Member Avatar for happygeek

Remember this week, for it was the week that we lost the fight against spam.

On May 5th I reported how militant spammer PharmaMaster had brought down the Blue Frog anti-spam vigilante service. I wondered then if it was the end of the toad for Blue Security, and sadly this has proven to be the case as CEO Eran Reshef has now closed the service in fear of escalating an online war claiming “I cannot go ahead and rip up the Internet to make Blue Security work.

Despite, or perhaps because of, the success of the Blue Frog ‘Do Not Include Registry’ proactive approach to targeting spam, ultimately the company could not fight an apparently highly organized spamming group in control of a colossal army of remote PC bots. The distributed denial of service attack might have had Blue Security as its target, but the collateral damage was hugely damaging across a swathe of Internet sites and services numbering well into the hundreds of thousands. Victims included blogging service TypePad after Blue Security blogged a warning to users on the Movable Type system when its homepage became unreachable. PharmaMaster responded within the hour with a targeted attack bringing down millions of blogs in the process. Web and mail servers hosted by domain registrar Tucows suffered a similar fate. This last 14 day period has shown just how far spammers will go when they sense their livelihood is threatened. Worryingly, it also displayed the power of the weaponry available to them and the organizational structure in place to deploy that power.

Reshef maintains that it is up to large ISPs and governments around the globe to take on spammers, and not be left to small Israeli start up. But to throw in the towel as Blue Security has done is nothing short of criminal. It is comparable to saying “pay the ransom in a hostage situation and expecting kidnapping to go away as a result. To conclude that this is a significant victory for the spammer is to understate the situation. Let’s be honest here, a show of brute force has revealed the strength of the spammer and the weakness of those who would seek to stop him. Until and unless law enforcement agencies are given teeth to bite back, and legislature displays the will to fight back, a spam free mailbox will remain just a fantasy.

For now, welcome to the Wild West 2.0 where the guy with blackest hat and the biggest gun rules the roost.

  • 3 Contributors
  • 3 Replies
  • 277 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by pty

Dani AI

Generated

That episode exposes some clear lessons about where anti‑abuse efforts fall short and what practical steps follow. is right to call for broader responsibility from ISPs, registrars and policy makers, but the technical community can also reduce single points of failure and limit collateral damage if design and operations change.

Decentralization can help, as suggested, but it brings its own hazards. Pure P2P eases a single-target DDoS but is vulnerable to poisoning, sybil attacks and bootstrap/trust problems. Safer patterns combine distribution with strong verification: cryptographically sign blocklists/updates, use short‑lived tokens and revocation mechanisms, require quorum/reputation for changes, and seed peers from multiple independent authorities. Hybrid architectures (multiple authoritative roots + peer caches) give availability without sacrificing integrity.

Operators should assume attacks will happen and prepare accordingly. Practical mitigations include Anycast/CDN fronting, pre-arranged scrubbing with upstreams, connection-rate limits and SYN cookies, per‑IP and per‑session throttles, application-layer filtering and caching, and an incident playbook that includes BGP filtering/Flowspec and contacts at transit providers and national CERTs. Logging and metrics for fast detection and post‑mortem forensics are essential.

End users and small networks matter too: prevent machines becoming part of botnets by keeping systems patched, disabling unnecessary services and UPnP on home routers, running current anti‑malware, and responding promptly to ISP notifications. Registrars/hosts should log and notify infected customers and provide cleanup paths instead of simply suspending services.

Bottom line: build layered defenses that assume adversaries will escalate — diversity of distribution, cryptographic verification, operational agreements, and policy/enforcement working together are what stop a single escalation from becoming an Internet‑wide hostage situation.

Recommended Answers

All 3 Replies

Member Avatar for 'Stein

Can't agree with ya more.

By the way, I wanna mention that I've been reading your articles lately, and I'm liking the writing. Good Job. :)

Thanks.

Member Avatar for happygeek

Thanks 'Stein, I write 'em as I see 'em :)

Member Avatar for pty

The fight is not lost yet. The weakness in Blue Frog's grand scheme was the fact that it relied on central servers.

A p2p approach would give the spammers no main target. is just that. Maybe it will continue where Blue Frog left off

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.