In the Fight Against Spam E-Mail, Goliath Wins Again

Interesting. I would call this an endorsement of success for the tactic.

For those who are not following the various anti-spam attempts, Blue Security was an interesting idea. They subscribed people to a spamwatching service, and when someone reported spam, they sent unsubscribe requests (as CAN-SPAM requires you to allow) to the best known source of spam, from all their subscribers, at the same time.

The crippling burst of traffic, while legal, managed to discourage several spammers. Of course, the counter-attack was not long in coming, along with cyber-threats of victimizing their customers with targeted attacks and virii.

Blue Security seems to have caved, with a quit message going up on their website tomorrow, reports the Washington Post in above link.

I personally expected this outcome, and am somewhat surprised they did not discuss it with their customers, and/or take measures against DDOS attacks.

The scale of the counter-attack was pretty surprising, taking down Tucows as well(which is no slouch of a webservice), but that reinforces my opinion that the method would work, if someone had the ability to go the distance. The next attempt(and there probably will be one) should involve either obfuscating the central server via Tor routing or similar, or a truly decentralized p2p network (which would have the problem of not having experts to validate the targets for mass unsubscribes).

The last possibility is for black hats to setup persistent bot nets that do the unsubcribing by proxy, but that amounts to just opening up gunslinging between the "good" bad guys, and the "bad" bad guys. Collateral damage could be worse than the original spam traffic.

A possible solution would be getting someone really really big involved, like Akamai, or Google, but that probably costs more than any single anti-spam effort could raise.