Enforcing peace on the Internet

The war on the Internet was no less fierce than in real life

On August 8, after the start of hostilities on the territory of South Ossetia, several websites of the unrecognized republic were attacked. The main South Ossetian resources turned out to be inaccessible - they were overloaded as a result of DDoS attacks, which these days have become the most popular weapon of hackers “warring” in the Caucasus. The term “DDoS attack” (Distributed Denial of Service) means the use of a network of virus-infected (“zombified”) computers to generate constant requests to a web server in order to overload it and make it unavailable for visitors. A network of zombie computers is also called a “botnet.” From "bot", meaning "robot".

The second most popular technique - the creation of sites that imitate a resource under a different address with the aim of compromising it, was also widely used. But it would be reckless to consider it a manifestation of cyber warfare. It’s too primitive an action, from the arsenal of an information war, not a technological one. Let us note, taking this opportunity, that military propagandists generally rarely shine with an excess of intelligence. Especially those who conduct their propaganda on blogs for free, out of sheer love for the art of nationalist abuse.

At 13:00 on August 8, the website of the Osinform news agency went down, having managed to report that it was being attacked (if you believe the Osinform message of August 5, it was attacked even then, three days before the start of hostilities). The attack was also reported on the website of the State Committee for Information and Press of the Republic of South Ossetia. To unload the attacked site, an information resource tskhinval.ru was created, which published materials from journalists about the events taking place in South Ossetia. But he too was attacked by hackers. Successful, I must say. The website of Ossetian radio and television was also damaged, and was unavailable for an hour.

Following the South Ossetian sites, Georgian resources were attacked. On the evening of August 8, a collage of photographs of Adolf Hitler and Mikheil Saakashvili appeared on the main page of the Georgian Foreign Ministry. This could not be the result of a DDoS attack - the server was not overloaded, but hacked. After the attack, the Georgian Foreign Ministry announced that it was forced to start a blog on Blogspot.com instead of the official website, desecrated by portraits of the greatest war criminal.

The hackers also hacked the Georgia Online website located at apsny.ge (“Apsny” means “Abkhazia” in Abkhazian), attacked the website of the Novosti-Georgia agency and the website of Georgian President Mikheil Saakashvili president.gov.ge. The latter remained unavailable at the time this issue went to press. The Georgian online media civil.ge and Free Georgia were blocked.

According to the leading anti-virus expert at Kaspersky Lab, Vitaly Kamlyuk, the reason for the unavailability of the resources listed above was precisely DDoS attacks: “With regard to such sites as civil.ge, newsgeorgia.ru, president.gov.ge, there are no attempts to block access by Russian providers are not taking action."

Georgia, on the contrary, as stated by a representative of the Russian embassy in Tbilisi, has blocked access to the entire .ru zone on its territory since August 9. Later, on August 14, the head of the Russian Ministry of Telecom and Mass Communications, Igor Shchegolev, would sharply criticize this action, calling blocking access to the Internet “unacceptable.”

However, this was not the only blow to Runet. On the night of August 11, hackers managed to disable the RIA Novosti website and attack the website of the English-language TV channel Russia Today. The attack came from Georgian IP addresses, the Russia Today information security service said. If so, this cannot serve as evidence that the attack was organized specifically from the territory of Georgia due to the very nature of DDoS attacks.

At the same time, Russian opposition websites also suffered: kasparov.ru, namarsh.ru and rufront.ru. But Georgia can hardly be blamed for this. These resources, presumably, were considered hostile by those who side with Russia in the conflict.

According to Vitaly Kamlyuk, in order to successfully attack, for example, the RIA Novosti website, a botnet of 100 thousand computers is enough. “How much could this cost? Based on the fact that an attack from 15 thousand computers costs the customer, as we know, $100-$150 per day, we can assume a thousand dollars per day. However, I must warn you: we do not We specialize in this type of computer crime, so it makes sense for you to talk to other experts,” said Mr. Kamlyuk.

The expert recommended by Vitaly Kamlyuk preferred to remain anonymous and said the following: “It is unknown who is behind DDoS attacks on websites. They are successful because no one knows who organized them. Not a single investigation of DDoS attacks has been completed: traces, as a rule, lead to the territory of another country and are lost there. In this case, the attacks can be either the work of patriotic hackers, or ordered by third parties. Yes, this is a cyber war. It is being carried out by both partisan hackers and states. , which has experience in repelling DDoS attacks, has provided assistance in Georgia. Has the level of hacker activity increased since the events in Ossetia? No, it remains the same for us except for reports of an attack on a number of Russian online media. "There are groups of hackers unknown to us, or there were no attacks, and the servers simply could not cope with the sharply increased load due to reader interest."

Andrey Vorobyov, head of the public relations department at RU-Center, agrees with the opinion of the hacker expert: “In Russia, hacker actions like the current ones are considered criminal, and the perpetrators should be brought to justice. But Russian law enforcement agencies are unlikely to find the perpetrators of DDoS attacks will succeed. Most of the attackers are outside our country."

By now, “combat” operations in cyberspace, like a real war, can be considered almost completed.

Olga FEDINA, iToday.ru, - specially for Vremya Novostei