427 Botnet fm qxd

www.syngress.com
440
Chapter 12 • Responding to Botnets
427_Botnet_12.qxd 1/9/07 3:08 PM Page 440

---

I think maybe he was saying “Let me the hell out of here!” When
he let the coverlet fall into a smoking heap at the baseboard, there was
a big smoking bald spot in the middle of the wall, but the paper was
out.” Colter,” he said. What would she think, he wondered, of that man
as he looked now, forty pounds lighter and ten years older, his legs a
pair of crooked useless horrors?.
On May 2, the spammers began a DDoS attack on the main Blue
Security Web site. During the course of the attack, the spammers would take
out Blue Security’s Web site. When Blue Security re-directed the traffic for its
main Web page to its blog server to make the Blue Frog service available to
its customers again, the blog server was not able to handle the load either.
Only when it went down it took all of Six Part, the blog serving company,
including high-profile customers Live Journal and Typepad. At that point,
their domain name service provider,Tucows, fired them, revealing yet another
hole on the good guy’s side. Blue Security then worked with Prolexic
Technologies, a company known as a specialist in DDoS protection. Prolexic
was bombarded by defamatory spam e-mails about Prolexic, multi-gigabit
DDoS attacks, and mail bombs.They were taken down for eight hours when
the attack shifted to their DNS provider. When the spammers began targeting
the paying customers of Blue Security with intense spam, the people who
turned to Blue Security—that is, had paid Blue Security for protection—sud-
denly found themselves a target because of that action. On May 16, Blue
Security closed its doors.
The Register of Known Spam Operations (ROKSO, www.spamhaus.org/
rokso/index.lasso), operated by The Spamhaus Project
(www.spamhaus.org/index.lasso), believes the planners of the attacks are:
■
Leo Kuvayev (AKA BadCow), speculated to be Pharmamaster, the
spammer who DDoS’ed Blue Frog. Kuvayev made the news in May
2005, being prosecuted by the state of Massachusetts to the tune of
$37M and the forced closure of dozens of Web sites.The state sus-
pects that he fled to Russia where there were no laws against spam-
ming. A law was passed in 2006, but is believed to be ineffective.
■
Christopher J. Brown / Swank AKA Dollar 
■
Joshua Burch (AKA “zMACk,” “pitboss,” and maybe “Digihax,”
“Nathan Allen” & “Gene Heu”)