Issue 4353. Last Updated: 03/21/2010

Hacker Attacks Preceded Fighting

Reuters
Hackers knocked down Georgian government web sites days before Russian tanks rolled into the country's territory, in what experts said Wednesday was an ominous sign that cyber-attacks might foreshadow future armed conflicts.

Major Internet security firms reported massive attacks on Georgian web sites by hackers using botnets, a network of "zombie" computers that can be used to overwhelm servers with millions of unsolicited requests.

"Cyber-attacks are part of the information war," said Alexander Denezhkin, editor of Cybersecurity.ru, an online journal. "Making your enemy shut up is a potent weapon of modern warfare."

The so-called distributed-denial-of-service (DDoS) attacks began in the weeks running up to the outbreak of the Russia-Georgia conflict and continued after the Kremlin announced that it had ceased hostilities Tuesday, said Tom Burling, an executive of Tulip Systems, a U.S. Internet firm. Tulip Systems, which took over hosting of the web sites for Georgia's presidency and a major television network on Saturday, said its experts had worked frantically to curtail the damage from the hackers. "They have been attacking Georgia from a cyber standpoint since July," Burling said, AFP reported. "They are still doing it now. Our poor technician here has gotten three hours sleep in the past four days."

Georgia has blamed Russia for the attacks.

Burling said Russia could be behind the attacks, which mirror attacks on Estonian web sites amid a dispute between Moscow and Tallinn last year.

Access to the Georgian president's web site remain closed Wednesday, and attempts to reach government officials by telephone for comment were unsuccessful.

Shadowserver.org, a U.S.-based foundation that monitors network activities, said it had no hard evidence to prove Russians were behind the attacks. The organization said, however, that the HTTP-based botnet server responsible for the attacks "is a MachBot controller, which is a tool that is frequently used by Russian bot herders."

"On top of that, the domain involved with this C&C server has seemingly bogus registration information but does tie back to Russia," it said in a statement posted on the group's web site.

All the attacks so far have been launched and coordinated from a U.S. segment of the web site, Shadowserver said.

Russian Internet security experts said the location of infested computers was immaterial to an effective cybercampaign. "Infested computers could be in the U.S. or Australia," Denezhkin said. "The crucial thing is existence of a commander or coordinator who could signal when cyber-attacks should begin."



Discussion

Comments

The Moscow Times welcomes comments from our readers and encourages you to participate in creating a dialogue about modern-day politics, business and events in Russia. In order to post a comment, you must first be registered with our site, and all comments must adhere to our comments policy.

1. Comments must pertain to the topic of the corresponding article.
2. Comments must not contain vulgarity, ad hominem attacks, slander or anything resembling hate speech.

If you have posted a comment and it does not appear within 24 hours, please contact us.

print


 For bloggers



Most Read