The CEO of an antispam firm whose service was knocked offline by a
spammer claimed his company was the victim of a sophisticated attack
carried out, in part, with the help of someone at a top-tier Internet
Service Provider (ISP).
Eran Reshef, CEO of Blue Security, an Israeli antispam firm, said that
his company was attacked by a major spammer named PharmaMaster who
used a combination of methods to knock out the company's Web site and
the servers hosting its services. He also hit back at criticism that
the response by Blue Security to the attacks caused widespread
problems to others.
Blue Security operates an antispam service designed to deter
junk-mailers by spamming them back. Blue Security's Do Not Intrude
program allows individuals to register their email addresses with the
company and essentially flood spammers who send them email with
automated opt-out requests.
The attacks that crippled Blue Service were preceded by PharmaMaster
sending out threatening emails to subscribers of the Do Not Intrude
Registry, warning them of even more spam if they did not withdraw
their subscriptions.
PharmaMaster then appears to have gotten someone at a major ISP to
block Blue Security's IP address on the Internet's backbone routers,
most probably via a process called black-holing, Reshef claimed. With
black-holing, an ISP essentially removes the advertised path to a
particular Web site or IP address -- making it completely inaccessible
to the outside world. According to Reshef, PharmaMaster informed Blue
Security that he had gotten an ISP to agree to blackhole the company
before the attacks started.
"Immediately, we started seeing our IP address getting blacklisted by
other ISPs," Reshef said. As a result, traffic to the company's main
Web site dropping from the usual 100 hits per minute to about two per
minute in less than an hour -- and nothing at all from outside of
Israel. At almost the same time, massive distributed denial of service
(DDoS) attacks were launched against the dedicated servers that
provide Blue Security's antispam service. The servers, located at five
separate hosting provider sites, were bombarded with up to 2GB of
traffic per second, rendering them inaccessible.
In what Reshef said was a bid to tell subscribers what was happening,
Blue Security pointed the company's corporate Web server URL to its
blog, which is hosted by Six Apart in San Francisco. PharmaMaster then
launched a DDoS attack against the server hosting Blue Security's
blog. That resulted in thousands of other blogs hosted by Six Apart to
be knocked offline.
The DDoS attacks against the company's dedicated servers meanwhile
resulted in service disruptions to five hosting providers and major
DNS service provider Tucows, he said.
Pointing the company's main URL to the Blue Security blog site on Six
Apart when it was under attack may not have been the best idea, Reshef
said. But at the time, the company had little idea that the attacker
would launch a separate denial of service attack on the blog site as
well.
Todd Underwood, chief operations and security officer at Renesys, an
Internet monitoring company, said that based on traffic analysis, Blue
Security's main Web site appears to have been under a DDoS attack for
at least two days before it redirected its URL to the blog.
"I do think if you are under attack it is your duty not to redirect it
against someone else," Underwood said. "It is not a fair or an ethical
decision," he said, adding that it is hard to imagine that Blue
Security didn't know it was being hit with a DDoS attack when it
pointed its URL to the blog site.
Underwood also said that it was unlikely that a spammer would have
been able to get an individual at a major ISP to install a "no route"
to Blue Security, as Reshef claimed. "These are not the kind of
networks where people can sneak in and make routing configuration
changes" without logging that change or discussing it with others, he
said. "The suggestion that some Russian spammer could bribe someone to
install a no-route" is hard to believe, he said.
John Levine, chairman of the Internet Anti-Spam Research Group, said
that other antispam efforts have been similarly targeted as well. But
they did not involve an ISP. And neither did those who were attacked
respond like Blue Security did, he said. "If you know you are under a
DoS attack, pointing your DNS at other parties is irresponsible," he
said.
Copyright 2006, IDG Communications New Zealand Limited.
NOTE: For more telecom/internet/networking/computer news from the
daily media, check out our feature 'Telecom Digest Extra' each day at
http://telecom-digest.org/td-extra/more-news.html . Hundreds of new
articles daily. And, discuss this and other topics in our forum at
http://telecom-digest.org/forum (or)
http://telecom-digest.org/chat/index.html
For more headlines and news of interest, please go to:
http://telecom-digest.org/td-extra/newstoday.html
Jaikumar Vijaya (idg@telecom-digest.org)