BlueSecurity Database Compromised?

EElyn writes "Numerous users of Blue Security's anti-spam system now report of a new form of aggressive spam. An unknown group of spammers claim to have derived a way to extract the member email addresses of Blue Security group's anti-spam system, called Blue Frog. Blue Frog, a small tool which once installed on the user's computer, enables Blue Security to systematically flood a known spammer's website with opt-out messages; much to the headache of the spammer. Tens of thousands of users have already signed up, so can it really be true that spammers now possess this database? Or is this yet another frail attempt by spammers to intimidate the user?" Another reader sent the text of the letter; read more to see.

Stray1 writes ""You are recieving this email because you are a member of BlueSecurity...." An email from unknown detractors has taken the Bluesecurity anti spam lists and decided to take matters into their own hands. I recieved this Email from an anonymous, and garbled host, which went on to say in not so fantastic english that I, as a Blusecurity member, would recieve this and many more (about 20 -30) spam messages a day until I left the blue security community. Blue Security, (www.bluesecurity.com)a website and community designed to lessen your Spam Email, is down for the moment. Is this what we have come to? Spam,(erm 'high volume email') companys holding your address hostage until you comply? "...We mightve had your email addresses before in our lists, but now, we are targetting YOU, because YOU are a bluesecurity user". I have to say, up until this point, my spam was down by about 70% to 80%."

Re:Eye for an Eye?

Blah blah blah.

'Vigilante' would imply something illegal is going on. This is market forces at work - more effective, generally, than government intervention.

Re:Eye for an Eye?

Vigilantism is the act of taking the law into your own hands. It carries an implication of illegal, or more specifically, 'by any means necessary'.

This is 'a community action to produce a market incentive', which is wholly different from 'vigilantism', at least in a literal sense.

Sure, sure, it looks like we're locked in this huge digital superhero battle between the evil spammers and the innocent citizenry, but face it: We're making an attempt to prevent high-volume e-mail to our e-mail addresses from being profitable, and that is all. We are consciously generating market pressure to achieve a goal, and we are doing it in an unorthodox, but morally and legally clean way.

A segment of the population has said, 'High-volume e-mail is annoying enough to be a breach of the peace, as far as I'm concerned. I want none of it, and I will make an effort to prevent my mailbox from recieving them, by filter and by incentive."

Your use of the term 'vigilante tactics' is an obvious attempt to cast a dim light on the activities of the Blue Security community. It brings a baseless accusation to mind - and this being slashdot, I'm inclined to make it - but I think I'll leave the obvious to the outside observer.

Frelling trolls.

Re:Eye for an Eye?

When will the world learn, violence begets violence and spam begets spam. Lets find a real solution to the problem rahter then a vigalante justice.

Actually, I've found that things some people think are unfortunate or bad beget shallow, empty platitudes.

Sometimes, violence simply ends violence, because there is no other way. Sometimes, fighting fire with fire is the best way. Sometimes showing someone what it's like to suffer the consequences of their own actions actually changes their behavior.

I'm all for as many technical approaches as possible, but finding "a real solution to the problem" that doesn't involve some degree of making this painful/costly for the spammers simply isn't going to work. Even if, through filtering, you can get 99% of the stuff blocked, all they have to do is increase the volume that much more to make that remaining 1% still pay off. Remember, they're not paying for their own overhead most of the time.

Your "real solution" comment, in the context of "violence only begets violence" is completely tone deaf. You're applying Israeli-Palestinian-conflict-type babble to a completely different situation. The spammers are not oppressed, or the victims of some historical violent wrong... they're a parasitic, bandwidth sucking plague. Any means by which we can stop them is called for. Surely you don't think that you're going to just turn the other Bayesian Filter Cheek, or write a Korea-bound, thought-provoking appeal to integrity and expect the onslaught to stop? Tempting as it is, no one is suggesting actual violence - just a substantial response in kind, only when provoked. It's called self defense, and it's an appropriate measure because it only happens when an illegal spammer causes it to happen.

How fortunate for you that you've never had anything violent threaten you, requiring you to offer up a physical deterrent to stop it. If you had, you might rethink your metaphors.

I'd call the bluff

If they're able to do so, what will stop them from *not* spamming you in the future anyway? Their ethics, integrity or your stupidity?

Screw the spammers.

What the hell does 20 or 30 messages mean? Nothing at all to me. I reject anywhere from 20 to 40 THOUSAND emails daily, on a domain with precisely two email users: My wife and me. The vast majority of the crap I get is easily rejected because it's sent to bogus (as in, they never ever existed) email addresses. SpamAssassin catches much of the rest.

What must be done

We really need to take the internet back from these guys. Reply to every spam e-mail by going to their web site, and filling out bogus info. Give them bad information overload. Same thing goes for junk mail and telemarketers. When somebody sends you a credit card offer, send it back to them, writing "Take me off your list". Make sure they have to waste so much time throwing out bad mail that it isn't worth their time. When telemarketers call, ask them to hold on a minute. Then set down the phone and don't pick it up again for 10 minutes. That will dig into their costs.

Re:What must be done

Seems like a good approach actually. Perhaps some script could be developed that would do nothing but look at a web form, fill in appropriate bogus info, and just hit the site repeatedly with bogus orders. I'll bet any CC provider would soon get tired of having to constantly do verification on bogus CC numbers and would end up closing the spammer's account.

Sure, it's a nasty form of attack, but then that's no less than spammers deserve.

Re:What must be done

"Perhaps some script could be developed that would do nothing but look at a web form, fill in appropriate bogus info, and just hit the site repeatedly with bogus orders"

Actually, there's a very nice client written in C++ that does a damn good job. No CC data or anything, but 'please remove me' forms. If you're confused, read the article again; it's mentioned.

Re:What must be done

The only thing that most of these "please remove me" BS forms do is confirm that the email address is a valid one, and can be resold to more spammers. If anything filling those out actually causes more harm than good.

If you're confused, read the article again; it's mentioned.

Thanks Tips, but all four links in the article seem to be unreachable.

Re:What must be done

I used to be a big anti-spammer, back when I had time on my hands. I generated a list of proper-pronouns that was somewhere just over 500k long (I forget the exact #s now). I wrote a number of scripts that used wget and curl (depending on the form) to stuff addresses generated from the pronoun list and about a dozen spam-hole domains I registered into those Remove Me forms. Within hours I was getting tens of thousands of pieces of spam. Within days my Cox cable connection was saturated. I offloaded it onto a co-lo box for another couple of months before I finally changed the MXs to 127.0.0.1 and shut the system down. I had automated scripts for auto-forwarding a copy of the spam to the FTC and to post the messages to NANAS (news.admin.net-abuse.sightings). I also archived the incoming spam and used it to seed my Bayesian filters and DCC system for the ISP I worked for. I can't begin to tell you how effective that was. It was a helluva rig. I wish I still had time to dick around with that kind of stuff.

Re:What must be done

That would be awesome, but unfortunately it doesn't work.


The brick idea, no. But the SD article made a nice suggestion - A rectangular chunk of nice thick sheet metal would fit well inside the return envelope, yet weigh far more than one ounce.


Also, one point on the SD article:

of the 161,000 people who wrote to the DMA last year, 116,000 wanted more junk mail. They were sent a booklet entitled "How To Get More Interesting Mail" (as God is my witness, I am not making this up), which tells you various key catalogs that you can send for to guarantee you'll be deluged with stuff.

I can tell you exactly why people ask for more junk mail...

They own wood stoves.

Re:What must be done

When somebody sends you a credit card offer, send it back to them, writing "Take me off your list".

you can get off the prescreened credit mailing lists altogether, just use one of the methods suggested on the FTC website [ftc.gov]

Unrestricted Warfare

Pretty soon the spammers will be conducting unrestricted submarine attacks on civilian shipping in the North Atlantic.

So, is the database compromised?

A big question here is.. is the database compromised? From the poking around I've done, it does seem that the only people who have received this message are BlueFrog users.. those who don't use it, don't seem to have it. It could simply be that the spammers have used tracking information embedded in the spammy URLs to find out who is using BlueFrog.

BlueFrog has been criticised for it's so-called "vigilante" approach.. it's not alone in this approach, but perhaps this does go to show a potential downside: spammers are evil - pissed off spammers will simply direct the evil at the people who pissed them off.

Re:So, is the database compromised?

I am a victim of the blackmail letter as well. It's easy to figure out how the spammers got my email address, they already had it. They simply backed up their address book, cleaned their list with Blue Security's tool, then "diffed" the database to figure out who was BlueSecurity member.

Another note, BlueSecurity is not Slashdotted. It is unavailable because of a DDoS attack started sometime earlier this week. The attack started submitting invalid PHP requests, making the site slow to a crawl and at times be completely unavailable.

I write about it on my blog. [blogspot.com] More on the attack here. [realtechnews.com] The threating letter I received is also on my Slashdot journal.

Re:So, is the database compromised? No.

Comments on BlueSecurity forums last night demonstrate that users with multiple protected addresses are getting these attack spams to some, but not all, of the protected addresses.

What's lkely happening: Spammer has a mailing list. Spammer uses BlueSecurity's "cleanlist" tool to clean registered addresses from his mailing list. Compare original list to cleaned list - email addresses that are in the first but not the second are BlueSecurity registered.

By this logic, email addresses that the spammer does not already have are not made available to the spammer in any way via BlueSecurity's own list. Delivery patterns of the attack spams support this observation.

I'll also note that Gmail's own spam filters are already capturing all of these attack spams; I only got two in my mailbox this morning, about 50 more were filtered.

This is the first time I'm aware of that a spam prevention service has worked so well that it's got a spammer pissed off enough to lash out. BlueSecurity++

Monty Python

So, if I got this right, the spammers that are getting spammed are now spamming the spammers? Sounds like a flying circus to me!

Re:So...

http://members.bluesecurity.com is still up; I don't know what they did to www., but it seems to be down.

Meanwhile, stay on, ride it out. Use your spam filter to catch the spams; heuristics will still capture the spams they're sending if they're reported. This guy is desperate - likely going bankrupt - and some of us in the Blue Community would like to see him and his sort become paupers for their asshattery.

How about posting the web site addresses involved?

I'm sure that we're all interested in what these people have to sell... also that would probably cause a massive slashdotting.

Email I Received

Below is an email that I received, which pretty much confirms that they have been hacked.

----

You are being emailed because you are a user of BlueSecurity's well-known software "BlueFrog." http://www.bluesecurity.com/ [bluesecurity.com]

Today, the BlueSecurity database became known to the worst spammers worldwide. Within 48 hours, the database will be published on the Internet, and your email address will be open to them all. After this, you will see the spam sent to your mailbox increase 10 - 20 fold.

BlueSecurity was illegally attacking email marketers, and doing so with your help. Many websites have been targeted and hit, including non-spam sites. BlueSecurity's software has been fully analyzed, and contains an abundance of malicious code. This includes: ability to send mass mail to users; the ability to attack websites with Distributed Denial of Service attack (DDoS); the ability to open hidden doors on any machine on which it is running; and a hidden auto-update code function, which can install anything on your computer and open it up to anyone.

BlueSecurity lists a USA address as their place of business, whereas their main office is in Tel Aviv. BlueSecurity is run by a few Russian-born Jews, who have previously been spamming themselves. When all is said and done, they will be able to run, hide and change their identities, leaving you to take the fall. YOU CANNOT PARTICIPATE IN ILLEGAL ACTIVITIES and expect to get away with it. This email ensures that you are well aware of the situation. Soon, you will be found guilty of computer crimes such as DDOS attacking of websites, conspiracy, and sending mass unsolicited bulk email messages for everything from viagra to porn, as long as you continue to run BlueFrog.

They do not take money for downloading their software, they do not take money for removing emails from their lists, and they have no visible revenue stream. What they DO have is 500,000 computers sitting there awaiting their next command. What are they doing now?

1. Using your computer to send spam ?
2. Using your computer to attack competitor websites?
3. Phishing through your files for your identity and banking information?

If you think you can merely change your email address and be safe while still running BlueFrog, you are in for a big surprise. This is just the beginning...

Re:Email I Received

I'm sure you're right. I have an entire domain registered with Blue Security, but it looks like the spammer has only been hitting some well-worn addresses I have seen other spammers using. I'm sure whoever it is "cleaned" his list, looked at what addresses got filtered out, and singled out those addresses for "special" treatment.

Go ahead, grab the snake...

If spammers begin writing to us, they'll only increase the form spam they receive.

PLUS! The blue security e-mail database contains a bogus honeypot address per each valid e-mail address.

If this rumour is true, it will be a fatal mistake for the spammers. Because the blue community are ALREADY fighting back. Not only with form complaints on the spammers' websites, but with FORMAL complaints to the FCC, geocities, Microsoft,the MPAA and the FDA about illegal offers.

I joined Blue Security because I already receive 100 spam mails PER DAY. Do you think it'll make a difference whether I receive 100 or 500 e-mails a-day? (99.9% of it is sent to my junk-mail, where it's fed back automatically to Blue Frog)

I feel no mercy for spammers. That's right, you're messing with the wrong guys. The release of this list will only make us MORE POWERFUL.

Do you feel lucky? PUNKS?

P.S. Interesting - the captcha for this post was "predate". I like it. B-)

Nice FUD but...

Blue frog is open source...

The REST of the story ...

The Gmail spam filter is filtering nearly every one of these spams, only a couple out of 60+ yesturday got into my inbox. .... and every one of that bastard's spams advertising a website went right to bluesecurity to hurt his business. He's just shooting himself in the foot.

Contrary to what the author wrote, there's closer to 475,000 members, not just a few 10's of thousands, enough that several major spammers have already agreed to not spam members due to the huge financial hits they were taking with the bluefrog choking off their websites.

What a joke, what dumbass would really believe that the spammers will not spam you if you leave blue security? Who here will admit to believing the criminals? ... I think that about covers the points that were lost when slashdot decided to post this boring version of the story, instead of what I submitted yesturday afternoon :)

What I received

Here's what I was sent:

"Hey,
You are recieving this email because you are a member of BlueSecurity (http://www.bluesecurity.com).

You signed up because you were expecting to recieve a lesser amount of spam, unfortunately, due to the tactics used by BlueSecurity, you will end up recieving this message, or other nonsensical spams 20-40 times more than you would normally.

How do you make it stop?

Simple, in 48 hours, and every 48 hours thereafter, we will run our current list of BlueSecurity subscribers through BlueSecurity's database, if you arent there.. you wont get this again.

We have devised a method to retrieve your address from their database, so by signing up and remaining a BlueSecurity user not only are you opening yourself up for this, you are also potentially verifying your email address through them to even more spammers, and will end up getting up even more spam as an end-result.

By signing up for bluesecurity, you are doing the exact opposite of what you want, so delete your account, and you will stop recieving this.

Why are we doing this?

Its simple, we dont want to, but BlueSecurity is forcing us. We would much rather not waste our resources and send you these useless mails, but do not believe for one second that we will stop this tirade of emails if you choose to stay with BlueSecurity.

Just remember one thing when you read this, we didnt do this to you, BlueSecurity did.

If BlueSecurity decides to play fair, we will do the same.

We are quite sure you will think this will not continue, that we will not continue wasting our resources doing this, feel free to wait out the first 48, or the second, and see whether these stop, you will be quite suprised.

If you have another email under the protection of bluesecurity, and have not recieved this there, do not worry, you will soon enough.

We mightve had your email addresses before in our lists, but now, we are targetting YOU, because YOU are a bluesecurity user.

You might also notice, that the BlueSecurity site(http://www.bluesecurity.com) is down..

Just remove yourself from BlueSecurity, and make it easier on you.

Sal Webber"

Blue security must be working

If BlueSecurity wasn't hurting Spammers they would ignore it. If they are fighting back it must mean that BlueSecurity is actually doing damage to them.

Blue Security coming back online

From http://www.bluesecurity.com/Announcements/spam.asp [bluesecurity.com]

As many spammers choose to comply with the Registry (see our recent blog posts here [bluesecurity.com], here [bluesecurity.com] and here [bluesecurity.com]), other spammers may resort to other means in an attempt to avoid compliance.

A major spammer had started spamming our members with discouraging messages in an attempt to demoralize our community. This spammer is using mailing lists he already owns that may contain addresses of some community members.

We have also received complaints from users about spam allegedly sent from Blue Security promoting our anti-spam solution and our web site. This is yet another tactic used by some spammers in an attempt to slander us by sending unsolicited email forged to appear as if it was sent from Blue Security. Blue Security is an anti-spam company determined to fight spam and as such never has and never will send unsolicited email.

Our answer to those criminals should be one - we will not be discouraged; We will continue to exercise our right to opt-out of spam.

If you are not a member of our community, now is the time to actively fight spam and make spammers leave you alone. For more information click here.

If you are already a member of our community, make spammers hear you load and clear - report your spam, let Blue Frog fight spammers on your behalf.

We regret any inconvenience caused by this incident.

Best Regards,

Blue Security.

They don't have the database!

From what I am seeing, I am now receiving 1,000s of these stupid "Because you are using the BlueSecurity Software ...." emails .... but they are all being directed to Mike, Jan, Cindy, Lucy, Bobby, and [e-mail] .... They are NOT directed to MY email address. These addresses that they are using were ONCE entered by an ignorant relative of my onto one of those online greeting card sites, (even mispelled) and those are the addresses that are being spammed. Since I ALSO registered my DOMAIN with BlueSecurity, I would ponder to guess that the spammers are using the domain list, matching it up to ANY email they have in their spam database with that domain and spamming the heck out of it. They HAVE NOT, I repeat, HAVE NOT hit ANY of my REGISTERED email addresses with BlueSecurity. They are only hitting random crap email addresses on my domain. They're shooting in the dark, they're angry, and they're running scared ... and I hope that you all keep up the good work!

First they ignore you...

then they laugh at you...

then they fight you...

then you win :D

One thing is safe to know: At least the spammers are now PAYING ATTENTION to us. A year ago they didn't even know we exist. Then they tried to give bad publicity to Blue Security in anti-spam websites (they said bluefrog was a botnet).

Later, SendSafe [oreilly.com] included an option to use bluefrog's list to NOT send spam to those addresses.

Finally, they're targeting us directly. You know what that means B-)

Also, I doubt the database's been compromised. I'm sure they only diffed the original and the filtered e-mail list. This means that only a small percentage of e-mail targets has been truly released.

Anyone even bother to research this?

The site hasn't been hacked.

Hasn't anyone gone to bluesecurity.com to actually see what THEY have to say about this "security breach"?

I have two other email address that WERE NOT signed up with BlueFrog also getting this spam.

BlueSecurity's official statement is this: ...which I would be pasting here if I could get to the goddamned site. Thanks a lot, slashdot. I'll be back to post the full text once I can get in the bloody site.

In short, the spammers are PISSED and they'll do anything to get people to unsubscribe from BlueFrog, including sending spams with lies. Don't fall for it. Keep fighting spam.

DoS and Explanation

According to this article [realtechnews.com] BlueSecurity is the target of a DoS attack.

Also, here's their explanation of the spammer's countermeasure:

This sounds scary, but it's not as bad as it sounds. Blue Security's email address registry remains secure contrary to what this spammer would have you believe. The way subscribers' emails were obtained was by checking the spammer's own list of emails against the Do Not Intrude registry. Normally spammers will get the emails of those who subscribe returned to them and will then remove those emails from their spamming lists. This one, however, has taken another approach. Instead of taking those hits off of his spam lists, he is sending them these intimidating emails.

Makes sense to me, and explains why only BlueSecurity users are getting the emails.

New attack email text

I just got the following NDR email (which GMail flagged as spam, but I read anyway). Looks like the pissy spammer is using email addresses from his list in the From field, and generating false spam for BlueSecurity.

I have deleted contact information at the end, for the sanity of those involved.

Begin

Subject: FW:Automaticly send 1000s of DDOS complaints for each spam you recieve

The trackback URL for this blog entry is:
http://community.bluesecurity.com/ [bluesecurity.com]

Bringing spammers to Their Knees:
Bluesecurity.com hopes you'll join thousands of others in an army capable
of crippling spammers' Web sites.

A few thousand spammers have ruined our internet. They've clogged our
mailboxes with filth. Already, 90% of email traffic is made up of
spam. Let us no longer blind ourselves to the irrefutable facts:
current measures have failed to stop spammers. The experience of the
past several years has proven that passive measures are just not the
answer.

Retribution is the only real answer to spam. We must punish spammers
ourselves to prevent them from taking over cyberspace. We must reclaim
our territory. We need direct action to eliminate spammers for good.

The magnitude of the task which lies before us is great. We are fighting
for the future of the Internet. What we need to do now is get as many
users as possible into our community. We already have a botnet with
hundreds of thousands of computers working together to induce commercial
loss on spammers and their ISPs. We have launched numerous
Denial-of-Service Attacks on Chinese spam networks with great success,
and plan many more!

We have excellent financiers who allow us continued success with our botnet
growth and Denial-of-Service Attacks. We thank the government agencies
involved
for their continued cooperation. We thank our leader, Eran Reshef,
for continued strategies of DoS attack operations. Also, US-based Rembrandt

Ventures & Skybox Security for their extensive funding & continued support.
And a
very special thanks to Douglas Schrier who has helped our botnet come to
life.

If you haven't signed up with the registry and installed a blue frog yet,
please sign up now.
If your friends have not yet joined us, we will convince them to do so.

Let's stop filtering spam and start eliminating spammers.
Together, we will reclaim the Internet, One ddos at a time.

Please Contact Us for any questions on signup via the following info:

address and phone deleted

Israel HQ: address and phone deleted

Current and potential investor relations:
Rembrandt Venture Partners address and phone deleted

Fight back spam! Join our Botnet today.
Download our .EXE here: http:/// [http] www.bluesecurity.com/ blue-frog/