Slashdot Mirror
Expert Dissects Estonian Cyber-War
Stony Stevenson points out an iTnews summary of a security researcher's account of the cyber-attacks on Estonia last year. The full report [PDF] is also available. We've discussed this internet-based conflict in the past. From the report:
"In the days leading up to the attack, numerous clues pointed to a large-scale operation that was being planned online. Russian-language Internet discussion forums were abuzz with preparations for an online attack. Three days before the expected onslaught, Estonia planned to release the news of the coming strike in hopes that European media attention would oblige the EU to pressure the Kremlin to intervene, whether or not the attacks emanated from the Russian authorities."
And the mass media scores big again!
This talk at Defcon 15 was much better: http://video.google.com/videoplay?docid=-5362349666961901582
- Aetheral Research -
Cyber-War causes real conflict!
Estonia I can almost forgive, as they're relatively poor and didn't have much time to go from Soviet-era attitudes to something saner. They should still have done more. What bothers me much more is that the scorecards for US departments make it clear that the US is even less prepared for a cyberwar than even Balkan castoffs.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I'm sorry, but ... wait, no I'm not.
Gadi Evron, while undeniably prolific, is questionably informed. Take what he has to say with a grain of salt, and don't for a second believe there's anything more involved here than using well-known industry best-practices for evaluating vulnerable infrastructure and dealing with this type of traffic.
We now return to your regularly scheduled cross-post flame-fest between nanog and full-disclosure.
The Internet as it stands today is a consequences-free zone. Nations can't "do" anything about such attacks because there are no effective ways to conclusively track them back to individuals or even organizations. Even if there was, how much is some official going to do in China when handed a report of some kind of attack against some other country's computers?
As continuously pointed out, an IP address does not identify an individual. Today, with today's laws, unless you leave clear tracks to other forms of identification just having an IP address does not connect a deed with an individual. You can threaten, harass, and, yes, DDoS, with impunity. I don't see this changing anytime soon.
This pretty much means that any real online presence lives or dies by how much they draw attention to themselves and how motivated the attackers are. Estonia sounds like they were particularly vulnerable with little in the way of offline backup for basic services. This is not true in the US today, but it could easily be that way tomorrow. Could a group of disgruntled folks cripple government services in the US? Maybe. Given the current climate with laws, enforcement and international cooperation, there is no way that anyone outside the US would ever be prosecuted unless they bragged about what they did.
I remember how I was also enraged upon hearing about Estonian plans and yes, I wanted to join the resistance (or "cyber-war" as they called it immediately in the West). But a bit later when emotions calmed down I changed my mind, because it all was immature and not that effective anyway (and yes, reading about the events from Estonian POV helped me to get calm, too).
Let God/History/Nature/whatever be the judge for Estonians, not me. If they prefer Nazis over Soviets, so be it. They made their choice.
Coding etudes
Cyber attacks are dangerous (impact on Estonia described). The are too easy to organize (Russian blogs described). We need draconian laws to punish offenders. Russia (and other poorly governed countries) can't be relied upon to establish draconian laws. We must lead the way! (and probably force everyone else to follow).
I wonder when the "Usual suspects" in terms of global terrorism and splinter governments realize that this sort of warfare is much cheaper to run than what they are doing, and can cause just as much if not more harm to the target country.
Lets hope it's later rather than sooner.
Moved to http://soylentnews.org/. You are invited to join us too!
In Soviet Russia, riots cyber you!
...What bothers me much more is that the scorecards for US departments make it clear that the US is even less prepared for a cyberwar than even Balkan castoffs. Estonia a Balkan state? Where did you study your geography?
A government of a tiny country, that has no achievements other than supporting relatively comfortable life for its microscopic population on subsidies and investments, and acting as US agent in EU (aka member of "New Europe"), imagines itself important and invulnerable, and pisses off hundreds of millions of people.
An extremely small minority of the pissed off hundreds of millions performs otherwise meaningless juvenile prank, that multiplied by the number of participants causes visible problems.
What the Hell did Estonian government expect? That the strength of their self-righteousness, or their American overlords, will protect them?
Learn some international politics beyond "do what sugar daddy says, and everything will be fine".
Contrary to the popular belief, there indeed is no God.
motha nature, motha-in-laws, or mothafuckin Russian botnets
The issue here was how the Russian people of Estonia were disregarded when the monument was moved. The monument could have been moved by involving the Russian people, not simply uprooting it and moving it. Any culture would have taken deep offense at the way this was done. The move was meant as an offense, a way to show how Estonians feel about Russian Estonians. I think Estonia is lucky it was just a cyber attack.
Pauly Shore and his Encino Man will come to the rescue!!
shoooooshhh
*duck*
In this case, people generally eat better and live better, reducing the strain on their immune system by diseases. Instead of working with the health care industry, though, there has been an effort to marginalize it through these sorts of autism accusations. Thus, it is actually the health care industry that is in the same boat Ludd was in, NOT the mainstream individual, and their reaction is little different from Ludd's, opting for ethically unsound retaliation and paranoia.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Russian authorities do not encourage web attacks, they encourage anti-Estonian sentiments. According to the Russian media that is under government control, half of the world is our potential enemy - right now the focus is on Ukraine, so quite many people have already learned to hate our neighboring country. I have seen some Russian hacker boards - most (if not all) of the 'hackers' responsible for those attacks are brainwashed teenagers. I guess a DDoS attack on an Estonian web-server pleases their twisted patriotic feelings somehow - and it also doesn't take a lot of skill. So the government is not directly responsible for the attacks (what's the point of encouraging those attacks anyway?) but of course they are responsible via encouraging the anti-Estonian feelings.
The truth is that every little nation from the former Soviet Union wants their piece from big fat (still) Russia. As Georgia in Caucasus, Ukraine in Sebastopol so is Estonia. But... well no one wants anything with Estonia! It is a small weak country. So they try all kinds of provocations, some successful some not. The last one I remember is the fuss over the Bronze Soldier. Now they accusing Russia of cyberwar. Why am I not surprised at all?
Experts seem to ignore the social and political phenomenon that caused and motivated the upheaval in the first place, and prefer to view this as some kind of cyber war instead of what it really was: social unrest caused by Estonian discrimination of their Russian minority.
Anonymous is powerful when they are motivated.
If this was a cyber war, then so is the Anonymous crusade against the Church of Scientology. There is no real difference. An injustice is perceived and people become motivated to fix it through whatever activist means they have.
The funny part in this is the perseverance with which USA and US military specialists insist on it being a full scale cyber war attack, and the fault of Russian government, without any actual hard proof of it that I am aware of. Not to mention basic logic.
Of course, recent military cyber war budgets and "cyber war attacks by Russia" go well in hand, so it's more beneficial to view this incident as an organized Cyber War, instead of what it most likely was: a group of Anonymous, skillful, annoyed, activists in pursuit of social justice.
Racism and discrimination of Russians by the Estonian government should be a lesson to us all in treating minorities: Increasingly, the minorities can bite back with the help of Internet.
it wouldn't happen if Estonian goverment had some respect for its citizens with non-estonian ethnic origin. What they should expect from citizens(actually they even don't have that status) whom they don't respect? All the same in all baltic states. The national TV openly calls such citizens 'the 5th column', which IMHO is politically incorrect. :) Yeah, they are 'partners' of the greatest and justiest country in this world: THE UNITED STATES
How about lithuanian law(still in project status) that would grant double-citizenship only to emigrated citizens that are of lithuanian ethnic origin
A customer of mine (small college) reported issues with their (smallish) internet pipe one evening. Something appeared to be hogging a bunch of bandwidth.
Long story short, a sniffer revealed a huge amount of traffic coming from a particular student machine directed at an IP address ARIN showed as belonging to Estonia's government. We said huh, wierd and shut down his switch port and went to bed.
Of course we found out a little bit later about the attacks. I don't have the sniffer traces anymore.
opinionated nationalistic "gentleman" all he is...
http://blogs.securiteam.com/?p=481
worried about Pro-Palestinian Hackers vs. Pro-Israeli Hackers then China vs. Taiwan hackers,
now its estonia vs russia, he has minimum interest getting to the core of the issue, it looks like ethnicity is of much bigger interest to him...
you learned a little lesson on "correcting people"...