Blue Security: Spam victim, or just a really bad idea?

Much has been made in the technology press this week about the demise of the Israeli antispam firm Blue Security, which was put out of business by an unknown Russian spammer who called himself (herself?) “Pharmamaster.”

If you remember, Blue was a company that used a network of software agents, dubbed “Blue Frog,” to collect examples of spam and, when necessary, spam the servers of companies selling products advertised in the spam messages with “Opt Out” requests, which companies are mandated by the U.S. CAN SPAM law to comply with. With one Opt out request for each spam message received, the campaigns amounted to denial of service attacks on spam sponsor sites.

According to reports, Blue had become a hassle for After weeks of sustained denial of service attacks from pissed-off spammers, CEO Eran Reshef threw in the towel earlier this week. In a published statements and interviews with InfoWorld, Reshef put the battle in near-cosmic terms, saying that the spammers would “rip apart the Internet” using a bot network that was “a weapon of mass destruction.”

Other experts begged to disagree and said that Reshef was just the target of a somewhat larger than average DOS attack — which he probably should have expected when he decided to start messing with their business.

In fact, maybe the one thing that antispam crusaders and spammers agree on is that Blue wasn’t a very good idea — and wasn’t destined to be very effective at stopping spam.

“Most of the people I know from the security community don’t think (automated Opt-Out campaigns) are a justified resposne. They’re too prone to misdirection and collateral damage,” said Todd Underwood, at Renesys in Manchester, NH in an interview with InfoWorld earlier this month.

And that’s what happened earlier in May, when Blue tried to shift operations to a Blog hosted by Six Apart. Once the spammers realized the trick, they launched attacks on Six Aparts servers, denying the good users of LiveJournal, Typepad and other blogging services access to their sites.

“People want to hit back,” said John Thielens, CTO at antispam firm Tumbleweed in Redwood City, California. “But you don’t hit back with the same tools they use to attack you. Because they’re a lot better at using them than you will ever be.”

That is apparently the conclusion that folks at Blue reached, too.

“After recovering from the attack, we determined that once we reactivated the Blue Community, spammers would resume their attacks. We cannot take the responsibility for an ever-escalating cyber war through our continued operations.”

While that “ever-escalating cyber War” would ever spread much beyond the boundaries of Blue Security’s domain is unclear.

But spam experts said the demise of Blue Security probably won’t make much difference.

“It’s not a victory for spammers. It’s just business as usual,” said Thielens.