Frog addresses already in the spammer's possession, and cannot give them access to as-yet untargeted addresses.

Controversy

Individuals claiming to be members of the computer security establishment condemned the Blue Security company for the action it took while under the load of a retaliatory DDoS attack initiated by spammers. As their servers folded under the load, Blue Security redirected (without permission) its own DNS entries to point to the company weblog which was announcing their difficulty. The company weblog was hosted at the blogs.com webportal, a subsidiary of Six Apart. This effectively redirected the attack to blogs.com and caused Six Apart's server farm to collapse, which in turn is said to have made some 2,000 other blogs unreachable for several hours. A representative of Renesys likened this action to pushing a burning couch from their house to a neighbor's.

In their defense, Blue Security Inc. stated they were not aware of the DDoS attack when they made the DNS change, claiming to have been "blackholed" (or isolated) in their Israeli network as a result of a social engineering hack, which was alleged to have been pulled off by one of the attackers against a high-tier ISP's tech support staff.

This claim has been disputed however by many writers such as Todd Underwood, writer of Rensys blog. Most sources, however, agree that regardless of whether Blue Security were "blackholed", they seem not to have been facing attack at the time they redirected their web address. Blue Security also claimed to have remained on amicable terms with Six Apart and pointed to the fact that the blog hosting company did not blame or even name them in the press release which explained the service outage. In any event, the action was widely reported on IT security websites, possibly damaging Blue Security's reputation within that community. At the same time, the incident and its broad reporting in more general interest media was considered by many to be a boon to the notoriety of Blue Security and the Blue Frog project.

Security Expert Brian Krebs gives a different reason for Blue Security's website being unavailable in his article on the Washington Post website. He says that what happened was not that Blue Security was lying about being unable to receive HTTP requests (because their servers were down), saying they had been "black hole filtered" and maliciously re-directed traffic (as Todd Underwood would claim), but rather that they were actually unable to receive traffic due to an attack on their DNS servers. This makes it probable that they had essentially been telling the truth and that CEO Eran Reshef was simply misinformed as to why their users were unable to reach their site.

Attackers identified

Soon after the attack started, Blue Security CEO Eran Reshef claimed to have identified the attacker as PharmaMaster, and quoted him as writing "Blue found the right solution to stop spam, and I can't let this continue" in an ICQ conversation with Blue Security.[2].

Prime suspects for the Distributed Denial of Service (DDOS) attack on Blue Security's servers have been identified in the ROKSO database as Christopher Brown AKA Swank AKA "Dollar", his partner Joshua Burch AKA "zMACk" and "some Russians" (Russian / Americans) notably Leo Kuvayev and Alex Blood. The suspects were identified from a transcript of their postings in the www.specialham.com forum where both the spam attacks and DDOS attack were planned.

Shutdown of Anti-Spam Service

Blue Security ceased its anti-spam operation on May 16, 2006. The company announced it will look for non-spam related uses of its technology. In a rare move for the venture capital industry, the company's investors expressed full support for the company's decision to change its business plan [3].

Many users have suggested continuing the project's goals in a decentralized manner (specifically using peer-to-peer technology, with the client distributed via BitTorrent or similar, thus making both the spam processing and client distribution elements harder for the spammers to attack). One such program already under development is dubbed Okopipi [4].

A number of users have recommended all users to uninstall the Blue Frog program, as it is no longer useful without the Blue Security servers active. [5]

See also

• SpamCop - a popular free spam reporting system
• Spamhaus
• Okopipi
• Spampoison (in: Spamtrap) - a free system to make spammers' mailing lists useless
• List of e-mail spammers

• DoSDragon.com a site carrying on the blue frog concept.
• spamdspammer.com A site the provides software to get back at spammers.

External links

• Wired news article on botnets and the DDoS attack on Blue Frog, Oct 31, 2006
• Wired News Article on shutdown, May, 16, 2006
• "In the Fight Against Spam E-Mail, Goliath Wins Again" Brian Krebs, Washington Post, May 17, 2006
• "Blue Security Kicked While It's Down", May 17, 2006 Brian Krebs on the spammers victory and its implications
• Summary of Blue Frog
• Marcus J. Ranum - Enabling the Complaint Department
• David Johnston: "Spammer Desperately Tries to Undermine Blue Security"
• Suspects in the DDOS attack
• Transcript of the Spammer attack plans
• Spammers Win, Anti-Spam Software Firm Shuts Down. Day to Day, 17 May 2006.
• Renesys' overview
• The Original Blue Frog Fan Club and News Source
• DoSDragon.com a site carrying on the blue frog concept.
• spamdspammer.com A site the provides software to get back at spammers.