Georgia cyberattacks linked to Russian organized crime

The cyberattackers were tipped off in advance of Russian military operations and timed the DDOS accordingly

The cyberattacks against Georgia a year ago were conducted in close connection with Russian criminal gangs, and the attackers likely were tipped off about Russia's intent to invade the country, according to a new technical analysis, much of which remains secret.

The stunning conclusions come from the U.S. Cyber Consequences Unit, an independent nonprofit research institute that assesses the impact of cyber attacks. A 100-page technical analysis is only being made available to the U.S. government and some cybersecurity professionals, but the organization did release a nine-page summary early Monday.

The report in part confirms some of the suspicions of observers, who theorized that the distributed denial-of-service attacks (DDOS), which crippled many Georgian Web sites, had its roots in Russia.

The report was chiefly produced through investigations by the CTO of the U.S. Cyber Consequences Unit, John Bumgarner. It involved analyzing a raft of data collected as the attacks were going on and afterwards. The data included server logs from a variety of stakeholders, some of whom would not share information with each other, said Scott Borg, director and chief economist of the institute.

Russia launched a five-day military campaign in August 2008 that corresponded with Georgia's attempts to assert greater control over the South Ossetia and Abkhazia regions, which have strong ties to Russia. Bombers struck targets throughout the country, and at the same time Georgian media and government sites fell under DDOS attack.

That timing doesn't appear to be a coincidence. The attacks were executed with an efficiency that indicated pre-planning, and the cyberattacks also preceded the first news stories of Russia's military intervention, according to the report.

"Many of the cyber attacks were so close in time to the corresponding military operations that there had to be close cooperation between people in the Russian military and the civilian cyber attackers," the report said. "Many of the actions the attackers carried out, such as registering new domain names and putting up new Web sites, were accomplished so quickly that all of the steps had to be prepared earlier."

Borg said that the institute is confident that the Russian government didn't directly carry out the attacks. But it is clear that Russia appeared to be leveraging civilian nationalists who were ready to take cyber action, perhaps with some low-level encouragement.

"It appears that the military invasion was taking into account the help they were about to receive ... by the cyberattack," Borg said.

It is not clear, however, at what level the interaction between Russian government officials and those who executed the attacks occurred. But it does appear that the loose coordination will likely become part of Russia's standard operating procedure from now on, Borg said.

A total of 54 Web sites were attacked, most of which would have benefited the Russian military campaign by not functioning, Borg said. By shutting down media and government sites, it was harder for Georgia to communicate to the public what was going on. Financial transactions were disrupted, and the National Bank of Georgia had to cut off its Internet connection for 10 days, according to the report.

Social networking sites helped recruit volunteers who traded tips on online forums in Russian, with one English-language forum hosted in San Francisco, the report said. Computers servers that had been used in the past to host malicious software by Russian criminal gangs were also used in the attacks.

"It appears that Russian criminal organizations made no effort to conceal their involvement in the cyber campaign against Georgia because they wanted to claim credit for it," the report said.

DDOS attacks work by bombarding a Web site with too many page requests, which causes it to become unavailable due to bandwidth problems unless security measures are taken. The attack is executed by a botnet, or a network of PCs that become infected with malicious code controlled by a hacker.

The code used to command those machines to attack the Web sites appeared to be customized specifically for the Georgia campaign, the report said. Three of the software programs used were designed to test Web sites to see how much traffic they can handle.

A fourth program was originally designed to add functions to Web sites but was altered by the hackers to request nonexistent Web pages. That tool, which is HTTP-based, proved more efficient than the ICMP-based (Internet Control Message Protocol) attacks used against Estonia in 2007, the report said.

Further evidence showed that Georgia could have been hit much harder. Some of Georgia's critical infrastructure was accessible over the Internet. While the civilian cyber attackers had signs of considerable expertise, "if the Russian military had chosen to get directly involved, such attacks would have been well within their capabilities," the report said.

"The fact that physically destructive cyberattacks were not carried out against Georgian critical infrastructure industries suggests that someone on the Russian side was exercising considerable constraint," it said.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags cyber attackssecurityrussiagovernment

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?