No sé si alguno de mis lectores utiliza Blue Frog, yo por lo menos lo descubrí hace apenas unos días cuando le di una nueva oportunidad al Mailwasher en vista que el Pop Peeper 3.0 seguiría sin incorporar filtros para el correo.

A modo de introducción, Blue Frog es un servicio de una compañía llamada Blue Security con el cual uno reenvía los correos de spam a nuestra cuenta en su web y ellos se encargan de validar dichos mensajes (para saber si realmente se trata de spam) para posteriormente tomar acciones contra la web que se presta a promocionar sus servicios mediante spam. Según he leído, por increible que parezca el servicio funciona, y viene en varias presentaciones: como aplicación independiente, o integrado en programas como Thunderbird, Firefox, Internet Explorer y el mencionado Mailwasher.

No obstante, hoy tras reportar mi dosis de spam diaria me dirigí a su web para revisar mis estadísticas y me topé con un error 404. Me he puesto a buscar información en internet y en varios sitios comentan que el sitio ha sido víctima de un ataque de denegación de servicio (DoS) por parte de un grupo de spammers molestos por el servicio de BlueSecurity. Pero lo peor no es eso, parece ser que la lista de direcciones de correo de los miembros de Blue Security ha caído en manos de estos spammers y ya muchos usuarios han reportado que han recibido correos de extorsión exigiendo que se den de baja de esa web si no desean ser bombardeados con spam en un futuro cercano. ¿Les suena exagerado en la forma que lo estoy contando? Miren cómo es el correo en cuestión:

Para los lectores que me siguen desde un lector RSS la nota continúa en el cuerpo extendido del artículo

Hey,

You are recieving this email because you are a member of BlueSecurity (http://www.bluesecurity.com).

You signed up because you were expecting to recieve a lesser amount of spam, unfortunately, due to the tactics used by BlueSecurity, you will end up recieving this message, or other nonsensical spams 20-40 times more than you would normally.

How do you make it stop?

Simple, in 48 hours, and every 48 hours thereafter, we will run our current list of BlueSecurity subscribers through BlueSecurity's database, if you arent there.. you wont get this again.

We have devised a method to retrieve your address from their database, so by signing up and remaining a BlueSecurity user not only are you opening yourself up for this, you are also potentially verifying your email address through them to even more spammers, and will end up getting up even more spam as an end-result.

By signing up for bluesecurity, you are doing the exact opposite of what you want, so delete your account, and you will stop recieving this.

Why are we doing this?

Its simple, we dont want to, but BlueSecurity is forcing us. We would much rather not waste our resources and send you these useless mails, but do not believe for one second that we will stop this tirade of emails if you choose to stay with BlueSecurity.

Just remember one thing when you read this, we didnt do this to you, BlueSecurity did.

If BlueSecurity decides to play fair, we will do the same.

Just remove yourself from BlueSecurity, and make it easier on you.

Gena Elmore

Supongo yo ante esa reacción de los spammers que el trabajo de Blue Frog es realmente efectivo, así que si ellos deciden seguir en el negocio una vez recuperados del ataque (supuestamente durará 3 días) les recomiendo que lo prueben si tienen alguna cuenta de correo azotada por el spam.

Enlaces relacionados:
Spammer Desperately Tries to Undermine Blue Security
BlueSecurity Database Compromised?

Actualización: en los comentarios de la noticia en Slashdot he visto una segunda versión del correo de amenaza. Totalmente falsa a mi entender ya que el código de Blue Frog es open-source y de ser cierto ya habría sido denunciado por gente decente:

You are being emailed because you are a user of BlueSecurity's well-known software "BlueFrog." http://www.bluesecurity.com/

Today, the BlueSecurity database became known to the worst spammers worldwide. Within 48 hours, the database will be published on the Internet, and your email address will be open to them all. After this, you will see the spam sent to your mailbox increase 10 - 20 fold.

BlueSecurity was illegally attacking email marketers, and doing so with your help. Many websites have been targeted and hit, including non-spam sites. BlueSecurity's software has been fully analyzed, and contains an abundance of malicious code. This includes: ability to send mass mail to users; the ability to attack websites with Distributed Denial of Service attack (DDoS); the ability to open hidden doors on any machine on which it is running; and a hidden auto-update code function, which can install anything on your computer and open it up to anyone.

BlueSecurity lists a USA address as their place of business, whereas their main office is in Tel Aviv. BlueSecurity is run by a few Russian-born Jews, who have previously been spamming themselves. When all is said and done, they will be able to run, hide and change their identities, leaving you to take the fall. YOU CANNOT PARTICIPATE IN ILLEGAL ACTIVITIES and expect to get away with it. This email ensures that you are well aware of the situation. Soon, you will be found guilty of computer crimes such as DDOS attacking of websites, conspiracy, and sending mass unsolicited bulk email messages for everything from viagra to porn, as long as you continue to run BlueFrog.

They do not take money for downloading their software, they do not take money for removing emails from their lists, and they have no visible revenue stream.

What they DO have is 500,000 computers sitting there awaiting their next command. What are they doing now?

1. Using your computer to send spam ?
2. Using your computer to attack competitor websites?
3. Phishing through your files for your identity and banking information?

If you think you can merely change your email address and be safe while still running BlueFrog, you are in for a big surprise. This is just the beginning...

Actualización 2: Parece ser que al equipo de BlueSecurity no se le ocurrió mejor cosa que apuntar los DNS de su servidor hacia su blog de Typepad, y con eso también se llevaron por delante a SixApart.com, MovableType.org, LiveJournal y Typepad, que en varias ocasiones del día de ayer se encontraban inaccesibles. Información en QDN.