Jump to content

Cyberattacks during the Russo-Georgian War

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Citation bot (talk | contribs) at 12:56, 30 May 2023 (Alter: template type. Add: newspaper, magazine, authors 1-1. Removed parameters. Some additions/deletions were parameter name changes. | Use this bot. Report bugs. | Suggested by Abductive | #UCB_webform 3083/3844). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Russo-Georgian War
Main topics
Related topics
Georgia (country) Abkhazia South Ossetia Russia

During the Russo-Georgian War, a series of cyberattacks swamped and disabled websites of numerous South Ossetian, Georgian, Russian and Azerbaijani organisations. The attacks were initiated three weeks before the shooting war began.[1]

Attacks

On 20 July 2008, weeks before the Russian invasion of Georgia, "zombie" computers were already on the attack against Georgia.[2][3] The website of the Georgian president Mikheil Saakashvili was targeted, resulting in overloading the site. The traffic directed at the website included the phrase "win+love+in+Rusia". The site then was taken down for 24 hours.[4][5]

On 5 August 2008, the websites for OSInform News Agency and OSRadio were hacked. The OSinform website at osinform.ru kept its header and logo, but its content was replaced by the content of Alania TV website. Alania TV, a Georgian government supported television station aimed at audiences in South Ossetia, denied any involvement in the hacking of the rival news agency website. Dmitry Medoyev, the South Ossetian envoy to Moscow, claimed that Georgia was attempting to cover up the deaths of 29 Georgian servicemen during the flare-up on August 1 and 2.[6]

On 5 August, Baku–Tbilisi–Ceyhan pipeline was subject to a terrorist attack near Refahiye in Turkey, responsibility for which was originally taken by Kurdistan Workers' Party (PKK) but there is circumstantial evidence that it was instead a sophisticated computer attack on line's control and safety systems that led to increased pressure and explosion.[7]

According to Jart Armin, a researcher, many Georgian Internet servers were under external control since late 7 August 2008.[8] On 8 August, the DDoS attacks peaked and the defacements began.[9]

However, within hours the traffic was again diverted to Moscow-based servers.[8][10]

On 10 August 2008, RIA Novosti news agency's website was disabled for several hours by a series of Georgian counter-attacks.[11]

By 11 August 2008, the website of the Georgian president had been defaced and images comparing President Saakashvili to Adolf Hitler were posted. This was an example of cyber warfare combined with PSYOPs.[9] Georgian Parliament's site was also targeted.[9][8][12] Some Georgian commercial websites were also attacked.[10][8][12][13] The Ministry of Foreign Affairs set up a blog on Google's Blogger service as a temporary site. The Georgian President's site was moved to US servers.[9][12] The National Bank of Georgia’s Web site had been defaced at one point and 20th-century dictators' images and an image of Georgian president Saakashvili were placed.[2] The Georgian Parliament website was defaced by the "South Ossetia Hack Crew" and the content was replaced with images comparing President Saakashvili to Hitler.[12]

Estonia offered hosting for Georgian governmental website and cyberdefense advisors.[14][3] It was reported that the Russians bombed Georgia’s telecommunications infrastructure, including cell towers.[14] Private United States companies also assisted the Georgian government to protect its non-war making information such as the government payroll during the conflict.[15]

Russian hackers also attacked the servers of the Azerbaijani Day.Az news agency. The reason was Day.Az position in covering the Russian-Georgian conflict.[16] ANS.az, one of the leading news websites in Azerbaijan, was also attacked.[17] Russian intelligence services had also disabled the information websites of Georgia during the war.[16] The Georgian news site Civil Georgia switched their operations to one of Google's Blogspot domains.[14] Despite the cyber-attacks, Georgian journalists managed to report on the war. Many media professionals and citizen journalists set up blogs to report or comment on the war.[18][19][10]

Reporters Without Borders condemned the violations of online freedom of information since the outbreak of hostilities between Georgia and Russia. "The Internet has become a battleground in which information is the first victim," it said.[17]

The attacks involved Denial-of-service attacks.[12][17][2]

On 14 August 2008, it was reported that although a ceasefire reached, major Georgian servers were still down, hindering communication in Georgia.[19]

Analysis

The Russian government denied the allegations that it was behind the attacks, stating that it was possible that "individuals in Russia or elsewhere had taken it upon themselves to start the attacks".[2][20][21]

Dancho Danchev, a Bulgarian Internet security analyst claimed that the Russian attacks on Georgian websites used “all the success factors for total outsourcing of the bandwidth capacity and legal responsibility to the average Internet user.”[9]

Jose Nazario, security researcher for Arbor Networks, told CNET that he was seeing evidence that Georgia was responding to the cyber attacks, attacking at least one Moscow-based newspaper site.[22]

According to Don Jackson, director of threat intelligence at SecureWorks, this was lending credence to the idea that the Russian government was indeed behind the attack, rather than the RBN.[23] Furthermore, Jackson found that not all the computers that were attacking Georgian websites were on RBN servers, but also on "Internet addresses belonging to state-owned telecommunications companies in Russia".[23]

Gadi Evron, the former chief of Israel's Computer Emergency Response Team, believed the attacks on Georgian internet infrastructure resembled a cyber-riot, rather than cyber-warfare. Evron admitted the attacks could be "indirect Russian (military) action," but pointed out the attackers "could have attacked more strategic targets or eliminated the (Georgian Internet) infrastructure kinetically." Shadowserver registered six different botnets involved in the attacks, each controlled by a different command server.[24][25]

In March 2009, Security researchers from Greylogic concluded that Russia's GRU and the FSB were likely to have played a key role in co-coordinating and organizing the attacks. The Stopgeorgia.ru forum was a front for state-sponsored attacks.[26]

John Bumgarner, member of the United States Cyber Consequences Unit (US-CCU) did a research on the cyberattacks during the Russo-Georgian War. The report concluded that the cyber-attacks against Georgia launched by Russian hackers in 2008 demonstrated the need for international cooperation for security. The report stated that the organizers of the cyber-attacks were aware of Russia's military plans, but the attackers themselves were believed to have been civilians. Bumgarner’s research concluded that the first-wave of cyber-attacks launched against Georgian media sites were in line with tactics used in military operations.[27] "Most of the cyber-attack tools used in the campaign appear to have been written or customized to some degree specifically for the campaign against Georgia," the research stated.[28]

See also

References

  1. ^ Hollis, David (6 January 2011). "Cyberwar Case Study: Georgia 2008" (PDF). Small Wars Journal. Archived (PDF) from the original on 4 March 2022. Retrieved 17 November 2020.
  2. ^ a b c d Markoff, John (12 August 2008). "Before the Gunfire, Cyberattacks". The New York Times. Archived from the original on 30 March 2019. Retrieved 21 February 2017.
  3. ^ a b Wentworth, Travis (23 August 2008). "How Russia May Have Attacked Georgia's Internet". Newsweek. Archived from the original on 4 March 2022. Retrieved 3 May 2014.
  4. ^ Dancho Danchev (22 July 2008). "Georgia President's web site under DDoS attack from Russian hackers". ZDNet. Archived from the original on 5 March 2022. Retrieved 9 February 2015.
  5. ^ "Georgia president's Web site falls under DDOS attack". Computerworld. 21 July 2008. Archived from the original on 11 August 2016. Retrieved 9 February 2015.
  6. ^ "S.Ossetian News Sites Hacked". Civil Georgia. 5 August 2008. Archived from the original on 25 June 2017. Retrieved 25 January 2009.
  7. ^ Jordan Robertson; Michael Riley (10 December 2014). "Mysterious '08 Turkey Pipeline Blast Opened New Cyberwar Era". Bloomberg.com. Archived from the original on 2014-12-25. Retrieved 2017-03-06.
  8. ^ a b c d Keizer, Gregg (11 August 2008). "Cyberattacks knock out Georgia's Internet presence". Computerworld. Archived from the original on 3 May 2014. Retrieved 3 May 2014.
  9. ^ a b c d e Danchev, Dancho (11 August 2008). "Coordinated Russia vs Georgia cyber attack in progress". ZDNet. Archived from the original on 2 November 2014. Retrieved 4 May 2014.
  10. ^ a b c "Georgia: Russia 'conducting cyber war'". The Telegraph. 11 August 2008. Archived from the original on 4 March 2022. Retrieved 4 April 2018.
  11. ^ Woodcock, Bill (11 August 2008). "The digital frontlines in the Georgia conflict". The Takeaway. Public Radio International. The World. Archived from the original on 2022-04-01. Retrieved 2022-03-07.
  12. ^ a b c d e Asher Moses (12 August 2008). "Georgian websites forced offline in 'cyber war'". The Sydney Morning Herald. Archived from the original on 14 September 2008.
  13. ^ "Georgia says Russian hackers block govt websites". Reuters. 11 August 2008. Archived from the original on 24 January 2016. Retrieved 5 July 2021.
  14. ^ a b c Shachtman, Noah (11 August 2008). "Estonia, Google Help 'Cyberlocked' Georgia (Updated)". Wired. Archived from the original on 4 March 2022. Retrieved 6 March 2017.
  15. ^ Steven Korns and Joshua E. Kastenberg, Georgia's Cyber Left Hook, Parameters: Journal of the Army War College (2008), 59-64
  16. ^ a b "Russian intelligence services undertook large scale attack against Day.Az server". Today.az. 11 August 2008. Archived from the original on 4 March 2022. Retrieved 11 August 2008.
  17. ^ a b c "Russian and Georgian websites fall victim to a war being fought online as well as in the field". Reporters Without Borders. 13 August 2008. Archived from the original on 2014-07-14.
  18. ^ "Georgia: Regional Reporters". Global Voices. 24 August 2008. Archived from the original on 26 April 2015. Retrieved 27 September 2008.
  19. ^ a b "Longtime Battle Lines Are Recast In Russia and Georgia's Cyberwar". The Washington Post. 14 August 2008. Archived from the original on 13 March 2018. Retrieved 20 September 2017.
  20. ^ "Georgia States Computers Hit By Cyberattack". The Wall Street Journal. 12 August 2008. Archived from the original on 4 March 2022. Retrieved 3 August 2017.
  21. ^ "The hunt for Russia's web crims". The Age. 13 December 2007. Archived from the original on 14 September 2014. Retrieved 25 January 2009.
  22. ^ "Russia and Georgia continue attacks--online". CNET. 12 August 2008. Archived from the original on 4 March 2022. Retrieved 15 July 2014.
  23. ^ a b "Expert: Cyber-attacks on Georgia websites tied to mob, Russian government". LA Times Blogs - Technology. 2008-08-13. Archived from the original on 2022-03-04. Retrieved 2020-11-17.
  24. ^ "Unlikely That Russians Hacked Georgia Though Attacks Were Political | Cyber Talk Blog by Shimon Sheves". www.cybertalkblog.co.uk. Archived from the original on 2022-03-05. Retrieved 2017-04-16.
  25. ^ "Marching off to cyberwar". The Economist. 4 December 2008. Archived from the original on 6 May 2009.
  26. ^ Leyden, John (23 March 2009). "Russian spy agencies linked to Georgian cyber-attacks". The Register. Archived from the original on 1 October 2019. Retrieved 10 August 2017.
  27. ^ Brian Prince (18 August 2009). "Cyber-attacks on Georgia Show Need for International Cooperation, Report States". eWeek.
  28. ^ Mark Rutherford (18 August 2009). "Report: Russian mob aided cyberattacks on Georgia". CNET. Archived from the original on 22 August 2013. Retrieved 2 November 2011.
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Cyberattacks_during_the_Russo-Georgian_War&oldid=1157707394"