427 Botnet fm qxd

www.syngress.com
Responding to Botnets • Chapter 12
441
427_Botnet_12.qxd 1/9/07 3:08 PM Page 441

---

■
Alex Blood / Alexander Mosh / AlekseyB / Alex Polyakov—Some
believe he could be Pharmamaster. Alex Polyakov is a Russian spy in
John LeCarre’s spy novel,
Tinker,Tailor, Soldier, Spy
.
An open source project called Black Frog (www.okopipi.org/) hopes to
continue to work on the concept.
Some Observations about the Blue Frog Affair 
This incident closely resembles the gang warfare of the 1920s, 1950s, and
1960s. Perhaps we should look at how communities reclaimed their neighbor-
hoods for ideas. It also resembles the Wild West when people entered an area
devoid of the infrastructures of civilization.The good news is that in each of
these cases, time eventually brought an end to the conditions that permitted
this immoral behavior to prevail. In each case, a few brave souls stood their
ground and said, “this has got to change.” And it did. Blue Frog was effective
at what it did. Six of the world’s top 10 spammers had agreed to use their fil-
tering.This was an incredible feat. What brought Blue Security down was the
lack of infrastructure to protect our DNS services, the lack of an ability to
respond to this kind of law enforcement challenge, the lack of effective laws
in all countries covering this problem, and the lack of any requirements for
DNS and ISPs to support their customers in these situations.That and the
fact that Blue Security never envisioned that someone would be able to figure
out who its customers were and go after them.
Graham Cluley, a Sophos senior technology consultant, made this observa-
tion in a 
Technology News
article (Blue Security Shutters After Brutal Spam
Attack, by Keith Regan 5/18/06) after the Blue Frog fiasco. “This is truly an
international problem now, and that means old-fashioned law enforcement
efforts aren’t going to get the job done. It’s going to take a combination of
technology, law enforcement, and cultural shifts from users to make a differ-
ence.”This change won’t happen by accident, and it won’t happen without
the right people meeting to plan it and make it happen.
Later in the spammer’s transcript, one of the spammers known as ebulker
says, “Let’s work as a team destroying their business and protect our interests
together!”That’s some advice we should be following.