Spam War Takes Out Blog Services 315
munchola writes "Following on from the story about spammers attacking Blue Security's anti-spam system, CBR is reporting that Six Apart, which runs the popular LiveJournal and TypePad blogging services, has become a collateral victim. Six Apart told its millions of bloggers it had experienced 'intermittent and limited availability for TypePad, LiveJournal, TypeKey, sixapart.com, movabletype.org and movabletype.com', before resolving the issue in the early hours of Wednesday. '[The spammers are] trying to rip apart the internet just to make our community stop fighting back against spam,' Blue Security's chief executive Eran Reshef said, adding that he knows who's behind the attack."
Fighting abuse with abuse is bad (Score:3, Insightful)
Swamping a spammer is not a good idea, because he can either redirect the attacks to an innocent third party, or simply pointless because they use stolen ressources, like trojaned computers that host illegal sites.
The best way to eradicate spammers would simply be to go after their clients.
Blame fest (Score:5, Insightful)
The spammer also launched a conventional bandwidth-consumption DDoS attack against bluesecurity.com. It was around this time that the company opened its new blog, which meant TypePad got whacked.
This blue security article has been running for a few days now and the site hasn't been responding any time I've tried recently.
Isn't it just another DDOS blame fest when in reality its just the news spreading around the world and all the collective users of all the collective news sites are clicking the links to try to read the story?
A total slashdotting/digging/farking and general newsing all at once.
It was the same when word spread about google going down.
"OMG have you heard, google is dead?"
*CLICK* "Yer, its not working here either" *CLICK* *CLICK* *CLICK*
*CLICK* "Hey, its loaded here." *CLICK* "Oh crap, its broken again now.."
We are all guilty of assisting this DDOS attack. shame on us.
It will ease up once something else comes and takes our attention away from it.
Kill the spammers (Score:5, Insightful)
Re:Fighting abuse with abuse is bad (Score:5, Insightful)
Everyone keep's knocking blue... (Score:5, Insightful)
So, do you have any better suggestions, if not then I kindly ask you to ommit your views until you can add something to the cause.
Opting out is *NOT* abuse! (Score:5, Insightful)
4 of the 10 major spammers had already excluded the blue security list from their mass mailings, and their problem was solved. But this particular spammer, instead of complying, shut down Blue Security.
Just because Blue Frog causes A SIDE EFFECT of disminishing the bandwidth of the spammer's website, is not Blue Security's fault. (It is our LEGAL RIGHT to request for opt-out, and to keep requesting it UNTIL IT IS FULFILLED).
To say opting out is abuse, is nothing but legitimizing illegal (non CAN-SPAM complying) spam.
Re:Kill the spammers (Score:3, Insightful)
I know you were just kidding, but some people aren't
Re:Kill the spammers (Score:3, Insightful)
I think going after companies and websites advertised in SPAM woudld do more damage. Get a 1 mil dollar fine and they wont be making the same mistake twice.
Taking away the source of funds/content for spammers will at least minimize spam.
Breaking point (Score:3, Insightful)
Take them out (Score:2, Insightful)
Blue Security are idiots (Score:2, Insightful)
First, these idiots set up an "anti-spam" service whose response to abuse is...abuse.
Second, they use a fraudulent corporate name. (Use Google and search Usenet.)
Third, they locate themselves on a network also happens to house one of the scummiest spammers on the planet.
Fourth, they decide to redirect an incoming attack at an innocent third party.
The only surprising thing is how many morons have actually DEFENDED these idiots.
Recommendations:
1. Permanently blacklist their domain(s).
2. Firewall off their network.
Re:Blame fest (Score:2, Insightful)
That would be because SixApart got the registrar/dns host to point bluesecurity.com to localhost (127.0.0.1) so unless you're running a webserver on your own box, you won't get anything.
The main news behind this story isn't that a spammer is attacking SixApart, but that bluesecurity, which claims to be a consumer-friendly anti-spam service, in its time of crisis chose not to just take the hit, but instead shared their misfortune with a huge community of unrelated people. Their solution was to repoint the DNS entry for bluesecurity.com to their blog. They did not ask, the didn't even inform SixApart that it would be happening. They completely took out the network of an uninvolved company for 4 hours, and until SixApart got the bluesecurity DNS record changed, service for their customers was minimal at best.
I don't care what the motives were behind bluesecurity's stunt. Anyone dumb enough to pull a trick like this deserves whatever they have coming to them from SixApart's lawyers.
Re:Fighting abuse with abuse is bad (Score:2, Insightful)
Don't know why but there seems to be a lot of posts going around pointing at BS as if they're
All this could easily be done manually, but it would take quite a lot of time for the user. Automating it like Blue Security did makes it so that more people will end up actually sending the opt-out request (rather than simply letting out a sigh and pressing the delete button) and hence the owners of given websites will hopefully start to understand that they rather should revert to different strategies than spam for making money. Apparantly these websites are usually hosted on low-cost infrastructure that is not happy receiving hundreds, thousands, if not ten-thousands opt-out requests the day after one of there spam-puppets send out a couple of million emails.
My 2 cents
PS: I've been using the BS client for quite some time now and I'm very pleased with it actually. Like on of the posters said : "If the spammers are starting to feel it enough to react, than BS must be doing something right.." Couldn't agree more.
To Stop Spam (Score:2, Insightful)
People could stop clicking, but that is unlikely to happen. Especially in America, people are always looking for the easier path: be it cheaper medication, promises of enhanced "performance," tales of rapid weight loss while sitting on your couch, or the constant get-rich-quick scheme.
If people actually thought... yes, used higher brain functions... they may realize that it is virtually all just BS.
It could also be that the general masses don't realize that everytime they click on a link or reply to an email, someone is making money. And that is a problem with awareness of how the internet works. Most seem happy to just know that it works.
Why not... (Score:2, Insightful)
redirct the domain name to 127.0.0.1(taking up to 24-48 hours to update) as one of the other posters posted...
Why I ask is because where I work we had a similar problem and sence I maintain our web server we had no choice but to unpluge the network cable. Waited 5 minutes and pluged it back in and vwala! no more DOS.
My best guess was that as soon as the DOS'er saw that our site was "down" they/it thought that there task was completed.
It is almost( but not quite the same) as if some one took a ethernet cable and created a loop on the same pair of switchs. (i.e. two switches are connected to each other. Then some random idiot looks at them and plugs in a spare cable in to both, creating a network loop.)
BlueSecurity on holiday? Unacceptable (Score:4, Insightful)
This is a 24/7 business. A serious online service vendor can't have company holidays. Least of all in the security business.
Re:Shifting attack (Score:4, Insightful)
Re:Fighting abuse with abuse is bad (Score:4, Insightful)
War and drama asside: I keep waiting for someone to make this point but I'm not seeing it yet.
Spam is a solicitation to contact the advertised party in the hopes that you will give them money. Otherwise known as an advertisement. THEY CONTACT US. It's called the free market. In turn we all have the right to use the communication path they supply to request that they leave us alone.
Is it illegal to contact some company you see on a billboard or in a TV commercial? What absurdity! What is this world coming to where everyone gets sucked into DDoS drama at every chance? Blue Froggers are just doing business within the realm of the law. No stretching the rules. No sensationalism.
The only reason spammer servers crash is because they aren't prepared and are poorly designed. They have two options:
1. Seriously upgrade their infrastructure to handle whatever degree of responses their advertisements generate & hire more staff to process the hits their ad generates.
=or=
2. Seriously decrease their advertisements to be in line with their capacity to manage their generated trafic.
It's just economics and common sense. This DDoS talk is a waste of time - the Blue Frog client is much nicer to the spammers than they are to us. And this huge amount of anger directed at Blue Frog is proof that it bites into their freedom to be irresponsible.
They can keep their pill pushing sites - I don't care if there are suckers out there dumb enough to give them money. I just want them to stop bothering ME. They will never get one red hot cent from me. They WILL get endless trouble from me as long as they continue to disrespect my privacy.
All the best folks!
B.
Re:Kill the spammers (Score:3, Insightful)
I'm certainly not. I want to see them in PMITA prison and destitute, but not dead.
However. According to a report from 2004 [spamfo.co.uk], spammers sent about 12.4 billion messages per day. If it takes one second per email to delete, then that consumes 393 person-years to remove from our collective inboxes. Assuming an average lifespan of 75, that means spammers use the entire lives of over five people each and every day.
Put in the context that they're effectively killing 1900 unwilling people per year, that proposal doesn't seem quite as unthinkable.
Again, I don't encourage violence against spammers. Still, I can see the point of people who do, even though I don't reach the same conclusion.
Re:Everyone keep's knocking blue... (Score:3, Insightful)
OK. Here's one. Summary execution for spammers and their families. It would solve the problem more effectively than anything else we've got.
You don't have any better suggestions? Then don't you dare criticize this one!
Sorry for the Modest Proposal (I do not advocate killing people over spam!), but the point I'm trying to make is: it's entirely legitimate to criticize an idea without suggesting an alternative. Unless you're making a split-second decision, it's worth looking at the downside before you implement a plan. Sometimes you'll decide it's worth it, at least for now, and other times you'll decide you're better off going back to the drawing board.
Re:Guilty of what? (Score:1, Insightful)
Is it illegal? Nope, not in any sense of the word."
Well, I *could* call it "aiding and abedding". Someone does not need to be a robber to be tried as one (think of the guy driving the getaway car).
And I can surely see a case where the provider of the packets causing a DDos would be convicted, and another conviction for someone who directed the flow of those packets to a known party
Maybe you could look at it like this : You might get hit by a large quantity of water, which threatens to damage your property. You are surely permitted to try to get rid of that water. But to transfer the water to a known other person, resulting in his property getting damaged like you where afraid it would do yours is premeditation.
The second, damaged person is then surely within his rights to claim damages. And if the judge is willing, he won't permit the redirector of that water to re-claim those damages from the person who send it in the first place.