Is Cyber a new warfare? Debate (catch all)

[marct]

Hi Stan,

Okay, I'll bite - can we get more information on him? Seriously, this is ringing off all sorts of pattern recognition bells in my mind. In particular, what forums was he posting on and who else goes there. Is this a parallel to how AQ recruits?

Marc

[Stan]

Hmmm, anyone wondering what Putin woke up to this morning on his server

The Estonian National Anthem has reportedly been 'cybered into' several Russian servers. Upon launching the site (I just tried it here), the Estonian's famous sinimustvalge begins

Along with the nice music pops the Estonian flag with this underneath:

Estonia forever!


маскальским и сибирским л0хам превед из Таллина!

Unfortunately, Estonia's IT experts feel the three sites are the work of the Russian youth and not patriotic Estonians. The links have been up too long and the Windows version used is Russian.

[Stan]

Hi Stan,

Okay, I'll bite - can we get more information on him? Seriously, this is ringing off all sorts of pattern recognition bells in my mind. In particular, what forums was he posting on and who else goes there. Is this a parallel to how AQ recruits?

Marc

I have no idea if this is how the AQ recruits. Estonian LE are calling him a criminal and little more. This is about all I could find from various info sources and the translations were 'quick and dirty'

Summation:
The attacks entailed a broad array of techniques, which started with mere spamming posts to later well-coordinated DDoS attacks against the government’s IT systems. The cyber attacks were coordinated in Russian over the internet from computer networks and servers in Russia. Detailed instructions on how to act included topics about the nature and execution of attacks, as well as information about potential targets and attack timing.

Very basic instructions were disseminated on websites, in forums, and in chat spaces, precluding the user’s need for any knowledge or skills. The first attack took place on 27 April following the first night of rioting and was fairly simple. The portrait of the Prime Minister was defaced on the home page of the Reform Party (the PM with Hitler’s mustache) and initial DDoS attacks against Estonian government organizations. Some were successful, but normal operations were quickly restored.

Dmitri’s Role:
On the 28th however, serious attacks were being urged to forum members living in Estonia against Estonian web pages from addresses http://2ch.ru and http://forum.xaker.ru. Discussions were also taking place about how to finance the rental of server farms and botnets for a massive attack - A Trojan Horse application - needed to hijack computers. More than 1,500 users logged onto their chat lines and awaited instructions from the botnet. It is widely believed that, a Russian criminal gang rented the botnet in order to launch these attacks against Estonia.

Simultaneous orders to attack were being disseminated via the internet. Although the vast majority were primitive, they were effective for the purposes of creating chaos and confusion. The attacks were also discussed and coordinated in IRC environments. Consequently, there was a large incremental increase in spontaneous attacks carried out by individuals. On the 30th a number of very complex and sophisticated attacks were launched.

The attackers were able to dedicate substantial resources indicative of a well organized and financed enemy. By this time, the Estonian authorities had blocked the majority of internet traffic from ‘dot RU’ IP address extensions, as well as from many other foreign IPs. Somewhat later in the day the brunt of the attack shifted to the DNS system. Now seemingly human-friendly website names were utilized with the obvious intent of putting the entire DNS system out of commission, and cripple Estonia’s internet.

During the first week of May, some of these attacks were able to achieve temporary success against telecommunications companies providing internet services and Estonian media publications. The attackers covered their tracks by using global bot networks (not all located in Russia), proxy servers in third countries, and by distorting their IP addresses.

At least they're seeking help !


Estonia to discuss cyber-attacks with NATO, EU

Estonia is to raise the issue of how to handle cyber-attacks against state computer systems in meetings with partner member states of the NATO military alliance and European Union, officials said Friday.

"If the ports of a NATO member country are under attack, it is considered an attack against the whole of NATO, and the military alliance comes to help," Defence Minister Jaak Aaviksoo said.

Regards, Stan

[Stan]

"Last Friday, we hoped it was all over but the new massive attack against one of the biggest banks on Tuesday showed we were too optimistic.

"Cyber-attacks also have been launched against banks, newspapers, schools and many other institutions".

Estonia's second-biggest bank, Swedish-owned SEB Eesti Uhispank, was forced Tuesday to block access from abroad to its online banking service after it came under "massive cyber-attack".

[kaur]

Nato has dispatched some of its top cyber-terrorism experts to Tallinn to investigate and to help the Estonians beef up their electronic defences.
"This is an operational security issue, something we're taking very seriously," said an official at Nato headquarters in Brussels. "It goes to the heart of the alliance's modus operandi."

http://www.guardian.co.uk/russia/art...081438,00.html

[marct]

Hi Kaur,

Excellent article, thanks for the link.

Based on what has been posted in this thread so far, I wold hazard a guess that this started as an opportunistic attack with the political-symbolic environment being manipulated by the Russians. The Russian State gets plausible deniability and, at the same time, the types of attacks they want - i.e. "non-warfare".

There are some things I want to think through on how this operates but, my current thinking is that this is a form of symbolic warfare that will bite the Russians later one.

Marc

[Stan]

Hi Kaur,

Excellent article, thanks for the link.

Based on what has been posted in this thread so far, I wold hazard a guess that this started as an opportunistic attack with the political-symbolic environment being manipulated by the Russians. The Russian State gets plausible deniability and, at the same time, the types of attacks they want - i.e. "non-warfare".

There are some things I want to think through on how this operates but, my current thinking is that this is a form of symbolic warfare that will bite the Russians later one.

Marc

Hi Marc !
I'll let Kaur answer from his own perspective, but what the Estonian Govt. and LE are saying, this was well planned, executed and financed.

Dmitri is not talking, but based on his 'student' status and relative lack of money, he was living extremely well.

Experts from Nato member states and from the alliance's NCSA unit - "Nato's first line of defence against cyber-terrorism", set up five years ago - were meeting in Seattle in the US when the crisis erupted. A couple of them were rushed to Tallinn.

Another Nato official familiar with the experts' work said it was easy for them, with other organisations and internet providers, to track, trace, and identify the attackers.

That said, NATO may be a touch concerned. Me Thinks !

[Stan]

BBC's 'Have Your Say' wants to know

Are you in Estonia? Do you think that Russia is responsible for the attacks? How well protected are state websites against this form of harassment?

[kaur]

I'd like to use word virtual swarming to describe the activity of opponents that are attacking Estonian servers. At first it looked like volunteer internet riot. Word was spread in internet forums to attack Estonian servers. For people without special knowledge, there were given special instructions how to do this. They did this as volunteers and binding force was the idea that there was huge insult against Russian soul by Estonian government. They attacked from every direction. The sites that were attacked were first not so important. At present they are useing same method, but calibre of their weapon is much bigger (number of hijacked computers is very big). How have they acquired this, it is interesting to know. It is hard to belive that the number of volunteers has grown because it seems that situation is at least here is calm (Estonian ambassador is also back in Russia again and Russian media is quiet) and momentum is gone. Who has such capacity to attack so intensely? Now they are targeting important targets, Estonian banks. e-banking is very popular here, so people are really pissed off.

Here is BBC story "Estonia hit by 'Moscow cyber war'

http://news.bbc.co.uk/2/hi/europe/6665145.stm

It seems that opponent has red this book http://en.wikipedia.org/wiki/Unrestricted_Warfare