Russia and Georgia Engaged In a Cyberwar

doctorfaustus writes "I first picked this up in bits and pieces last week off Daily Rotation. A more in-depth story is available at ZDNet, which reports 'a week's worth of speculations around Russian Internet forums have finally materialized into a coordinated cyber attack against Georgia's Internet infrastructure. The attacks have already managed to compromise several government web sites, with continuing DDoS attacks against numerous other Georgian government sites, prompting the government to switch to hosting locations to the US, with Georgia's Ministry of Foreign Affairs undertaking a desperate step in order to disseminate real-time information by moving to a Blogspot account.' There is a question whether the computer work is being done by the Russian military or others. ZDNet's story offers further analysis of the attacks themselves and their origins. Some pretty good reporting." And reader redbu11 contributes the news that Georgia seems to be censoring access to all Russian websites, as confirmed by a Georgian looking glass/nslookup tool. The access is blocked on DNS level (Italy censored the Pirate Bay in the same way). Here are a couple of screenshots (in a language other than English) as of Aug 12th 5:40 pm: www.linux.ru nslookup — FAIL, www.cnn.com nslookup — OK.

ComputerWorld guy CWmike adds "In an intriguing cyberalliance, two Estonian computer experts are heading to Georgia to keep the country's networks running amid an intense military confrontation with Russia. Poland has lent space on its president's Web page for Georgia to post updates on its ongoing conflict with Russia. Estonia is also now hosting Georgia's Ministry of Foreign Affairs Web site."

Comments

Re:let it loose!

[Darkness404]

Wouldn't it be grey hat hacking?

A grey hat, in the hacking community, refers to a skilled hacker who sometimes acts legally, sometimes in good will, and sometimes not. They are a hybrid between white and black hat hackers. They usually do not hack for personal gain or have malicious intentions, but may or may not occasionally commit crimes during the course of their technological exploits.

A black hat hacker would hack the firewall in order to get credit card numbers.

NOT CYBER WAR, It's something else...

[davidsyes]

I've listened to NPR yesterday about this, and the best experts have been able to say so far is that it is cyber VANDALISM. No major infrastructure has been crashed. Hospitals and such have not been imploded.

There is even speculation that Georgians themselves crashed/trashed their OWN systems to exploit the current bad image Putin (yes, PUTIN is calling the shots, not Medvedev. Moreover, and ironically, a US-based outfit in, guess where... GEORGIA (yes, the state) offered and took on the hosting for the Georgian President's web site. Guess what? It wasn't working out. It was still being crashed/taken down. So, another party (seems to be Estonia) is helping out.

I really fracking wish some of these sensationalistic headers on Slash would get slashed.

http://www.npr.org/blogs/talk/2008/08/august_12th_show.html

Now, given that Putin/Medvedev claim Russian advances are immediately ceasing (purportedly) there really isn't "cyber warfare" going on, isn't there? If things continue, or escalate, THEN it might truly eclipse the bounds into "warfare".

Re:How much more of this until browsers adapt?

[Mr. Slippery]

Just like we can specify a URL like "http://username:password@www.somewhere.com/" can we come up with a way to specify a given virtualhostname at an IP address (say... "http://www.somesite.com>192.168.1.5/")?

Just put "192.168.1.5 www.somesite.com" in /etc/hosts, or whatever the Windows equivalent is.

Re:How much more of this until browsers adapt?

[SanityInAnarchy]

Just put "192.168.1.5 www.somesite.com" in /etc/hosts, or whatever the Windows equivalent is.

It's actually /etc/hosts, believe it or not.

Well, or something like C:\Windows\System32\etc\hosts. But the format is identical, save for maybe using \r\n instead of \n (and I'm not even sure about that).

Must be all that BSD code in the Windows IP stack.

Re:How much more of this until browsers adapt?

[scalarscience]

Actually it's Windows\System32\drivers\etc (the file is hosts without any extension). On Vista UAC may block your access to the file by default as well, the easiest way to get around this (aside from disabling UAC altogether) is to run your editor with elevated privileges.

Hear from the security team defending the website

[unity100]

here : http://www.webhostingtalk.com/showthread.php?t=714632 these are the people working at that atlanta web host, hosting georgian president's site from russian bastardiness. they havent had enough sleep in the few days but they made a fight of principle out of it.

Re:Poor Georgia...living under the Russian boot...

[shutdown -p now]

Russian troops have since then retreated from Georgian controlled territory back into Ossetia and Abkhazia. It seems that we have a ceasefire in effect now, for some time at least.