Blue Frog 3777020 225263893 2008-07-12T19:41:53Z SmackBot 433328 Date the maintenance tags or general fixes {{Infobox_Software | name = Blue Frog | logo = [[Image:Blue-frog-spam.png|48px]] | screenshot = | caption = | developer = Blue Security | latest_release_version = | latest_release_date = | operating_system = [[Microsoft Windows]]<br />[[Extension (Mozilla)|Extension]] for [[Mozilla Firefox]] | genre = | license = [[Open Source]] | website = [http://bluesecurity.com/ Blue Security Inc.]{{Dead link|date=January 2008 |url=http://bluesecurity.com/}}| }} :''For a real blue frog see [[Dendrobates azureus]]''. The '''Blue Frog''' tool, produced by Blue Security Inc., operated as part of a community-based [[anti-spam techniques (e-mail)|anti-spam]] system which tried to persuade [[spammers]] to remove community members' addresses from their [[electronic mailing list|mailing list]]s by automating the complaint process for each user as spam is received. Blue Security maintained these addresses in encrypted form in a ''Do Not Intrude Registry'', and spammers could use free tools to clean their lists. ==Information== Community members reported their spam to Blue Security, which analyzed it to make sure it met their guidelines, then reported sites sending illegal spam to the [[Internet service provider|ISP]]s which hosted them (if it could be found, contacted and were willing to work with them), to other anti-spam groups and to law-enforcement authorities in an attempt to get the spammer to cease and desist. If these measures failed, Blue Security sent back a set of instructions to a Blue Frog [[client (computing)|client]]. The client software used these instructions to visit and leave complaints on the websites advertised by the spam messages. For each spam message a user received, their Blue Frog client would leave one generic complaint, including instructions on how to remove all Blue Security users from future mailings. Blue Security operated on the assumption that as the community grew, the flow of complaints from tens or hundreds of thousands of computers would apply enough pressure on spammers and their clients to convince them to stop spamming members of the Blue Security community. The Blue Frog software included a [[Firefox]] and [[Internet Explorer]] plugin allowing [[Gmail]], [[Hotmail]], and [[Yahoo Mail]] e-mail users to report their spam automatically. Users could also report spam from [[desktop environment|desktop]] e-mail applications such as [[Microsoft Office Outlook]], [[Outlook Express]] and [[Mozilla Thunderbird]]. Users who downloaded the free Blue Frog software registered their e-mail addresses in the "Do Not Intrude" registry. Each user could protect ten addresses and one personal [[Domain Name System|DNS]] [[domain name]]. Blue Frog was available as a free add-on within the [[Firetrust]] [[Mailwasher]] anti-spam filter. It was also compatible with [[SpamCop]], a tool with different spam-fighting methods. Blue Security released all its software products (including Blue Frog) as [[open source]]: the developer community could review, modify or enhance them. ==Spammers' backlash== [[Image:Blue Frog discredit a.png|thumb|A screenshot of one of the hoax messages.]] [[Image:Blue Frog discredit b.png|thumb|A variation of the hoax messages.]] On [[May 1]], [[2006]] Blue Frog members started to receive intimidating e-mail messages from sources claiming that the software was actually collecting personal details for identity theft, [[DDoS]] attacks, creating a spam database, and other such purposes. Blue Security has dismissed these claims [http://community.bluesecurity.com/webx?14@183.ufdSa9Hek4V.0@.3c528f05!comment=1]. [[:Image:Blue Frog discredit b.png|One variant of the e-mailed message]] stated that they had found a way to extract addresses from the database for malicious purposes. Due to how the Blue Security software works, this is not possible; however, spammers can identify BlueFrog member e-mail addresses in lists they already possess. Blue Security provides spammers a free tool that allows them to 'clean their lists'. Extracting addresses directly from the program would be impossible as they are just [[Cryptographic hash function|hash]]es, but a spammer can run a list through the BlueSecurity filter and then compare the results with an unaltered list, and thus identify BlueSecurity users and target them. This method can only identify Blue Frog addresses already in the spammer's possession, and cannot give them access to as-yet untargeted addresses. ===Controversy=== {{POV-section|date=December 2007}} In May 2006, the Blue Security company underwent a retaliatory [[DDoS]] attack initiated by spammers. As their servers folded under the load, Blue Security redirected its own DNS entries to point to the company weblog which was announcing their difficulty. The company weblog was hosted at the blogs.com webportal, a subsidiary of [[Six Apart]]. This effectively redirected the attack to blogs.com and caused Six Apart's server farm to collapse, which in turn is said to have made some 2,000 other blogs unreachable for several hours. Individuals claiming to be members of the computer security establishment condemned the Blue Security company for the action it took while under DDoS attack. A representative of [[Renesys]] likened this action to [http://www.renesys.com/blog/2006/05/the_bluesecurity_fiasco_dont_m.shtml pushing a burning couch from their house to a neighbor's]. In their defense, Blue Security Inc. stated they were not aware of the DDoS attack when they made the DNS change, claiming to have been "[[black hole (networking)|blackholed]]" (or isolated) in their Israeli network as a result of a [[social engineering]] hack, which was alleged to have been pulled off by one of the attackers against a high-tier ISP's tech support staff. This claim has been disputed by many writers such as Todd Underwood, writer of [http://www.renesys.com/blog/2006/05/the_bluesecurity_fiasco_dont_m.shtml Renesys blog]. Most sources, however, agree that regardless of whether Blue Security were "blackholed", they seem not to have been facing attack at the time they redirected their web address.{{Fact|date=February 2007}} Blue Security also claimed{{Fact|date=February 2007}} to have remained on amicable terms with Six Apart and pointed to the fact that the blog hosting company did not blame or even name them in [http://www.sixapart.com/typepad/news/2006/05/typepad_update_1.html the press release which explained the service outage]. In any event, the action was widely reported on IT security websites, possibly damaging Blue Security's reputation within that community. At the same time, the incident and its broad reporting in more general-interest media was considered by many to be a boon to the notoriety of Blue Security and the Blue Frog project. Security Expert [[Brian Krebs]] gives a different reason for Blue Security's website being unavailable in his [http://blog.washingtonpost.com/securityfix/2006/05/blue_security_surrenders_but_s.html article] on the [[Washington Post]] website. He says that what happened was not that Blue Security was lying about being unable to receive [[HTTP]] requests (because their servers were down), saying they had been "black hole filtered" and maliciously re-directed traffic, but rather that they were actually unable to receive traffic due to an attack on their DNS servers. This makes it probable that they had essentially been telling the truth and that CEO Eran Reshef was simply misinformed as to why their users were unable to reach their site. ===Attackers identified=== Soon after the attack started, Blue Security CEO Eran Reshef claimed to have identified the attacker as [[PharmaMaster]], and quoted him as writing "Blue found the right solution to stop spam, and I can't let this continue" in an [[ICQ]] conversation with Blue Security. Prime suspects for the Distributed Denial of Service (DDOS) attack on Blue Security's servers have been identified in the [[The Spamhaus Project#Register of Known Spam Operations|ROKSO]] database as [http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK5514 Christopher Brown AKA Swank AKA "Dollar"], his partner [http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK6643 Joshua Burch AKA "zMACk"] and "some Russians" (Russian / Americans) notably [http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK4932 Leo Kuvayev] and [http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK6138 Alex Blood]. The suspects were identified from a [http://slashdot.org/comments.pl?sid=184656&cid=15249882 transcript] of their postings in the www.specialham.com forum where both the spam attacks and DDOS attack were planned. ===Shutdown of Anti-Spam Service=== Blue Security ceased its anti-spam operation on [[May 16]], [[2006]]. The company announced it will look for non-spam related uses of its technology. In a rare move for the [[venture capital]] industry, the company's investors expressed full support for the company's decision to change its business plan [http://www.wired.com/news/technology/1,70913-1.html]. Many users have suggested continuing the project's goals in a decentralized manner (specifically using [[peer-to-peer]] technology, with the client distributed via [[BitTorrent (protocol)|BitTorrent]] or similar, thus making both the spam processing and client distribution elements harder for the spammers to attack). One such program already under development is dubbed [[Okopipi (software tool)|Okopipi]] [http://castlecops.com/postitle156112-0-0-.html] though progress seems slow. A number of users have recommended all users to [[uninstall]] the Blue Frog program, as it is no longer useful without the Blue Security servers active. [http://castlecops.com/modules.php?name=Forums&file=viewtopic&p=768501] == See also == *[[Okopipi (software tool)|Okopipi]] *[[Anti-spam techniques (e-mail)]] *[[Collactive]], founded by the Blue Security team. == External links == * [http://www.wired.com/wired/archive/14.11/botnet.html Wired news article on [[botnet]]s and the [[Denial-of-service attack|DDoS]] attack on Blue Frog, Oct 31, 2006] * [http://www.wired.com/news/technology/0,70913-0.html?tw=rss.index Wired News Article on shutdown, May, 16, 2006] *[http://www.washingtonpost.com/wp-dyn/content/article/2006/05/16/AR2006051601873.html "In the Fight Against Spam E-Mail, Goliath Wins Again"] [[Brian Krebs]], ''[[Washington Post]]'', May 17, 2006 *[http://blog.washingtonpost.com/securityfix/2006/05/blue_security_surrenders_but_s.html "Blue Security Kicked While It's Down", May 17, 2006] [[Brian Krebs]] on the spammers victory and its implications *[http://castlecops.com/t154098-Summary_of_the_BlueFrog.html Summary of Blue Frog] *[http://www.ranum.com/security/computer_security/editorials/bluesecurity Marcus J. Ranum - Enabling the Complaint Department] *[http://www.realtechnews.com/posts/3011 David Johnston: "Spammer Desperately Tries to Undermine Blue Security"] *[http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK5514 Suspects in the DDOS attack] *[http://castlecops.com/postx154070-0-15.html#757510 Transcript of the Spammer attack plans] *[http://www.npr.org/templates/story/story.php?storyId=5411437 Spammers Win, Anti-Spam Software Firm Shuts Down]. ''Day to Day'', 17 May 2006. *[http://www.renesys.com/blog/2006/05/the_bluesecurity_fiasco_dont_m.shtml Renesys' overview] *[http://knujon.com KnujOn] - Another anti-spam service, "a multi-tiered response to Internet threats, specifically email-based threats" *[http://www.okopipi.org Okopipi] is a site that is hoping to be the new Blue Frog. {{spamming}} [[Category:Anti-spam]] [[de:Blue Frog]]