All measures have been taken to protect the Kremlin website from attacks by hackers, presidential press secretary Dmitry Peskov told Interfax. The head of the group of security consultants at Check Point Russia, Anton Razumov, discussed the situation with the presenter Alexey Korneev.

Photo: Alexander Miridonov, Kommersant / buy photo

On Friday morning, the website of the head of state was subjected to a powerful cyber attack. According to Peskov, attacks partially continue to this day. At the same time, Vladimir Putin’s press secretary noted that it is useless to investigate what is happening; most likely, the attack is not being carried out from Russian territory. Over the past two days, the websites of Channel One, Lenta.ru, VGTRK and the Central Bank have also been attacked by hackers.

— Is it generally possible to determine from what territory the attack is being launched? Because some media specifically name Ukraine, is it possible to determine this somehow?

— The fact is that the attack is distributed, “denial of service” means that in fact requests come from a huge number of different places at the same time. And it doesn’t really matter where the attack itself comes from, it can come from different parts of the world, what matters is who is its customer, its organizer. And it’s not realistic to identify the customer so quickly. It was clearly prepared, and for this they use other people's computers, which may have been hacked in advance or with certain vulnerabilities.

— On Twitter, one hacker group constantly threatens Russian companies, including state-owned ones, and all this, naturally, is associated with Ukraine, but what kind of instrument of influence are these, hacker attacks, do they really cause a lot of harm?

— There are different types of hacker attacks, some are aimed at directly making a profit, for example, the withdrawal of some funds, and some are based more on exerting political pressure on reputational risks. Because, obviously, if such important sites as the Kremlin site, many publications lie, do not respond for a long time, these are significant reputational risks.

— The attacks became known in the morning, they are still ongoing, however, apparently, the website of the Russian President has already started operating. Is it even easy to hack the Kremlin’s website, the website of the President and other similar reputable resources, given their solid protection?

— In this case we are not talking about hacking as such. Imagine that at the same time, for example, 1 thousand users access some service, and this service works great, responds, everyone sees its pages, everything opens. But at some point, instead of 1 thousand users, 1 million simultaneously start accessing it. At the same time, its computing resources are no longer enough, and although these million users are specially formed for the wrong requests, not entirely correct requests, nevertheless, legitimate users who would really like to receive the necessary information - there are simply no resources left for them. That is, the resource itself is not hacked, it continues to work, but becomes inaccessible.

— This doesn’t mean that 1 million users are involved in the attack?

- This could mean exactly that. Another thing is that these may not necessarily be users. For example, there are attacks that use blogs on the WordPress engine - this is probably the most popular platform in the world, which hosts many systems, many servers and, if configured incorrectly, can be forced to attack a specific resource, as in in this case.

— Is a hacker attack an expensive business in general? Surely it has some value.

- Yes, it has a certain cost, but, in fact, the cost, for example, of $500 is not unaffordable when you want to make so much noise. In addition, there is one more feature that is often forgotten: under the guise of a DDoS attack, when all the efforts of information security employees are aimed precisely at eliminating this cause and restoring the functionality of the site, under this hype, when forces are diverted, they may actually try to attack website to hack it. That is, this is the use of a DDoS attack as a cover for some more serious attack, which will actually be associated with hacking.

— That is, there is no effective means of protecting against DDoS attacks today, and any website, even the most secure, can be subject to such an attack?

“It’s really true that anyone can be subjected to it.” Protection methods exist - this could be a so-called DDoS protector installed directly at the customer’s site, that is, a protection system against DDoS attacks. But, unfortunately, with very powerful attacks, the communication channel between this server and the Internet may overflow. That is, maybe the server would be happy to respond, maybe the device is protected by a DDoS protector, but the channel itself is overloaded, so the response to users will be slower.

“These are significant reputational risks.”