Blue Frog

This article is about the anti-spam tool. For other uses, see Blue frog (disambiguation).

Blue Frog

Developer(s)	Blue Security
Operating system	Microsoft Windows Extension for Mozilla Firefox
License	Open-source
Website	Blue Security Inc. (archived)

Blue Frog was a freely-licensed anti-spam tool produced by Blue Security Inc. and operated as part of a community-based system which tried to persuade spammers to remove community members' addresses from their mailing lists by automating the complaint process for each user as spam is received. Blue Security maintained these addresses in a hashed form in a Do Not Intrude Registry, and spammers could use free tools to clean their lists. The tool was discontinued in 2006.

Information

Community members reported their spam to Blue Security, which analyzed it to make sure it met their guidelines. Then, they reported sites sending illegal spam to the ISPs which hosted them (if they could be contacted and were willing to work with them), to other anti-spam groups, and to law-enforcement authorities in an attempt to get the spammer to cease and desist. If these measures failed, Blue Security will send back a set of instructions to a Blue Frog client. The client software will use these instructions to visit and leave complaints on the websites advertised by the spam messages. For each spam message a user received, their Blue Frog client would leave one generic complaint, including instructions on how to remove all Blue Security users from future mailings. Blue Security operated on the assumption that as the community grew, the flow of complaints from tens or hundreds of thousands of computers would apply enough pressure on spammers and their clients to convince them to stop spamming members of the Blue Security community.

The Blue Frog software included a Firefox and Internet Explorer plugin allowing Gmail, Hotmail, and Yahoo! Mail e-mail users to report their spam automatically. Users could also report spam from desktop email applications such as Microsoft Office Outlook, Outlook Express and Mozilla Thunderbird.

Users who downloaded the free Blue Frog software registered their e-mail addresses in the "Do Not Intrude" registry. Each user could protect ten addresses and one personal DNS domain name.

Blue Frog was available as a free add-on within the Firetrust Mailwasher anti-spam filter. It was also compatible with SpamCop, a tool with different spam-fighting methods.

Blue Security released all its software products (including Blue Frog) as open-source: the developer community could review, modify, or enhance them.

Spammers' backlash

A variation of the hoax messages.

On May 1, 2006, Blue Frog members started to receive intimidating e-mail messages from sources claiming that the software was actually collecting personal details for identity theft, DDoS attacks, creating a spam database, and other such purposes. Blue Security has contested these claims.

One variant of the e-mailed message stated that spammers had found a way to extract addresses from the database for malicious purposes. Due to how the Blue Security software works, this is not possible; however, spammers can identify BlueFrog member e-mail addresses in lists they already possess. Blue Security provides spammers a free tool that allows them to "clean their lists". Extracting addresses directly from the program would be impossible as they are just hashes, but a spammer can run a list through the BlueSecurity filter and then compare the results with an unaltered list, and thus identify BlueSecurity users and target them. This method can only identify Blue Frog addresses already in the spammer's possession, and cannot give them access to as-yet-untargeted addresses.

Controversy

In May 2006, the Blue Security company was subject to a retaliatory DDoS attack initiated by spammers. As its servers folded under the load, Blue Security redirected its own DNS entries to point to the company weblog, which was announcing its difficulty. The company weblog was hosted at the blogs.com webportal, a subsidiary of Six Apart. This effectively redirected the attack to blogs.com and caused Six Apart's server farm to collapse, which in turn is said to have made some 2,000 other blogs unreachable for several hours.

Individuals claiming to be members of the computer security establishment condemned the Blue Security company for the action it took while under DDoS attack. A representative of Renesys likened this action to pushing a burning couch from their house to a neighbor's.

In its defense, Blue Security Inc. stated that it was not aware of the DDoS attack when it made the DNS change, claiming to have been "blackholed" (or isolated) in its Israeli network as a result of a social engineering hack, which was alleged to have been pulled off by one of the attackers against a high-tier ISP's tech support staff.

This claim has been disputed by many writers such as Todd Underwood, writer of Renesys blog. Most sources, however, agree that regardless of whether Blue Security were "blackholed", they seem not to have been facing attack at the time they redirected their web address. Blue Security also claimed to have remained on amicable terms with Six Apart and pointed to the fact that the blog hosting company did not blame or even name them in the press release which explained the service outage. In any event, the action was widely reported on IT security websites, possibly damaging Blue Security's reputation within that community. At the same time, the incident and its broad reporting in more general-interest media was considered by many to be a boon to the notoriety of Blue Security and the Blue Frog project.

Security expert Brian Krebs gives a different reason for Blue Security's website being unavailable in his article for The Washington Post. He says that what happened was not that Blue Security was lying about being unable to receive HTTP requests (because their servers were down), saying they had been "black hole filtered" and maliciously re-directed traffic, but rather that they were actually unable to receive traffic due to an attack on their DNS servers. This makes it probable that they had essentially been telling the truth and that CEO Eran Reshef was simply misinformed as to why their users were unable to reach their site.

Accusations of being malware

Some users accused Blue Frog of being malware itself on Mozilla's chat forums, claiming that Blue Frog spammed signatures in Yahoo! and Gmail accounts, left active remnants all over the operating system after uninstalling, and hinted that the actual reason for Blue Frog's existence in accumulating a "do-not-spam" database was to harvest fresh addresses for spammers to deluge. Blue Frog shut down one week after the forum thread appeared.

After Blue Security recast itself as Collactive, it would again be accused of spamming.

Attackers identified

Soon after the attack started, Blue Security CEO Eran Reshef claimed to have identified the attacker as PharmaMaster, and quoted him as writing "Blue found the right solution to stop spam, and I can't let this continue" in an ICQ conversation with Blue Security.

Prime suspects for the distributed denial of service (DDoS) attack on Blue Security's servers have been identified in the ROKSO database as Christopher Brown, AKA Swank AKA "Dollar" and his partner Joshua Burch AKA "zMACk". Unidentified Australians and "some Russians" (Russian/Americans), notably Leo Kuvayev and Alex Blood, were also involved. The suspects were identified from a transcript of their postings in the Special ham forum where both the spam attacks and DDoS attack were planned.

Shutdown of service

Blue Security ceased operation on May 16, 2006. The company announced it will look for non-spam related uses of its technology. The company's investors expressed full support for the company's decision to change its business plan.

Many users have suggested continuing the project's goals in a decentralized manner (specifically using peer-to-peer technology, with the client distributed via BitTorrent or similar, thus making both the spam processing and client distribution elements harder for the spammers to attack). One such program was purportedly begun under the name Okopipi though this now appears to have been abandoned.

A number of users have recommended all users to uninstall the Blue Frog program, as it is no longer useful without the Blue Security servers active.

Complainterator

One of the former Blue Security members, Red Dwarf, wrote a program called Complainterator. It runs on Windows and as an add-on to several popular email clients. It processes spam emails and produces email messages to be sent to sites hosting spamvertised products. The goal is to inform hosting sites in hopes that they will remove spam sites, thereby making it difficult for spammers to profit from spam activities.

See also

• Anti-spam techniques (e-mail)
• Collactive, founded by the Blue Security team.
• Malware

Bibliography

• Krebs, Brian (May 17, 2006), "Blue Security Kicked While It's Down", The Washington Post, archived from the original on June 12, 2006 on the spammers victory and its implications.
• Singel, Ryan (May 16, 2006), "Under Attack, Spam Fighter Folds", Wired News.
• Underwood, Todd (May 8, 2006), "The Blue Security Fiasco", Renesys, archived from the original on June 18, 2006.

External links

• Berinato, Scott (November 2006), "Attack of the Bots. The latest threat to the Net: autonomous software programs that combine forces to perpetrate mayhem, fraud, and espionage on a global scale. How one company fought the new Internet mafia – and lost", Wired, vol. 14, no. 11 on botnets and the DDoS attack on Blue Frog, Oct 31, 2006.
• Brand, Madeleine; Reshef, Eran (17 May 2006), "Spammers Win, Anti-Spam Software Firm Shuts Down", Day to Day (transcript) (interview), NPR.
• Montan, Eric, Spammer Desperately Tries to Undermine Blue Security.
• Krebs, Brian (May 17, 2006), "In the Fight Against Spam Email, Goliath Wins Again", The Washington Post.
• Ranum, Marcus J, "Enabling the Complaint Department", Ranum (editorial).
• KnujOn – Another anti-spam service, "a multi-tiered response to Internet threats, specifically email-based threats"
• Suspects in the DDOS attack