Georgia cyberattacks linked to Russian organized crime

The cyberattackers were tipped off in advance of Russian military operations and timed the DDOS accordingly

The cyberattacks against Georgia a year ago were conducted in close connection with Russian criminal gangs, and the attackers likely were tipped off about Russia's intent to invade the country, according to a new technical analysis, much of which remains secret.

The stunning conclusions come from the U.S. Cyber Consequences Unit, an independent nonprofit research institute that assesses the impact of cyber attacks. A 100-page technical analysis is only being made available to the U.S. government and some cybersecurity professionals, but the organization did release a nine-page summary early Monday.

The report in part confirms some of the suspicions of observers, who theorized that the distributed denial-of-service attacks (DDOS), which crippled many Georgian Web sites, had its roots in Russia.

The report was chiefly produced through investigations by the CTO of the U.S. Cyber Consequences Unit, John Bumgarner. It involved analyzing a raft of data collected as the attacks were going on and afterwards. The data included server logs from a variety of stakeholders, some of whom would not share information with each other, said Scott Borg, director and chief economist of the institute.

Russia launched a five-day military campaign in August 2008 that corresponded with Georgia's attempts to assert greater control over the South Ossetia and Abkhazia regions, which have strong ties to Russia. Bombers struck targets throughout the country, and at the same time Georgian media and government sites fell under DDOS attack.

That timing doesn't appear to be a coincidence. The attacks were executed with an efficiency that indicated pre-planning, and the cyberattacks also preceded the first news stories of Russia's military intervention, according to the report.

"Many of the cyber attacks were so close in time to the corresponding military operations that there had to be close cooperation between people in the Russian military and the civilian cyber attackers," the report said. "Many of the actions the attackers carried out, such as registering new domain names and putting up new Web sites, were accomplished so quickly that all of the steps had to be prepared earlier."

Borg said that the institute is confident that the Russian government didn't directly carry out the attacks. But it is clear that Russia appeared to be leveraging civilian nationalists who were ready to take cyber action, perhaps with some low-level encouragement.

"It appears that the military invasion was taking into account the help they were about to receive ... by the cyberattack," Borg said.

It is not clear, however, at what level the interaction between Russian government officials and those who executed the attacks occurred. But it does appear that the loose coordination will likely become part of Russia's standard operating procedure from now on, Borg said.

A total of 54 Web sites were attacked, most of which would have benefited the Russian military campaign by not functioning, Borg said. By shutting down media and government sites, it was harder for Georgia to communicate to the public what was going on. Financial transactions were disrupted, and the National Bank of Georgia had to cut off its Internet connection for 10 days, according to the report.

Social networking sites helped recruit volunteers who traded tips on online forums in Russian, with one English-language forum hosted in San Francisco, the report said. Computers servers that had been used in the past to host malicious software by Russian criminal gangs were also used in the attacks.

"It appears that Russian criminal organizations made no effort to conceal their involvement in the cyber campaign against Georgia because they wanted to claim credit for it," the report said.

DDOS attacks work by bombarding a Web site with too many page requests, which causes it to become unavailable due to bandwidth problems unless security measures are taken. The attack is executed by a botnet, or a network of PCs that become infected with malicious code controlled by a hacker.

The code used to command those machines to attack the Web sites appeared to be customized specifically for the Georgia campaign, the report said. Three of the software programs used were designed to test Web sites to see how much traffic they can handle.

A fourth program was originally designed to add functions to Web sites but was altered by the hackers to request nonexistent Web pages. That tool, which is HTTP-based, proved more efficient than the ICMP-based (Internet Control Message Protocol) attacks used against Estonia in 2007, the report said.

Further evidence showed that Georgia could have been hit much harder. Some of Georgia's critical infrastructure was accessible over the Internet. While the civilian cyber attackers had signs of considerable expertise, "if the Russian military had chosen to get directly involved, such attacks would have been well within their capabilities," the report said.

"The fact that physically destructive cyberattacks were not carried out against Georgian critical infrastructure industries suggests that someone on the Russian side was exercising considerable constraint," it said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags cyber attackssecurityrussiagovernment

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?