Georgia cyberattacks linked to Russian organized crime

The cyberattackers were tipped off in advance of Russian military operations and timed the DDOS accordingly

The cyberattacks against Georgia a year ago were conducted in close connection with Russian criminal gangs, and the attackers likely were tipped off about Russia's intent to invade the country, according to a new technical analysis, much of which remains secret.

The stunning conclusions come from the U.S. Cyber Consequences Unit, an independent nonprofit research institute that assesses the impact of cyber attacks. A 100-page technical analysis is only being made available to the U.S. government and some cybersecurity professionals, but the organization did release a nine-page summary early Monday.

The report in part confirms some of the suspicions of observers, who theorized that the distributed denial-of-service attacks (DDOS), which crippled many Georgian Web sites, had its roots in Russia.

The report was chiefly produced through investigations by the CTO of the U.S. Cyber Consequences Unit, John Bumgarner. It involved analyzing a raft of data collected as the attacks were going on and afterwards. The data included server logs from a variety of stakeholders, some of whom would not share information with each other, said Scott Borg, director and chief economist of the institute.

Russia launched a five-day military campaign in August 2008 that corresponded with Georgia's attempts to assert greater control over the South Ossetia and Abkhazia regions, which have strong ties to Russia. Bombers struck targets throughout the country, and at the same time Georgian media and government sites fell under DDOS attack.

That timing doesn't appear to be a coincidence. The attacks were executed with an efficiency that indicated pre-planning, and the cyberattacks also preceded the first news stories of Russia's military intervention, according to the report.

"Many of the cyber attacks were so close in time to the corresponding military operations that there had to be close cooperation between people in the Russian military and the civilian cyber attackers," the report said. "Many of the actions the attackers carried out, such as registering new domain names and putting up new Web sites, were accomplished so quickly that all of the steps had to be prepared earlier."

Borg said that the institute is confident that the Russian government didn't directly carry out the attacks. But it is clear that Russia appeared to be leveraging civilian nationalists who were ready to take cyber action, perhaps with some low-level encouragement.

"It appears that the military invasion was taking into account the help they were about to receive ... by the cyberattack," Borg said.

It is not clear, however, at what level the interaction between Russian government officials and those who executed the attacks occurred. But it does appear that the loose coordination will likely become part of Russia's standard operating procedure from now on, Borg said.

A total of 54 Web sites were attacked, most of which would have benefited the Russian military campaign by not functioning, Borg said. By shutting down media and government sites, it was harder for Georgia to communicate to the public what was going on. Financial transactions were disrupted, and the National Bank of Georgia had to cut off its Internet connection for 10 days, according to the report.

Social networking sites helped recruit volunteers who traded tips on online forums in Russian, with one English-language forum hosted in San Francisco, the report said. Computers servers that had been used in the past to host malicious software by Russian criminal gangs were also used in the attacks.

"It appears that Russian criminal organizations made no effort to conceal their involvement in the cyber campaign against Georgia because they wanted to claim credit for it," the report said.

DDOS attacks work by bombarding a Web site with too many page requests, which causes it to become unavailable due to bandwidth problems unless security measures are taken. The attack is executed by a botnet, or a network of PCs that become infected with malicious code controlled by a hacker.

The code used to command those machines to attack the Web sites appeared to be customized specifically for the Georgia campaign, the report said. Three of the software programs used were designed to test Web sites to see how much traffic they can handle.

A fourth program was originally designed to add functions to Web sites but was altered by the hackers to request nonexistent Web pages. That tool, which is HTTP-based, proved more efficient than the ICMP-based (Internet Control Message Protocol) attacks used against Estonia in 2007, the report said.

Further evidence showed that Georgia could have been hit much harder. Some of Georgia's critical infrastructure was accessible over the Internet. While the civilian cyber attackers had signs of considerable expertise, "if the Russian military had chosen to get directly involved, such attacks would have been well within their capabilities," the report said.

"The fact that physically destructive cyberattacks were not carried out against Georgian critical infrastructure industries suggests that someone on the Russian side was exercising considerable constraint," it said.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags governmentcyber attacksrussia

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?