Subscribe free to our newsletters via your
. Military Space News .

Subscribe free to our newsletters via your

Analysis: Russia-Georgia cyberwar doubted

The website.
by Shaun Waterman
Washington (UPI) Aug 18, 2008
The hacker networks that attacked Georgian Web sites earlier this month previously had targeted porn and gambling sites, likely as part of an extortion racket, and only launched their assault after fighting with Russia broke out, casting doubt on Tbilisi's claims it was orchestrated as part of Moscow's military offensive.

The first attack started just after 2 p.m. GMT on Aug. 8, according to the Shadowserver Foundation, a volunteer group that monitors hacker activity -- more than 12 hours after Russian tanks rolled through the Roki tunnel into Georgia, and once news reports about the conflict had been circulating for some time.

Within hours of fighting breaking out, Russian hackers had established a site,, where visitors could view a list of Georgian Web sites being targeted, showing which sites had been successfully brought down, and download a simple program that enabled their own computer to join the attack, according to Kimberly Zenz, a Russia specialist with Internet threat intelligence outfit iDefense.

"My own view is that 90 percent of this is being done by volunteers," she told United Press International, adding that, within a few days of being launched, the attacks had become more intense than those last year against Estonia.

Zenz's view is at odds with the Georgian government's charge that Russia's government and/or military were behind the attack. "It is extremely difficult for us to believe that this was not orchestrated at the highest levels," Patrick Worms, an adviser to the Georgian government, told UPI last week.

But one Israeli security specialist last week said the attacks were more akin to a cyber-riot than cyberwar.

"While Georgia is obviously under DDOS (Distributed Denial of Service) attack and it is political in nature żż it is my opinion this is not warfare but just some żż attacks by Russian hackers and/or some rioting by enthusiastic Russian supporters," wrote Gadi Evron, the former head of Israel's Computer Emergency Response;p> Evron acknowledged the attacks could be "indirect Russian (military) action," but pointed out the attackers "could have attacked more strategic targets or eliminated the (Georgian Internet) infrastructure kinetically," i.e., with high explosives.

Indeed, a careful analysis of the attacks shows that the most damaging actions were likely carried out by organized hacker gangs.

The first attacks were launched by botnets -- networks of personal computers that have become, often unbeknownst to their owners, infected with malicious software and are controlled by hackers. Botnets are used to send spam e-mails or to bombard Web sites with fake visits, the technique used against Georgia and known as Distributed Denial of Service attack.

Shadowserver volunteers logged six different botnets involved in the DDOS attacks on Georgian government and news sites, each controlled by a different command server. "We have been tracking these servers for a while now, some for a year or more," Shadowserver volunteer Mike Johnson told United Press International by e-mail.

Johnson said their prior targets were mostly Cyrillic-language sites in the Russian .ru domain and mainly "from the 'seamier' side of the Internet" -- pornographic video, gambling and prostitution sites.

Zenz said that fit the profile of botnets being rented out or otherwise used for extortion. "Those kinds of sites will pay, rather than go to the authorities (to stop a DDOS attack)," she said.

She said Russian hackers were also distributing lists of e-mail addresses for Georgian officials and of Georgian Web sites with security flaws -- encouraging others to get involved in hacking or sending spam or malware.

Georgian hackers appeared to have responded, Zenz said, taking down sites that provided news about the Russian-backed Georgian breakaway province of Ossetia -- and in one case replacing the Web site's own content with a news feed from a pro-Georgian service.

At least two of the three major Georgian Internet service providers appeared to have blocked access to Russian .ru Web sites for their subscribers last week, Zenz added.

Several Georgian officials and others involved in monitoring and responding to the cyberattacks failed to respond to e-mail queries Monday or were unavailable for comment.

Russian officials last week denied Georgian charges they were behind the attacks -- a he-said, she-said scenario that has become familiar in this conflict in which so much is unclear.

"You have charges from both sides," White House spokesman Gordon Johndroe told reporters Monday, referring to Russian allegations and Georgian counter-allegations of ethnic cleansing. "We take these charges seriously and are going to look into them."

Zenz said that, despite the self-organized character of the cyberattacks, they were very sophisticated. For instance, the Russian attackers appeared to have tried to forestall any cyber-retaliation by taking down the two highest-profile Georgian hacker sites, and, in their initial assault.

Moreover, the fact that news sites were among the first targets showed an awareness that this was a battle about perception as much as reality.

"This is all about trying to shape the message -- on both sides," she said, adding, "Georgian hackers are not as numerous or as good, and they don't have those botnets at their fingertips."

Email This Article
Comment On This Article

Share This Article With Planet Earth DiggDigg RedditReddit
YahooMyWebYahooMyWeb GoogleGoogle FacebookFacebook

Related Links
Cyberwar - Internet Security News - Systems and Policy Issues

Memory Foam Mattress Review
Newsletters :: SpaceDaily :: SpaceWar :: TerraDaily :: Energy Daily
XML Feeds :: Space News :: Earth News :: War News :: Solar Energy News

US subway card hackers targeted with lawsuit
Las Vegas, Nevada (AFP) Aug 9, 2008
Operators of a US city transit system were in court Saturday trying to stop hackers from showing thousands of their peers how to get free rides by cracking its fare "smart cards."

  • US: Venezuela's Russia fleet invite is 'curious'
  • Russia moves SS-21 missiles into Georgia: US defense official
  • Tougher Russia could complicate UN work
  • Georgia 'will join NATO': Merkel

  • Atlantic Eye: Lost lessons of the Cold War
  • Strategic Lessons In Failure Part Three
  • UN watchdog holds more nuclear talks in Iran
  • Saudis Facing Reality Check With Rise Of A Nuclear Iran

  • Thales Successful In ESSM Live Firing Test
  • Missile Successfully Launches From Vandenberg
  • Indian Army Orders Additional BrahMos Cruise Missiles
  • ATK Conducts Successful AARGM Flight Test

  • Rice arrives in Warsaw to sign US-Polish missile deal
  • Poland won't be intimidated over US missiles: president
  • Balance Of Terror Rides Again In Pursuit Of Mutual Destruction
  • US Missile Defense In Europe Becomes A Reality

  • China's Tianjin building runway for Airbus test flights: report
  • NASA evaluates new wing sensor
  • Russia And China May Co-Design New Passenger Plane
  • China Southern Airlines managers take paycut due to oil prices

  • Unmanned Vehicles Go Head-To-Head On Salisbury Plain
  • Latest UAV Spreads It's Wings In Southern Afghanistan
  • Thales's Watchkeeper Programme Passes Flight Trials
  • US Navy's BAMS UAS Program Begins After GAO Ruling

  • Feature: Success alters U.S. Iraq tactics
  • Dogs of War: Blackwater as Wal-Mart
  • Analysis: Oversight of contractors lags
  • Airlift of Georgian troops from Iraq near complete: Pentagon

  • Lockheed Martin C-5m Super Galaxy Completes Flight Test
  • Is Russian Air Power Facing Up To Training Issues Part Two
  • Sniper ATP-Equipped B-1B Has Combat First
  • Iran boosts range on warplanes

  • The content herein, unless otherwise known to be public domain, are Copyright 1995-2007 - SpaceDaily.AFP and UPI Wire Stories are copyright Agence France-Presse and United Press International. ESA Portal Reports are copyright European Space Agency. All NASA sourced material is public domain. Additional copyrights may apply in whole or part to other bona fide parties. Advertising does not imply endorsement,agreement or approval of any opinions, statements or information provided by SpaceDaily on any Web page published or hosted by SpaceDaily. Privacy Statement