Why Did Microsoft buy Frontbridge? So It Could Get More Spam!

Last year, Microsoft acquired the hosted (or managed) email security service provider, Frontbridge. For some time, I've been saying that there's an interesting competitive advantage enjoyed by Frontbridge and other services providers, such as Postini, MX Logic, MessageLabs, and BlackSpider.

Companies that offer a service to a large number of customers get to see a lot of spam and other unwanted email. This is very useful to spot new types of spam campaigns and spot them quickly. As spammers shift to a botnet model, spam campaigns are hitting harder, sending more messages over a shorter period of time. The quicker a spam control solution can notice a new campaign and block it, the less spam is actually received by users.

Microsoft says that "92% of all email received at microsoft.com is spam," so the FrontBridge team is now receiving an enormous corpus of new spam, which should help them to be more reactive to new spam campaigns..

Interestingly, Microsoft claims that it's also extracting reputation data from spam sent to hotmail.com and msn.com, but I'm told by my buddies at Symantec that this is still protected by BrightMail technology.

[edited for clarity June 15 4pm BST]

See you next week at INBOX

I'll be at INBOX next week in San Jose. I'm moderating the Email Security Shootout panel. Should be fun. You don't need a full conference pass to get in -- the $25 Buyer Pass is enough.

Where's Richi been?

P1030157
Originally uploaded by Richi Jennings.

More pics at Flickr

Wired has half the Blue Security story

I see Wired is now talking about the Blue Security situation. It focusses on the spammer retaliation angle.

Naturally, there are some spammers who take a dim view of organizations that try to limit the number of mailboxes they can pollute. It now appears that spammers are passing around a list of names that purports to be this secret registry. Not only that, but levels of spam received by members of the Blue Security list have roughly doubled since May 1.

So how can this be?

I've seen the spammers' list. It's not as it seems -- it doesn't include spamtraps and other special addresses or wildcard domain entries that I know to be in there. What's happened is that a spammer has taken his list and "cleaned" it against the Blue Security list. He then compared the original list with the cleaned list to figure out which addresses were removed. He then bragged to his spammer buddies that he's "cracked" the Blue Security list.

Blue Security "do not email list" compromised? No!

It had to happen. I'm amazed it's taken so long.

Spammers are passing around a list of names that is purportedly the Blue Frog "do not email" list. Someone is already spamming the list with dire warnings of falling skies.

I've seen the list. It's not complete in the sense that it doesn't include the wildcard domain entries. It also doesn't include spamtraps that I know to be there. Presumably a spammer has taken his list and "cleaned" it against the blue list, then done a diff? Like I say, I'm amazed it's taken so long.

In other words, people won't get spam from these spammers unless they're already getting spam from them.

Blue Security's community forums are down "for maintenance." ;-)

Links (updated as I find them): 1 2 3 4 5 6 7 8 9...