BlueSecurity Database Compromised?

EElyn writes "Numerous users of Blue Security's anti-spam system now report of a new form of aggressive spam. An unknown group of spammers claim to have derived a way to extract the member email addresses of Blue Security group's anti-spam system, called Blue Frog. Blue Frog, a small tool which once installed on the user's computer, enables Blue Security to systematically flood a known spammer's website with opt-out messages; much to the headache of the spammer. Tens of thousands of users have already signed up, so can it really be true that spammers now possess this database? Or is this yet another frail attempt by spammers to intimidate the user?" Another reader sent the text of the letter; read more to see.

Stray1 writes ""You are recieving this email because you are a member of BlueSecurity...." An email from unknown detractors has taken the Bluesecurity anti spam lists and decided to take matters into their own hands. I recieved this Email from an anonymous, and garbled host, which went on to say in not so fantastic english that I, as a Blusecurity member, would recieve this and many more (about 20 -30) spam messages a day until I left the blue security community. Blue Security, (www.bluesecurity.com)a website and community designed to lessen your Spam Email, is down for the moment. Is this what we have come to? Spam,(erm 'high volume email') companys holding your address hostage until you comply? "...We mightve had your email addresses before in our lists, but now, we are targetting YOU, because YOU are a bluesecurity user". I have to say, up until this point, my spam was down by about 70% to 80%."

I'd call the bluff

[by Anonymous Coward]

If they're able to do so, what will stop them from *not* spamming you in the future anyway? Their ethics, integrity or your stupidity?

Screw the spammers.

[Vengeance (46019)]

What the hell does 20 or 30 messages mean? Nothing at all to me. I reject anywhere from 20 to 40 THOUSAND emails daily, on a domain with precisely two email users: My wife and me. The vast majority of the crap I get is easily rejected because it's sent to bogus (as in, they never ever existed) email addresses. SpamAssassin catches much of the rest.

What must be done

[XxtraLarGe (551297)]

We really need to take the internet back from these guys. Reply to every spam e-mail by going to their web site, and filling out bogus info. Give them bad information overload. Same thing goes for junk mail and telemarketers. When somebody sends you a credit card offer, send it back to them, writing "Take me off your list". Make sure they have to waste so much time throwing out bad mail that it isn't worth their time. When telemarketers call, ask them to hold on a minute. Then set down the phone and don't pick it up again for 10 minutes. That will dig into their costs.

Re:What must be done

[clevershark (130296)]

Seems like a good approach actually. Perhaps some script could be developed that would do nothing but look at a web form, fill in appropriate bogus info, and just hit the site repeatedly with bogus orders. I'll bet any CC provider would soon get tired of having to constantly do verification on bogus CC numbers and would end up closing the spammer's account.

Sure, it's a nasty form of attack, but then that's no less than spammers deserve.

Re:What must be done

[Fordiman (689627)]

"Perhaps some script could be developed that would do nothing but look at a web form, fill in appropriate bogus info, and just hit the site repeatedly with bogus orders"

Actually, there's a very nice client written in C++ that does a damn good job. No CC data or anything, but 'please remove me' forms. If you're confused, read the article again; it's mentioned.

Re:What must be done

[clevershark (130296)]

The only thing that most of these "please remove me" BS forms do is confirm that the email address is a valid one, and can be resold to more spammers. If anything filling those out actually causes more harm than good.

If you're confused, read the article again; it's mentioned.

Thanks Tips, but all four links in the article seem to be unreachable.

Re:What must be done

[macdaddy (38372)]

I used to be a big anti-spammer, back when I had time on my hands. I generated a list of proper-pronouns that was somewhere just over 500k long (I forget the exact #s now). I wrote a number of scripts that used wget and curl (depending on the form) to stuff addresses generated from the pronoun list and about a dozen spam-hole domains I registered into those Remove Me forms. Within hours I was getting tens of thousands of pieces of spam. Within days my Cox cable connection was saturated. I offloaded it onto a co-lo box for another couple of months before I finally changed the MXs to 127.0.0.1 and shut the system down. I had automated scripts for auto-forwarding a copy of the spam to the FTC and to post the messages to NANAS (news.admin.net-abuse.sightings). I also archived the incoming spam and used it to seed my Bayesian filters and DCC system for the ISP I worked for. I can't begin to tell you how effective that was. It was a helluva rig. I wish I still had time to dick around with that kind of stuff.

Re:What must be done

[pla (258480)]

That would be awesome, but unfortunately it doesn't work.


The brick idea, no. But the SD article made a nice suggestion - A rectangular chunk of nice thick sheet metal would fit well inside the return envelope, yet weigh far more than one ounce.


Also, one point on the SD article:

of the 161,000 people who wrote to the DMA last year, 116,000 wanted more junk mail. They were sent a booklet entitled "How To Get More Interesting Mail" (as God is my witness, I am not making this up), which tells you various key catalogs that you can send for to guarantee you'll be deluged with stuff.

I can tell you exactly why people ask for more junk mail...

They own wood stoves.

Unrestricted Warfare

[stevesliva (648202)]

Pretty soon the spammers will be conducting unrestricted submarine attacks on civilian shipping in the North Atlantic.

So, is the database compromised?

[Dynamoo (527749)]

A big question here is.. is the database compromised? From the poking around I've done, it does seem that the only people who have received this message are BlueFrog users.. those who don't use it, don't seem to have it. It could simply be that the spammers have used tracking information embedded in the spammy URLs to find out who is using BlueFrog.

BlueFrog has been criticised for it's so-called "vigilante" approach.. it's not alone in this approach, but perhaps this does go to show a potential downside: spammers are evil - pissed off spammers will simply direct the evil at the people who pissed them off.

Re:So, is the database compromised?

[smokeslikeapoet (598750)]

I am a victim of the blackmail letter as well. It's easy to figure out how the spammers got my email address, they already had it. They simply backed up their address book, cleaned their list with Blue Security's tool, then "diffed" the database to figure out who was BlueSecurity member.

Another note, BlueSecurity is not Slashdotted. It is unavailable because of a DDoS attack started sometime earlier this week. The attack started submitting invalid PHP requests, making the site slow to a crawl and at times be completely unavailable.

I write about it on my blog. [blogspot.com] More on the attack here. [realtechnews.com] The threating letter I received is also on my Slashdot journal.

Re:So, is the database compromised? No.

[MrNougat (927651)]

Comments on BlueSecurity forums last night demonstrate that users with multiple protected addresses are getting these attack spams to some, but not all, of the protected addresses.

What's lkely happening: Spammer has a mailing list. Spammer uses BlueSecurity's "cleanlist" tool to clean registered addresses from his mailing list. Compare original list to cleaned list - email addresses that are in the first but not the second are BlueSecurity registered.

By this logic, email addresses that the spammer does not already have are not made available to the spammer in any way via BlueSecurity's own list. Delivery patterns of the attack spams support this observation.

I'll also note that Gmail's own spam filters are already capturing all of these attack spams; I only got two in my mailbox this morning, about 50 more were filtered.

This is the first time I'm aware of that a spam prevention service has worked so well that it's got a spammer pissed off enough to lash out. BlueSecurity++

Email I Received

[duerra (684053)]

Below is an email that I received, which pretty much confirms that they have been hacked.

----

You are being emailed because you are a user of BlueSecurity's well-known software "BlueFrog." http://www.bluesecurity.com/ [bluesecurity.com]

Today, the BlueSecurity database became known to the worst spammers worldwide. Within 48 hours, the database will be published on the Internet, and your email address will be open to them all. After this, you will see the spam sent to your mailbox increase 10 - 20 fold.

BlueSecurity was illegally attacking email marketers, and doing so with your help. Many websites have been targeted and hit, including non-spam sites. BlueSecurity's software has been fully analyzed, and contains an abundance of malicious code. This includes: ability to send mass mail to users; the ability to attack websites with Distributed Denial of Service attack (DDoS); the ability to open hidden doors on any machine on which it is running; and a hidden auto-update code function, which can install anything on your computer and open it up to anyone.

BlueSecurity lists a USA address as their place of business, whereas their main office is in Tel Aviv. BlueSecurity is run by a few Russian-born Jews, who have previously been spamming themselves. When all is said and done, they will be able to run, hide and change their identities, leaving you to take the fall. YOU CANNOT PARTICIPATE IN ILLEGAL ACTIVITIES and expect to get away with it. This email ensures that you are well aware of the situation. Soon, you will be found guilty of computer crimes such as DDOS attacking of websites, conspiracy, and sending mass unsolicited bulk email messages for everything from viagra to porn, as long as you continue to run BlueFrog.

They do not take money for downloading their software, they do not take money for removing emails from their lists, and they have no visible revenue stream. What they DO have is 500,000 computers sitting there awaiting their next command. What are they doing now?

1. Using your computer to send spam ?
2. Using your computer to attack competitor websites?
3. Phishing through your files for your identity and banking information?

If you think you can merely change your email address and be safe while still running BlueFrog, you are in for a big surprise. This is just the beginning...

Go ahead, grab the snake...

[Spy der Mann (805235)]

If spammers begin writing to us, they'll only increase the form spam they receive.

PLUS! The blue security e-mail database contains a bogus honeypot address per each valid e-mail address.

If this rumour is true, it will be a fatal mistake for the spammers. Because the blue community are ALREADY fighting back. Not only with form complaints on the spammers' websites, but with FORMAL complaints to the FCC, geocities, Microsoft,the MPAA and the FDA about illegal offers.

I joined Blue Security because I already receive 100 spam mails PER DAY. Do you think it'll make a difference whether I receive 100 or 500 e-mails a-day? (99.9% of it is sent to my junk-mail, where it's fed back automatically to Blue Frog)

I feel no mercy for spammers. That's right, you're messing with the wrong guys. The release of this list will only make us MORE POWERFUL.

Do you feel lucky? PUNKS?

P.S. Interesting - the captcha for this post was "predate". I like it. B-)

Nice FUD but...

[Eric Damron (553630)]

Blue frog is open source...

Re:Email I Received

[discHead (3226)]

I'm sure you're right. I have an entire domain registered with Blue Security, but it looks like the spammer has only been hitting some well-worn addresses I have seen other spammers using. I'm sure whoever it is "cleaned" his list, looked at what addresses got filtered out, and singled out those addresses for "special" treatment.

What I received

[Carny Trash (972308)]

Here's what I was sent:

"Hey,
You are recieving this email because you are a member of BlueSecurity (http://www.bluesecurity.com).

You signed up because you were expecting to recieve a lesser amount of spam, unfortunately, due to the tactics used by BlueSecurity, you will end up recieving this message, or other nonsensical spams 20-40 times more than you would normally.

How do you make it stop?

Simple, in 48 hours, and every 48 hours thereafter, we will run our current list of BlueSecurity subscribers through BlueSecurity's database, if you arent there.. you wont get this again.

We have devised a method to retrieve your address from their database, so by signing up and remaining a BlueSecurity user not only are you opening yourself up for this, you are also potentially verifying your email address through them to even more spammers, and will end up getting up even more spam as an end-result.

By signing up for bluesecurity, you are doing the exact opposite of what you want, so delete your account, and you will stop recieving this.

Why are we doing this?

Its simple, we dont want to, but BlueSecurity is forcing us. We would much rather not waste our resources and send you these useless mails, but do not believe for one second that we will stop this tirade of emails if you choose to stay with BlueSecurity.

Just remember one thing when you read this, we didnt do this to you, BlueSecurity did.

If BlueSecurity decides to play fair, we will do the same.

We are quite sure you will think this will not continue, that we will not continue wasting our resources doing this, feel free to wait out the first 48, or the second, and see whether these stop, you will be quite suprised.

If you have another email under the protection of bluesecurity, and have not recieved this there, do not worry, you will soon enough.

We mightve had your email addresses before in our lists, but now, we are targetting YOU, because YOU are a bluesecurity user.

You might also notice, that the BlueSecurity site(http://www.bluesecurity.com) is down..

Just remove yourself from BlueSecurity, and make it easier on you.

Sal Webber"

Blue security must be working

[paladinwannabe2 (889776)]

If BlueSecurity wasn't hurting Spammers they would ignore it. If they are fighting back it must mean that BlueSecurity is actually doing damage to them.

They don't have the database!

[drosoph (664471)]

From what I am seeing, I am now receiving 1,000s of these stupid "Because you are using the BlueSecurity Software ...." emails .... but they are all being directed to Mike, Jan, Cindy, Lucy, Bobby, and [e-mail] .... They are NOT directed to MY email address. These addresses that they are using were ONCE entered by an ignorant relative of my onto one of those online greeting card sites, (even mispelled) and those are the addresses that are being spammed. Since I ALSO registered my DOMAIN with BlueSecurity, I would ponder to guess that the spammers are using the domain list, matching it up to ANY email they have in their spam database with that domain and spamming the heck out of it. They HAVE NOT, I repeat, HAVE NOT hit ANY of my REGISTERED email addresses with BlueSecurity. They are only hitting random crap email addresses on my domain. They're shooting in the dark, they're angry, and they're running scared ... and I hope that you all keep up the good work!

First they ignore you...

[Spy der Mann (805235)]

then they laugh at you...

then they fight you...

then you win :D

One thing is safe to know: At least the spammers are now PAYING ATTENTION to us. A year ago they didn't even know we exist. Then they tried to give bad publicity to Blue Security in anti-spam websites (they said bluefrog was a botnet).

Later, SendSafe [oreilly.com] included an option to use bluefrog's list to NOT send spam to those addresses.

Finally, they're targeting us directly. You know what that means B-)

Also, I doubt the database's been compromised. I'm sure they only diffed the original and the filtered e-mail list. This means that only a small percentage of e-mail targets has been truly released.

DoS and Explanation

[cheshire_cqx (175259)]

According to this article [realtechnews.com] BlueSecurity is the target of a DoS attack.

Also, here's their explanation of the spammer's countermeasure:

This sounds scary, but it's not as bad as it sounds. Blue Security's email address registry remains secure contrary to what this spammer would have you believe. The way subscribers' emails were obtained was by checking the spammer's own list of emails against the Do Not Intrude registry. Normally spammers will get the emails of those who subscribe returned to them and will then remove those emails from their spamming lists. This one, however, has taken another approach. Instead of taking those hits off of his spam lists, he is sending them these intimidating emails.

Makes sense to me, and explains why only BlueSecurity users are getting the emails.

Re:Eye for an Eye?

[Fordiman (689627)]

Blah blah blah.

'Vigilante' would imply something illegal is going on. This is market forces at work - more effective, generally, than government intervention.

Re:Eye for an Eye?

[Fordiman (689627)]

Vigilantism is the act of taking the law into your own hands. It carries an implication of illegal, or more specifically, 'by any means necessary'.

This is 'a community action to produce a market incentive', which is wholly different from 'vigilantism', at least in a literal sense.

Sure, sure, it looks like we're locked in this huge digital superhero battle between the evil spammers and the innocent citizenry, but face it: We're making an attempt to prevent high-volume e-mail to our e-mail addresses from being profitable, and that is all. We are consciously generating market pressure to achieve a goal, and we are doing it in an unorthodox, but morally and legally clean way.

A segment of the population has said, 'High-volume e-mail is annoying enough to be a breach of the peace, as far as I'm concerned. I want none of it, and I will make an effort to prevent my mailbox from recieving them, by filter and by incentive."

Your use of the term 'vigilante tactics' is an obvious attempt to cast a dim light on the activities of the Blue Security community. It brings a baseless accusation to mind - and this being slashdot, I'm inclined to make it - but I think I'll leave the obvious to the outside observer.

Frelling trolls.

Re:Eye for an Eye?

[ScentCone (795499)]

When will the world learn, violence begets violence and spam begets spam. Lets find a real solution to the problem rahter then a vigalante justice.

Actually, I've found that things some people think are unfortunate or bad beget shallow, empty platitudes.

Sometimes, violence simply ends violence, because there is no other way. Sometimes, fighting fire with fire is the best way. Sometimes showing someone what it's like to suffer the consequences of their own actions actually changes their behavior.

I'm all for as many technical approaches as possible, but finding "a real solution to the problem" that doesn't involve some degree of making this painful/costly for the spammers simply isn't going to work. Even if, through filtering, you can get 99% of the stuff blocked, all they have to do is increase the volume that much more to make that remaining 1% still pay off. Remember, they're not paying for their own overhead most of the time.

Your "real solution" comment, in the context of "violence only begets violence" is completely tone deaf. You're applying Israeli-Palestinian-conflict-type babble to a completely different situation. The spammers are not oppressed, or the victims of some historical violent wrong... they're a parasitic, bandwidth sucking plague. Any means by which we can stop them is called for. Surely you don't think that you're going to just turn the other Bayesian Filter Cheek, or write a Korea-bound, thought-provoking appeal to integrity and expect the onslaught to stop? Tempting as it is, no one is suggesting actual violence - just a substantial response in kind, only when provoked. It's called self defense, and it's an appropriate measure because it only happens when an illegal spammer causes it to happen.

How fortunate for you that you've never had anything violent threaten you, requiring you to offer up a physical deterrent to stop it. If you had, you might rethink your metaphors.

Re:So...

[Fordiman (689627)]

http://members.bluesecurity.com is still up; I don't know what they did to www., but it seems to be down.

Meanwhile, stay on, ride it out. Use your spam filter to catch the spams; heuristics will still capture the spams they're sending if they're reported. This guy is desperate - likely going bankrupt - and some of us in the Blue Community would like to see him and his sort become paupers for their asshattery.