Slashdot Mirror
The Real Impact of the Estonian Cyberattack
An anonymous reader writes "News.com offers up an interview with Arbor Networks' senior security researcher Jose Nazario. He takes stock of the denial-of-service attack against the Baltic nation of Estonia, and considers the somewhat disturbing wider implications from the event. 'You look around the globe, and there's basically no limit to the amount of skirmishes between well-connected countries that could get incredibly emotional for the population at large. In this case, it has disrupted the Estonian government's ability to work online, it has disrupted a lot of its resources and attention. In that respect, it's been effective. It hasn't brought the government to a crippling halt, but has essentially been effective as a protest tool. People will probably look at this and say, That works. I think we're going to continue to do this kind of thing. Depending on the target within the government, it could be very visible, or it could not be very visible.'"
Depending on the target within the government, it could be very visible, or it could not be very visible.
Yep, that pretty much sums up the possible outcomes.
You know... I thought about the possibility of a Multicast worm/attack ... Just haven't had time to document it... Would work similar to the following... For those who use IM clients that have annoying streaming advertisements... If you didn't know, those are multicasted to your machine... My theory was to re-inject packets at the router level (avoiding Reverse Path Forwarding when possible) to make your machine believe my spoofed host is a valid source to get your images from... Only thing is, the image would be corrupted forcing an infection on your machine... This would in turn replicate via broadcast from the infected hosts... It was a theory of mine while studying DoS attacks for the CCIE security exam and a lot of variables would have to be met... Anyhow, the reason for this post is, I believe those committing DoS attacks are halfclued as to what a real attack could potentially do... For instance Border Router Attack Tool is another theoretical tool to break BGP neighboring. You of course have to know enough about a topology to even get it to work but under a unified stream, you could cause massive route flaps which lead to neighbors disconnecting. Its only a matter of time before someone takes it to the extreme and breaks connectivity between huge AS'
Infiltrated dot Net
Damn my Asperger's. I thought we were under attack from Cybertron...
Isn't the backbone capable of metering connections to an attacked country? I haven't noticed the providers to be politically spineless (except for AT&T) but can't they help a poor country out?
For 3 years straight I've been getting hit by Viagra and Penis enlargement e-mails/ads about 30 times a day. Maybe they can use that for their own defense just to irritate the piss out of them.
"Please, shut up. Just when I think you can't say anything more stupid, you speak again." -Archie Bunker.
just do this
It isn't cyber attack here in France that's the killer! It's something worse! Save yourselves, stay away!!!!!!
In Soviet Russia, Estonia cyberattacks you!
Unless some magical solution presents itself, then cyber-warfare will most likely continue. The difference will be in how we respond. Should starting up your own cyber-attacks be an acceptable form of retaliation? or will more cyber-attacks only lead us down the path to a conventional-attack?
That a whole country could be DOS'd is evidence of someone doing a bad network install. The network should never be down.
Lots of companies have a root-and-branches approach to Internet connectivity, too, thinking that each site (or the whole corporate intranet) needs only one gateway to the outside. Put all your eggs in one basket, and watch the basket. For the family baked bean recipe confidentiality that's good, but for availability that's bad.
The "right" way to do it is to have multiple redundant shared trunks with neighbors. That word "shared" is scary to network administrators (or rather, to their pencil-pushing mentors). It means they'll have to carry outside traffic on their pipes (that's a metaphor, Senator), and that has risks: it costs money, and it has the potential to allow someone to see inside the network.
However, the rewards for sharing bandwidth are enormous: multiple ISPs mean allowing TCP/IP to do its job, routing traffic to avoid disasters like DOS attacks, hurricanes, and nuclear bombs. The ISPs and other bandwidth partners know they have an interest in helping to protect your network. The technical risks can be mitigated simply by routing and tunneling.
Is the above realistic? Nope. Not in a corporate environment, anyway. I'd be really surprised if anyone outside academia or pure ISP does shared trunking anymore.
But it can also happen at the leaf nodes: you and your neighbors share cable broadband and DSL connections, routing through wifi. That violates most subscriber agreements, but it's the way the protocols were designed to work. Your network should never be down.
Never.
sigs, as if you care.
Decent well-connected countries would not engage in this sort of things. Russia — busily turning itself back into an Evil Empire — denies "officially" organizing the attacks...
Whether it did officialy organize them, or not is irrelevant — so many things in the country happen unofficially (including the unofficial salaries — in dollars — paid to top government bureaucrats to keep them from leaving for the private sector), that the government's claims may even be nominally truthful this time.
What is important is the government's official reaction. For example, a Russian health official is on record concerning the health hazards of the Estonian sprats. Those who follow the region would recognize the tactics already applied against Georgia's major exports. Georgia's most excellent wines are now called "alcohol-containing liquids" in Russia and their import is banned "on health grounds".
Sprats are safe for now — unlike Georgia, Estonia is an EU (and NATO) member. But Russia — in sore need of something glorious in its sorry past (we liberated Estonia, not reconquered it, you see) — is still enraged. In a decent country such rage wouldn't be enough to break law and order, but Russia is another story. There is no doubt, the cyber-attacks against Estonia used Russian governmental resources, including hardware and human ones — these will most certainly not be prosecuted.
In Soviet Washington the swamp drains you.
"... there's basically no limit to the amount of skirmishes between well-connected countries that could get incredibly emotional for the population at large..."
Come off it! The population won't give a drop of gnat's piss. They don't depend on computing for anything. So their e-mails go a bit slow - there's nothing unusual there if you use Microsoft. Given how much people put up with anyway, I can't see them noticing!
If you purchase those items, then they will stop targeting your email. That's what a friend told me.
I'm seeing a shitload of spam and SSH scanning from Russia. There's also stuff like the excellent Nginx web server, no reason to doubt the authors motives but at what point would he cave to mafia threats and insert a back door?
The situation in Russia isn't helped by the fact that the mafia are basically the state (Putins FSB). Europe will eventually rely on these villains for natural gas, what can the west do about the situation before it's too late?
Only thing is, the image would be corrupted forcing an infection on your machine...
... checksum for your "poor man tripwire" is pathetic).
Sure dude... So on, say, Linux, you'd have to exploit supposedly a buffer overflow to gain local access *then* you'd need to exploit a local root exploit to gain root privileges. Multiply this by the number of Linux distros out there and the number of different IM clients and suddenly your pet theory falls flat. Or maybe you were talking about rooting Vista boxes? Cancel or Allow?
You've posted links to this lame "infiltrated" website several times... This website is full of random babbling and misinformation, all the "exploits" look exactly like: "type sudo root apt-get install trojan" or "type sudo root rpm -Uvh trojan.rpm". See the flaw?
You predicted a major Un*x worm coming in the next 9 months... As a regular Un*x user bragging about your OS of choice using "uname -a", you really should know better about how Un*x OSes are working.
Your "tripwire on steroids" is plain laughable... But you mentionning Tripwire raise an interesting question: should people run your "Proof of Concept" [sic] backdoor using "sudo root" (how else could you execute root commands on a system you plan to attack? Wait, even without needing root, how do you plan to run your "Proof of Concept" backdoor on someone's computer?), how would you defeat people unmounting the drive and scanning it from a known clean system running an integrity tool like Tripwire?
Methinks you *pretend* to know something about security but you're actually just at the very beginning of your long journey (your MD5 + SHA1 +
It is really completely dumb to pretend to have a "Proof of Concept" backdoor for Un*x systems that needs to be installed doing "sudo root something".
I've got here at home one Debian etch (custom-compiled kernel), one old Fedora Core 4... And one OpenBSD box. Care to explain how from here to nine months those Un*x machines will get infected by a major Un*x worm/trojan/plague whatever?
For either you explain it or you accept you, and your website, are full of sh*t.
To moderators: that guy has been modded as troll previously, he doesn't know jack, put him in your "-1" list.
say you had two countries simmering over some stupid feud: land or machismo or even a soccer game. in such a situation, any cross border incursions or launched missiles can get back to a matter of accountabilty: what comes from your territory is your responsibility, and the fact that something came from your territory or not is pretty straightforward. the side where the incursions came from can even make excuses, but the other side can still say: "look, these guys came from your territory. clean it up yourself or we'll clean it up for you." that provides some straightforward safeguards right there
however, things are too nebulous on the web. no accountability. the russians that attacked estonia can not be found by russia and suppressed easily, because no one knows who they are. well, obviously there can be some intelligent detective work done (who purchased the botnets for rent, for example), but my point is, any group of teenage assholes can do this sort of thing, from any botnet in the world, and so it renders obvious lines of accountability all nebulous and unresolved
and so it is sort of like terrorism, in that there is no one easy and big to blame. no state or governmental entity. it's vague and undefined. and in the end, therefore, these sorts of wars/ crimes are really the defining characteristic of conflicts in the 21st century. for the most part, wars of nation against nation and obvious straightforward battlefields seem to be a dead era. today's conflicts are all about shadowy organizations ready to do nefarious things in the name of nebulous agendas, and finding and stopping who or what or how is simply a task without any clear goals or clear yardsticks of progress
some people would use this fact to say that therefore there is no war or conflict at all, that say, the "war on terrorism" isn't real. no, wrong. the threat is still very real. something like 9/11 is not a phantasm of a neocon's imagination
it's just that the enemy is opaque and made of fog. but because the enemy is hard to pin down, does not mean there isn't nefarious intent out there you need to protect yourself from. yes, that vagueness can be used to amp up fear and provoke overreaction. but, in a way, doing nothing is still worse than overreaction (unless overreaction consists of taking the war to targets that should not be targets)
we live in a difficult era folks. do nothing, you're damned. do something, you can be damned worse. you need to be clever and constant and precise in your efforts, and you'll still screw up and get blowback anyways, and you must still soldier on nonplussed nonetheless, against cyberenemies, against terrorism, with no real yardstick of progress, with no real verification of success or failure, with nothing but the fog for miles and for years, and then a plane in a skyscraper, or a bomb in a disco, or a flood of emails, or a DoS for seemingly no rhyme or reason... and then gone again like a fart in the wind, until the next mass murder. it's psychologically debilitating, and yet constitution and fortitude are your best character qualities needed in order to beat back these shadowy enemies
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I understand that the Russians are essentially harassing countries that used to be part of the Soviet Union, most notably they have been trying to interfere with the Ukraine. I wonder if they have anything to do with this DOS attack on Estonia's government network.
Kevin Smith on Prince
It could also be somewhat visible. Yes, some attacks are somewhat visible indeed.
____
nico
Nico-Live
Given how "well" Russian Government organizes things it'd be an utter failure. Please remember, there are many people and groups in the whole world that are quite capable of doing it by themselves. What, do you think the government has nothing else to do than to issue covert demands for every dial-up user to ping particular Estonian servers?
Estonia (and some mass media) simply find it useful to blame everything on Russian government now. Russian companies refuse to buy their products because customers stopped buying them? Blame Kremlin. If a giant meteor were to strike the capital right now, there'd be a couple of experts saying that "Nobody can prove it wasn't a covert Kremlin operation".
Of course you also have to think about it from the other point of view. If there was a symbol for all US soldiers that died in combat, that marked their graves in another country, and that country would then decided to just move it somewhere else, because they want to put a highway on top of that last resting place... Would Americans grin and bear it? No? Loud screams from politicians asking for sanctions? Regular people doing everything they can to protest it? Net bot herders making statement and then bragging about "squashing the embassy N servers" between themselves?
Would the US government have to encourage people to do it?
Now tell me, what's the difference?
I would think the more important thing would be Pentagon's readiness to bomb the source of cyberattacks, which means that a group of bot herders can decide which country Pentagon will be bombing next.
Hyperom.com
Without a 2 front war you would be speaking German, make no mistake. Let's face it, the US mostly whipped the world into shape in WWII. Why we allowed Stalin to retain power, I'll never know. We should have given Patton an army of rearmed Germans to finish you off.
Yes, you launched a satellite, and yes you launched a man into space. Your efforts were greatly assisted by German rocketry (as were ours). You lost the big enchillada, the moon landing. Your empire no longer exists. Indeed you are surrounded by enemies.
Also, your economic warfare against Poland and Estonia are against WTO rules, a US invented organisation that you grovelled to join. Expect to be dropped from the G8 soon.
Your past is shit, as the Estonians so poignantly demonstrated.
...but every time I see a story about Estonia, I always think Elbonia. My apologies to both Scott Adams and the people of Elb^h^hstonia.
It must have been something you assimilated. . . .
has pluses and minuses. an internet where there is no anonymity is also the autocratic oppressive regime's best friend
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Frankly, because of stuff like this, we need to be prepared to use a variation of the old Internet Death Sentence. Hostile nations could be removed from the routing tables (i.e. we don't route traffic to or from them). With international cooperation attacks like this *could* be stopped dead in their tracks, with the side benefit that the offending nation would have a high priority desire to clean up the attacks.
Just another tool you need to keep in your toolbelt.
The first "D" stands for "Distributed."
Thank you for your charity in not calling me stupid.
There is a huge difference between being totally shut down by a DDoS attack and being 90% shut down. If you are shut down, there is fear; if you are limping along, you become angry. In a fight, anger is better than fear.
Having multiple points of entry helps in the effort to stay up, no matter what the cause. The reason DDoS's work is that Internet connections are leveraged: a small number, usually one, address per resource. In the case of a network gateway, there is one address for lots of resources.
Now, if the goal of the botnetter is to take down one speciific host, there's not much to be done except switching hosts, and repeating until one of you gets tired.
But if the problem is defending a whole country, then it's the gateways that must be defended. That problem is very hard if you only have one gateway, since the botnets only have to be aimed at one address. But if you have multiple addresses, while it's more work for you, it's very much more work for the attacker.
Also, having multiple gateways to defend gives more information about the sources of the attack.
In effect, having multiple gateways changes the game from a many-on-one attack to a many-on-many attack, which makes it more likely that you will succeed at least in a limited way, which is the goal.
sigs, as if you care.
I don't think that stopping routing from a country would make much practical difference. There are millions of vulnerable and already compromised Windows boxes scattered across the world. You can rent time on them from a Web interface. A big part of the usefulness of DDoS attacks is it is easy to make it impossible to attach them to an individual or country since the actual traffic comes from all countries. Most of the compromised machines known to be attacking as part of a botnet are within the US.
A trivial threat compared to posting the major web addresses on Slashdot.
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
not having responsibility for what goes on inside your borders is not an acceptable state of affairs. because neighbors will begin to get angry about it because of the rats and vermin making incursions from your lands, and then they will go in and clean things up themselves, and this of course is an escalation. that's why being responsible for what goes on inside your borders is the most imperative thing for a country to have. if they don't have it, there is only war and misery to be had with everyone who lives on the borders of such countries as assholes capitalize on the anarchy to further their mayhem
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
the russians that attacked estonia can not be found by russia and suppressed easily, because no one knows who they are.
Typically, if someone _needs_ to be prosecuted, "round up the usual suspects" applies. That you think otherwise is folly.
and so it is sort of like terrorism, in that there is no one easy and big to blame. no state or governmental entity. it's vague and undefined.
This is a half-truth used to create a fearful population and justify egregious limitations to your personal freedoms.
today's conflicts are all about shadowy organizations ready to do nefarious things in the name of nebulous agendas
and finding and stopping who or what or how is simply a task without any clear goals or clear yardsticks of progress
Exclusively associating this with the "terrists" is sadly inappropriate. The American intel community certainly does the same thing. The terrists didn't just appear out of the clear blue sky. As an example, please review the history of Afghanistan from, say 1970 to present.
the "war on terrorism" isn't real. no, wrong. the threat is still very real. something like 9/11 is not a phantasm of a neocon's imagination
No. It's a direct result of Western foreign policies. Except Americans don't pay attention to what their Government does, much less other super-powers that screw the regions up.
it's just that the enemy is opaque and made of fog. but because the enemy is hard to pin down
Wrong again. "the enemy" is a strategic result of a horrible event in American history that was a direct result of decades of bad foreign policy. The strategy justifies and accelerates sodomizing many of the founding principals of American Government. For example, the balance of powers.
If you didn't read 1984 by George Orwell, go to your local library and check out a copy today.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
how the hell in your mind does the malintent and bigotry of someone against you become your fault is utterly beyond my comprehension. sir: if i think i am superior to you because of race/ religion, that is an original sin on my part, which i am only accountable for
nothing, absolutely NOTHING i ever did or could ever do to you justifies or explains my own bigotry against you. al qaeda is not fighting the west because of che guevara, or the kyoto protocols, or walmart, or nike sweat shops in indonesia. al qaeda is fighting the west because al qaeda HAS AN AGENDA ALLL OF IT'S OWN. it believes it's version of sharia law should apply all over the middle east, and against every and all infidels who dare meddle. and by "meddle" i mean any retarded rationale they cook up to justify mass murder far beyond their borders
for example, what is the great crime that the hindus of bali perpetrated on the muslim world to justify the disco bombings there after 9/11? guess what: there is none. the target was valid because al qaeda's goal is the creation of a pan-islamic state in southeast asia. being a member of some other religion automatically justifies your qualification for mass murder. this is the way of the bigot: i am muslim, or i am white, or i am chinese, or i am baptist, whatever: just that fact alone makes me worthy of life and everyone else worthy of death
how the HELL in your mind does that original sin on the part of al qaeda members become the fault of the usa, or ANYTHING the usa EVER did in your mind? it's breathtaking your leap of logic over that one
if you apply your logic equally to the west and the middle east, then based on 9/11, the usa has every right to invade iraq. hell, based on 9/11, i as a westerner have a right to go to egypt and kill women and children. BASED ON YOUR RATIONALE it would be acceptable for me to go kill civilians in egypt because of 9/11. all of the rationale you use to say the usa deserved, or should have seen 9/11 coming applies equally to me going to egypt to commit mass murder because of 9/11. do you believe i am justified? of course you don't, and of course you would be wrong if you thought 9/11 justifies invading iraq
BUT THIS IS EXACTLY HOW YOU EXCUSE WHAT AL QAEDA DOES: the usa did (xyz) along time ago in the cold war in pursuit of goal (abc), where both (abc) and (xyz) HAVEN'T GOT ONE FUCKING THING TO DO WITH COMMITTING MASS MURDER ON CIVILIANS BY ANY LEAP OF LOGIC OR REASON
how the FUCK can you support that rationale and in ANY conceivable way consider yourself to be a proponent of peace, of having a human conscience, of having any intellectual or moral coherence? you're just a reflective partisan hater of the usa. you are intellectually and morally bankrupt. an empty signal. that's the beginning and ending of you. you're completely empty and bankrupt
i say fuck the usa. who cares about the usa, the usa does plenty of bad in the world. did you fucking hear me?
i repeat: FUCK THE USA
i do not need nationalism or ANYTHING PRO-USA to support my views of you and to shut you down. because my view is NOT PRO-USA. my view is ANTI-PREJUDICE.
listen to me closely you prejudicial ignorant fuck: if i am going to condone or excuse evil in this world FAR worse than whatever the usa has ever done in the name of hating the usa, then i have become utterly devoid of intelligence or morality or a human conscience
because the usa gave osama bin laden a stinger missile in 1982... means the usa should have seen 9/11 coming? wtf is wrong with you? seriously, your delusion is huge and almost impossible to understand
let me tell you the truth about your retarded worldview: the truth is you are ethnocentric and a racist.
you don't see people in the middle east as your equal. equality implies equal amount of human rights... and equal amount of human responsibilities
but that's now how you think of middle easterners. you think of them as children. in your eyes, when someone in the middle east does something wrong,
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
that you are not identifying: control versus freedom
all of the changes you propose are basically the wet dreams of authoritarian censoring oppressive governments everywhere
it is very much in the name of freedom to leave the internet devoid of such control... and an internet devoid of controls leads to this sort of anarchic bullying by shady forces
negatives with both approaches, pluses with both approaches
it all boils down to that familiar schism... control or freedom/ security or liberty: the ideological conflict of the 21st century
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
One person's "protest tool" is another's "terror attack". In this case I'd say the later because transfer of information was denied. If say, web pages were added to sites promoting a view I may consider it a "protest". By making sites inaccessible is no different than blowing up a bridge or building.
i should have qualified my statements. there are plenty of security versus liberty dichotomies which are actually false and are presented by demagogues. that being said, there are also some fundamental security versus liberty choices people need to make on a daily basis. and these choices are always being revisited in times when some people abuse their freedoms in order to inflict harm on others. the idea is to limit freedoms in limited ways for limited time periods at targetted systems/ individuals, such as with DDoS attacks as you aptly demonstrate, not blankly take away everyone's freedoms on the justification of one indiscretion by one malcontent
however, oppressive regimes do exactly that for exactly those reasons. so the dichotomy between freedom and security may be false, but the excusing of taking away freedoms in the name of security is done all the time and is very real nonetheless
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Should invading one's peaceful neighbours be opposed, or rewarded with trade deals?
a cyber-attack that criples South Korean internet during the launch week of StarCraft 2?
Yeah, scary.
//Nothing to see here, please move along.
For a moment there I thought the page title said 'The real impact of the Elbonian Cyberattack'. Glad thats cleared up!
*runs*
I get at least 2 average 3 attempts to root my system from all over the world. One odd thing is that Romanian reverse DNS lookups are just actively refused for this zombie 217.156.110.24. http://www.dnsstuff.com/tools/ptr.ch?%26ip%3D217.1 56.110.24
I know its either a compromised box of little importance, or some script kid. Best option along with denyhosts is uncommenting "PermitRootLogin no" in sshd_config.
Anyway, what is the motivation for tag.starnets.ro to refuse reverse lookup? No need to answer american queries? Firewalled off the evil americans? Hiding something?
Could conjecture all day on that. The bot that hit me next was from California 68.183.62.151. Apparently a DSL Extreme customer running an SSH server open to the public no less. Probably rooted by that very means. They really wanted the user "test" to work apparently.
Why isn't this kind of tresspass prosecutable, at least inside the US.
During WW2 Estonia was German ally. German SS and police units, with Estonian auxiliaries, massacred the Jews of Estonia and others. They established concentration camps where they burned and gunned down Latvians, Belarussians, Ukrainians,Russians and Jews. _These_days_ Estonian govermnent recognize Latvian waffen SS divisions as heroes and threaten to destroy monumets made to commemorate the victory over fascism.