Dead LJ

"Dead Journal." For the past one and a half weeks, the most popular Runet platform - Livejournal - is subjected to massive cyber attacks. The most serious of them were March 30 and April 4, although on other days access to the Live Journal was difficult for many users. In a few hours, instead of the usual 50 thousand, LJ appeals receives more than a million requests from non -existent users. They are directed from tens of thousands of computers from Southeast Asia. What kind of threat it is and who is interested in attacking the world of blogs - The New Times understood

“Today, for money on the Internet, you can shut your mouth to anyone,” says Dmitry Melnikov, Colonel of the FSB. Until August 2010, Melnikov served as an adviser to the head of the Federal Agency for Information Technologies and claims that special services are not standing at the attack on a “live magazine”: “One thing I can say: the special services of the cyber attack on LJ did not manage for sure. DDOS ATAKA is too banal. Not our level. Here cryptographically protected traffic is serious. At one time, on behalf of the President, we, in the academic plan, destroyed computer networks of the Central Bank. It was creatively interesting, the bankers were in shock, and DDOS was for a punks. ”
However, the fact remains: which the “Living Journal” is experiencing the largest attack in its history in a row, no one seems to be in the political background of what is happening, and only one question remains: who specifically exercises this virtual looting and by whose order.
A target for attack
DDOS attacks are not first used in Russia as a means of political struggle. True, usually their victims were servers and networks of state institutions or government organizations (as the government sites of Georgia and Estonia attacked, for example, during the Ossetian War and the conflict around the transfer of a bronze soldier in Tallinn). Remember LJ users and attacks on blogs of individual opposition activists and independent journalists, the epidemic of which occurred in 2008-2009. But no one has yet decided to attack the entire social network. The impetus for such an experiment could well be a Facebook revolution in the Middle East and North Africa, where it was through social networks that the manifestants coordinated their actions and pierced the walls of information blockade built by the regimes. In Russia, Facebook remains a place for a narrow intellectual party. Special services learn to fight with twitter activists who distributed information about an important event using a single hashtag. Now special services are able to score such streams with senseless spam, disarming Twitter. The Living Journal remained in this regard the most promoted and popular site. But for the time being, he had no danger: he had their own associations of liberals, loyalists, nationalists, narrowly segmented and almost not intersecting with each other. However, the experience of lawyer Alexei Navalny, uniting under the idea of ​​combating corruption of representatives of various political forces showed that LJ is quite capable of playing the role of the very coordinator and organizer that the Lenin Iscra played at one time. Judging by the attempts to destroy LJ, those in power decided to extinguish this “spark” preventively, a year before the elections, and prevent it from flaming into the flame. "

We prefer to help operational units working directly with hackers controlled by them, but we will not engage in computer attacks ourselves

"According to the representatives of the SUP company, which manages the" living magazine ", the attacks were aimed at manipulating the audience of the service and its destruction as a discussion site. The expert of the company to create antivirus programs" Kaspersky Laboratory "Maria Garnaeva describes the addressing of cyber attacks on the LJ:“ Analysis of the monitoring data showed that the first DDOS ATAK was on the LID. The owners of the Botneta were carried out on an attack on the blog of Alexei Navalny: http://navalny.livejournal.com. The service was recognized only on April 4th, the bots received an impressive list that includes blogs of many popular users of this service. To more serious problems, ”said Ilya Dronov, Director of SUP products. -It was aimed exclusively at the refusal of the channel and network equipment and was a litter of the latter with bat TCP connections. This time, not only the magazine of Alexei Navalny was put on the attack, but also the first five blogs, according to the Yandex.blogi service. “Thus, it can be safely argued that the attack was directed directly to the service itself, without any personal preferences from the attackers,” Dronov summarizes. “Someone really wants LJ to cease to exist as a platform.”
Who is the customer?
Alexei Navalny claims: “I have no doubt that the attacks of the Kremlin administration, which oversees domestic policy, are behind the attack. Realizing that all their Putinsky line development strategies crashed on the Internet, despite the huge monetary investments, they decided to deal with the most problematic sites for them in a simpler (and, as it seems, effective) way. ” Blogger Anton Nosik agrees with him: “If you recall the history of non -economic DDOSs in the runet of the last five -year, then the deductive skills of Sherlock Holmes will not be required to understand in the service of which political forces are domestic cyberhopers. Judge for yourself: Estonian sites, Georgian sites, blogs and NBP communities, Kommersant servers, Gazeta.ru, Cyxymu accounts on Facebook and Twitter, LJ Navalny. Why today they needed to blame the entire LJ, I think it is also easy to guess. Alas, if I am right, then it was only a rehearsal. ” As a possible performer of cyber attacks, Nosik called the movement “ours”, recalling that the movement had already taken responsibility for the DDOS attacks: in organizing an attack on Estonian government servers, Konstantin Goloskokov, Commissar Goloskokov, publicly admitted in an interview with the Financial Times. The involvement of “ours” in the attacks on the servers of Kommersant and Gazeta.ru was expressed in the open print by the then chief of the newspaper Andrei Vasiliev, and its current general director Demyan Kudryavtsev.
The famous blogger Vladimir Poblovsky also believes that the current attacks on LJ are test attacks that are made to work out the mechanism of disconnection of blogs in case of public unrest after the elections.
The role of special services
Prochrevsky movements, which declared their involvement in cyber attacks on Estonian sites, work in full contact with the special services of Russia (see The New Times No. 12 of April 4, 2011). So the question of the possible role of the special technical units of the FSB and the “K” management of the Ministry of Internal Affairs in the attack on the LJ servers still remains open. Opposition politician Vladimir Ryzhkov notes: “The special services have repeatedly demonstrated that they are able to block whole large sections of the Internet. An example that crashed into my memory is the events in Beslan in September 2004, when it was actually impossible to find links to the word “Beslan” for three days in any search engine. The impression was that those three days, while these tragic events continued, Runet was tightly controlled. I was told that for many years there has been a special unit on the Internet control in Lubyanka, which can solve any problems, including blocking sites, social networks, hacking and reading electronic messages. It seems to me that, given the huge role that social networks played in Egypt, Tunisia and Iran, now almost all the main authoritarian countries of the world are making efforts to control the Internet. It is possible that we simply observe field exercises with an sight to the December elections to the State Duma and the March presidential election in Russia. It is possible that technologies are being worked out before our eyes, when all the main social networks will be blocked at the right time in order to stop the dissemination of information or self -organization of people and the organization of protest actions. ”
The senior officer of the FSB information protection unit Roman K., on the terms of anonymity, agreed to comment on the version of Ryzhkov for The New Times, notes: “Computer attacks are not our profile. Moreover, everything that is done on the Internet by only professionals can be monitored by other professionals. Therefore, we prefer not to monitor, but to monitor and help operational units working directly with hackers controlled by it. We can conduct “reconnaissance”, identify the most vulnerable elements of the attacked resources, “improve qualifications”, but we will never engage in computer attacks ourselves. For this, there are a huge number of programs in the public domain, both free and commercial. Another thing is if the task is to bring the Internet in the context of the introduction of an emergency will be officially set for us, then this task for us is fulfilled. Although not completely: the satellite part of the traffic, supported by servers that are not controlled from the territory of Russia, is inaccessible to us. ”

How to do it
The technology used against LJ allows cybercriminals to remotely control infected machines - each separately, part of the computers included on the network, or the entire network entirely - without the user's knowledge. Such programs are called bots. Botnets have powerful computing resources, are a formidable cyber weapon and a good way to make money for attackers. At the same time, the owner of Botnet can manage the infected machines that are included in the network from anywhere: from another city, country or even from another continent, and can do this anonymously. The owner of the infected machine, as a rule, does not even suspect that it is used by attackers. Therefore, computers infected with the bout program under the control of cybercriminals are also called zombies-computers, and the network that they enter is a zombie network. The zombie networks are widely used for conducting DDOS attacks (Distributed Denial of Service-a distributed attack like “Refusal for maintenance”). In the course of such an attack with a boot infected with a bot, a stream of false requests is created for an attacked server on the network. As a result, the server due to overload becomes inaccessible to users. One of the options for illegal earnings using botnets is based on leasing or selling a finished network. The creation of botnets for sale is a separate area of ​​cybercrime business.