Spammer Targets Blue Frog Anti-Spam List -- Redmondmag.com

Spammer Targets Blue Frog Anti-Spam List

By The Associated Press
05/04/2006

One spammer has managed to identify e-mail addresses on a "do-not-spam" list touted as secure, taking advantage of an obvious flaw with such lists and prompting critics to wonder what took so long.

Those who submitted their addresses to Blue Security Inc.'s Blue Frog registry have been getting messages that threaten, among other things, "nonsensical spams 20 to 40 times more than you would normally" get, according to a copy provided by the company.

Blue Security described the spammer's tactics as "bullying" and "extortion" as well as a sign the company's controversial anti-spam tactics are working, annoying spammers enough to prompt such a response.

Critics, however, say such lists are fundamentally flawed.

"Do-not-spam" registries work by encouraging users to submit their e-mail addresses -- Blue Security says it has 450,000. Before sending out a batch of messages, spammers are supposed to remove any addresses appearing on such lists.

The lists are generally encrypted so spammers can't mine them for new addresses. Instead, spammers run their lists through an identical encryption algorithm, and the resulting fingerprints are compared. Spammers can then remove any matches.

But John Levine, co-author of "Fighting Spam for Dummies," said spammers merely have to run their lists, see what's been removed and compare that with the original to find out the addresses on the "do-not-spam" lists.

"It's only a surprise that it took this long," Levine said.

Eran Reshef, Blue Security's chief executive, said spammers must already have the e-mail address to learn it is on the "do-not-spam" list.

Blue Security has been criticized for what Levine calls its vigilante approach. Users install software that sends complaints to spammers automatically. Thousands complaining at once can knock out a Web site and, the company says, encourage spammers to stop.

According the company, the spammer responded not only by threatening users if they don't stop but also by making Blue Security's Web site inaccessible outside Israel, where the company has major operations.

Featured

Microsoft Graph 'Activity Logs' Feature Goes Live

Microsoft announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and identify patterns of potential misuse.
Fallout from Microsoft's 'Midnight Blizzard' Saga Hits Feds

When the Russian attack group Midnight Blizzard successfully breached Microsoft corporate e-mail accounts late last year, it apparently managed to steal U.S. government agency e-mails, too.
PowerShell Script Used in Phishing Attack May Be AI-Generated

A PowerShell script being used in a novel malware campaign may have been created by AI, according to security researchers at Proofpoint.
Using Microsoft Office to Build a Network Diagram, Part 1

Keeping documentation is a great way to ease your future hardware refresh and have what you need for insurance purposes.
Microsoft Claims Breakthrough in Quantum Computing Reliability

A new paper details Microsoft's recent progress in quantum computing -- specifically, its development of a system that is both significantly less prone to errors and better at correcting them.