Last visit was: Sat Jul 05, 2014 5:26 am
It is currently Sat Jul 05, 2014 5:26 am

Georgia Cyberattacks Linked to Russian Organized Crime


All times are UTC - 5 hours [ DST ]


 [ 4 posts ] 
Author Message
 PostPosted: Mon Aug 17, 2009 8:16 am   
Spam Reporter
User avatar

Joined: Tue Nov 25, 2008 11:37 pm
Posts: 176
As if we didn't already know

--------------------------------------

Georgia Cyberattacks Linked to Russian Organized Crime
By Jeremy Kirk, IDG News Service - Mon Aug 17, 2009 2:50AM EDT
http://tech.yahoo.com/news/pcworld/20090817/tc_pcworld/georgiacyberattackslinkedtorussianorganizedcrime




The cyberattacks against Georgia a year ago were conducted in close connection with Russian criminal gangs, and the attackers likely were tipped off about Russia's intent to invade the country, according to a new technical analysis, much of which remains secret.

The stunning conclusions come from the U.S. Cyber Consequences Unit, an independent nonprofit research institute that assesses the impact of cyber attacks. A 100-page technical analysis is only being made available to the U.S. government and some cybersecurity professionals, but the organization did release a nine-page summary early Monday.

The report in part confirms some of the suspicions of observers, who theorized that the distributed denial-of-service attacks (DDOS), which crippled many Georgian Web sites, had its roots in Russia.

The report was chiefly produced through investigations by the CTO of the U.S. Cyber Consequences Unit, John Bumgarner. It involved analyzing a raft of data collected as the attacks were going on and afterwards. The data included server logs from a variety of stakeholders, some of whom would not share information with each other, said Scott Borg, director and chief economist of the institute.

Russia launched a five-day military campaign in August 2008 that corresponded with Georgia's attempts to assert greater control over the South Ossetia and Abkhazia regions, which have strong ties to Russia. Bombers struck targets throughout the country, and at the same time Georgian media and government sites fell under DDOS attack.

That timing doesn't appear to be a coincidence. The attacks were executed with an efficiency that indicated pre-planning, and the cyberattacks also preceded the first news stories of Russia's military intervention, according to the report.

"Many of the cyber attacks were so close in time to the corresponding military operations that there had to be close cooperation between people in the Russian military and the civilian cyber attackers," the report said. "Many of the actions the attackers carried out, such as registering new domain names and putting up new Web sites, were accomplished so quickly that all of the steps had to be prepared earlier."

Borg said that the institute is confident that the Russian government didn't directly carry out the attacks. But it is clear that Russia appeared to be leveraging civilian nationalists who were ready to take cyber action, perhaps with some low-level encouragement.

"It appears that the military invasion was taking into account the help they were about to receive ... by the cyberattack," Borg said.

It is not clear, however, at what level the interaction between Russian government officials and those who executed the attacks occurred. But it does appear that the loose coordination will likely become part of Russia's standard operating procedure from now on, Borg said.

A total of 54 Web sites were attacked, most of which would have benefited the Russian military campaign by not functioning, Borg said. By shutting down media and government sites, it was harder for Georgia to communicate to the public what was going on. Financial transactions were disrupted, and the National Bank of Georgia had to cut off its Internet connection for 10 days, according to the report.

Social networking sites helped recruit volunteers who traded tips on online forums in Russian, with one English-language forum hosted in San Francisco, the report said. Computers servers that had been used in the past to host malicious software by Russian criminal gangs were also used in the attacks.

"It appears that Russian criminal organizations made no effort to conceal their involvement in the cyber campaign against Georgia because they wanted to claim credit for it," the report said.

DDOS attacks work by bombarding a Web site with too many page requests, which causes it to become unavailable due to bandwidth problems unless security measures are taken. The attack is executed by a botnet, or a network of PCs that become infected with malicious code controlled by a hacker.

The code used to command those machines to attack the Web sites appeared to be customized specifically for the Georgia campaign, the report said. Three of the software programs used were designed to test Web sites to see how much traffic they can handle.

A fourth program was originally designed to add functions to Web sites but was altered by the hackers to request nonexistent Web pages. That tool, which is HTTP-based, proved more efficient than the ICMP-based (Internet Control Message Protocol) attacks used against Estonia in 2007, the report said.

Further evidence showed that Georgia could have been hit much harder. Some of Georgia's critical infrastructure was accessible over the Internet. While the civilian cyber attackers had signs of considerable expertise, "if the Russian military had chosen to get directly involved, such attacks would have been well within their capabilities," the report said.

"The fact that physically destructive cyberattacks were not carried out against Georgian critical infrastructure industries suggests that someone on the Russian side was exercising considerable constraint," it said.


Top
 Profile  
 PostPosted: Mon Aug 17, 2009 10:43 am   
Spammers' Nightmare
User avatar

Joined: Thu Apr 05, 2007 4:10 pm
Posts: 2777
Not surprised, but good that the evidence was indeed analyzed formally and the proper conclusion was reached.


Top
 Profile  
 PostPosted: Tue Mar 26, 2013 5:55 am   
I'm an ass. I deserve to die.
User avatar

Joined: Tue Mar 26, 2013 5:42 am
Posts: 1
Perhaps you could tell us why all of these seemingly patriotic Russian citizens feel obligated to launch DOS attacks against the government of a neighboring country? I'd also like to read your thoughts as to whether this is a spontaneous display of public outrage against an outlaw government, or is coordinated by either a private organization or maybe even an agency of the Russian government. I'm sure that any of the above would have excellent reasons for doing this, so don't be shy.

I'd also like to know what Serbia's alleged war on terrorism has to do with the subject at hand.


Top
 Profile  
 PostPosted: Tue Mar 26, 2013 9:27 pm   
You are kiillllling-a my bizinisss!
User avatar

Joined: Thu Mar 01, 2007 3:01 am
Posts: 5915
I don't remember the details anymore. It's pretty old news.


Top
 Profile  
 [ 4 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Wayback machine, Yahoo [Bot] and 0 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  


Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
Style originally created by Volize © 2003 • Redesigned SkyLine by MartectX © 2008