Hackers tried to block Yandex using a vulnerability in the Roskomnadzor registry

A few days ago, hackers tried to block Yandex and a number of other major Internet services, RBC found out , which itself came under attack. The technology they used was based on a vulnerability in the Roskomnadzor website blocking system. It was also used in the largest cyber attack on Russian banks in 2017 - but, as it turned out, the vulnerability has not yet been eliminated. The dates of the attacks coincided with a rally against the isolation of the Runet and a closed meeting in the Federation Council on the draft law on the sovereign Runet.

More. Internet services have been subjected to so-called DNS attacks based on a vulnerability in the site blocking system in Russia, which is supervised by Roskomnadzor, writes RBC. Hackers take from the list domains included in the register of sites banned by Roskomnadzor and associate them with the IP addresses of other sites - this leads to their blocking. Representatives of Yandex noted that they repelled the attack for several days.

The main reason why hackers failed to block websites was that after similar attacks on banks in 2017, large operators invested in expensive intelligent DPI content blocking systems that pass through and analyze all incoming traffic, but at the same time slow down the speed of user access to information.

• It is unclear who was behind the network attacks. Several interlocutors of RBC immediately drew attention to the fact that the dates of the attacks coincided with the March 10 rally against the isolation of Runet and the closed discussion of the law on sovereign Runet in the Federation Council.
• Internet industry representatives say that a registry of banned sites has long been available for purchase. “Domain names that have been included in the register of banned sites of Roskomnadzor can be easily bought on the dark web, in particular, just for conducting DNS attacks. They cost practically nothing, since they are useless for some other purposes, and their number is practically inexhaustible, ”Alexander Lyamin, CEO of Qrator Labs, told RBC.
• RBC sources among major telecom operators claim that the attack was aimed at some media.

Context. The largest similar attack occurred in June 2017 - hackers periodically blocked access to the websites of large Russian banks for several days. Since then, Roskomnadzor has not been able to solve the problem: according to a Yandex representative, the only protection tool developed by Roskomnadzor was a proposal to create "white lists" - a list of sites that under no circumstances should be blocked. This is correct, but not enough: now telecom operators are not required to take these lists into account when blocking.

Interlocutors of RBC also said that at a closed meeting held in the Federation Council, telecom operators and representatives of Internet companies used past network attacks as evidence of the insolvency of Roskomnadzor: the authors of the draft law on sovereign Runet, in case of critical situations, propose to transfer the authority to manage the Russian segment of the Internet to this particular service .

Anna Kovalenko