Hacker Attacks Preceded Fighting

14 August 2008

By Tai Adelaja / Staff Writer

Hackers knocked down Georgian government web sites days before Russian tanks
rolled into the country's territory, in what experts said Wednesday was an
ominous sign that cyber-attacks might foreshadow future armed conflicts.

Major Internet security firms reported massive attacks on Georgian web sites
by hackers using botnets, a network of "zombie" computers that can be used
to overwhelm servers with millions of unsolicited requests.

"Cyber-attacks are part of the information war," said Alexander Denezhkin,
editor of Cybersecurity.ru, an online journal. "Making your enemy shut up is
a potent weapon of modern warfare."

The so-called distributed-denial-of-service (DDoS) attacks began in the
weeks running up to the outbreak of the Russia-Georgia conflict and
continued after the Kremlin announced that it had ceased hostilities
Tuesday, said Tom Burling, an executive of Tulip Systems, a U.S. Internet
firm. Tulip Systems, which took over hosting of the web sites for Georgia's
presidency and a major television network on Saturday, said its experts had
worked frantically to curtail the damage from the hackers. "They have been
attacking Georgia from a cyber standpoint since July," Burling said, AFP
reported. "They are still doing it now. Our poor technician here has gotten
three hours sleep in the past four days."

Georgia has blamed Russia for the attacks.

Burling said Russia could be behind the attacks, which mirror attacks on
Estonian web sites amid a dispute between Moscow and Tallinn last year.

Access to the Georgian president's web site remain closed Wednesday, and
attempts to reach government officials by telephone for comment were
unsuccessful.

Shadowserver.org, a U.S.-based foundation that monitors network activities,
said it had no hard evidence to prove Russians were behind the attacks. The
organization said, however, that the HTTP-based botnet server responsible
for the attacks "is a MachBot controller, which is a tool that is frequently
used by Russian bot herders."

"On top of that, the domain involved with this C&C server has seemingly
bogus registration information but does tie back to Russia," it said in a
statement posted on the group's web site.

All the attacks so far have been launched and coordinated from a U.S.
segment of the web site, Shadowserver said.

Russian Internet security experts said the location of infested computers
was immaterial to an effective cybercampaign. "Infested computers could be
in the U.S. or Australia," Denezhkin said. "The crucial thing is existence
of a commander or coordinator who could signal when cyber-attacks should
begin."

http://www.themoscowtimes.com/article/1010/42/369790.htm