The Russians Launch A New Weapon, Very Accurate, Causing Lots of Grief and Aggravation But At Least It Doesn’t Kill -- Welcome to Cyber War And Imagine What It Could Do To Your Favorite News Media Site

Philip Stone May 21, 2007

There’s a spat going on in northern Europe – between tiny Estonia and huge Mother Russia -- which the entire world should note with alarm for one of the weapons used is a very sophisticated attack on Estonia’s Internet infrastructure. It nearly crippled the country’s Internet infrastructure so just think what it could do to your favorite news media site if someone doesn’t like what it says and has the technical know-how to do something about it -- a direct attack on democracy itself!

Estonia is one of the most advanced cyber countries in the world – some 70% of the 1.3 million population have broadband, four out of five tax returns are filed via the Internet, and some 800,000 Estonians use Internet banking to pay most bills.  Disrupting a system like this disrupts daily life big-time.

It all started because this was moved

And according to its defense minister, Estonia was under attack for more than two weeks from about 1 million computers globally with the intention of bringing the country’s information infrastructure to its knees. Another form of terrorism?

Mikhel Temmet, chair of Estonia’s cyber-defense co-ordination committee, said the attacks were nothing less than terrorism. “The act of terrorism …suggests, to sow terror itself. If a highly IT country cannot carry out its everyday activities, like banking, it sows terror among the people.” The system used by Estonia’s President was down for six days at the beginning, and most cabinet ministries suffered similar fates. He said that the EU and NATO have to work together on how to defend themselves from such attacks.

The Estonians originally accused the Russian government but then backed off that, saying that while Russians are obviously involved there is no real proof the Russian government itself is behind it, even though they identified that the initial attacks came from Russian government offices.  No doubt Russian civil servants thought it a lark to bombard Estonia by sending so many Internet requests to various servers at one time. One ISP number was traced back allegedly to President Putin’s office.

The Russian government’s official line is “It’s not us”. Kremlin spokesman Dmitri Peskov called it "out of the question." Other Russian spokespeople basically say, “professional hackers might be using our IP addresses to spoil relations between Estonia and Russia."

Estonia’s first line of defense was to ban all traffic ending in the Russian. “ru”. But within three days the next stage began as the country came under attack from so-called botnets – home and business computers anywhere in the world remotely commanded by robots to attack. When bots first attacked Estonia it was done by around 1 million computers from locations ranging from the United States to China. And the only defense against that was to shut off Estonia from the rest of the world for a while.

Meanwhile Russian Websites were listing instructions for Russians on how they could send traffic to Estonia that would end up as a Distributed Denial of Service Attack (DDoS). And that they did, timed to begin at midnight Moscow time on May 9 – the anniversary of winning World War II -- sending some four million packets of data per second, every second for 24 hours.

The hackers also had some fun, for instance, adding a Hitler moustache on the picture of Prime Minister Andrus Ansip on his political party's Web site, but none of this was any joke to NATO or the European Union. The attacks were becoming far more sophisticated, aimed at shutting down the banking system and alike. This was not ordinary citizens at home doing their thing!

All of this came about from a spat between the two countries that still has not simmered. But whether it was the Russian government or whether it was just Russian nationalists, they have shown the power of the Internet in bringing a country’s information infrastructure creaking to a halt. The traffic was so heavy and specifically directed that those receiving servers basically said, “We can’t handle this load. I’m done.” And they fainted until revived. How strong an attack?  According to the Estonian Defense Ministry some government web sites that get around 1,000 visits a day were getting 2,000 visits every second!

In our own daily lives we each realize how much we depend on the Internet these days. Imagine it happening in a whole country so advanced in its web structure that such server failures can cause real aggravation, disruption of business, disruption of the government.

And yet it doesn’t really actually wound or kill anyone. Neat military weapon, no? It’s neat enough for NATO and the European Union to send experts to Estonia to trace what happened and try to figure out defenses for the future.

Europe’s history is full of little events that grow into big events and cause war, so one has to keep an eye on this spat to ensure things don’t get too out of hand, but to be fair to the Russians, they have some real cause to be angry with Estonia.

Anyone who has ever been to the Soviet Union, or to the Russia that followed it, knows full-well that the Russians pay great homage to their World War II war dead. Of the estimated 35 million people who lost their lives in World War II, some 18 million were Russian. So every territory Russia controlled after World War II saw Russian War memorials built in the middle of many towns to remind everyone of Mother Russia’s sacrifice in fighting the Nazi war machine.

And such was the case in Tallinn, Estonia. Without going into the history of the Baltic Republics it was a very uneasy occupation and in Estonia’s case in its 16 years of freedom since 1991 it has become a NATO and European Union member. But that Russian war memorial was still there in the middle of the capital reminding everyone of a past that, except for the ethnic Russians living in Estonia, everyone else really wanted to forget, and instead they wanted to look forward.

So April 27 the Estonians moved the Red Army war memorial – a bronze statue of a Russian soldier -- and the bodies of 12 unknown Russian soldiers buried beneath it -- to a war cemetery on the edge of town. And the Russians took great umbrage. Since then, trade has been disrupted -- most of Estonia’s trade with Russia is via rail and suddenly the Russians start track repairs that closes down the line, some officials called for a trade boycott, there have been demonstrations in front of the Estonian embassy in Moscow -- the relations between the two countries are as bad as they could diplomatically get, and in tandem the cyber attacks hit almost immediately and very effectively.

Are such cyber attacks a declaration of war? Apart from the fact that one has to prove a government’s involvement behind such attacks, is a cyber attack the same as a missile attack. Is it an act of war to try and bring down state infrastructure, banks, airports and the like?

For NATO, where an attack against one country is an attack against all, the situation is serious. It doesn’t take much imagination to think what could happen next as the effectiveness of the Estonian attacks becomes better known. Companies around the world could have their Internet communications brought to their knees by unscrupulous competitors, what if the Chinese really get mad at Taiwan, what if the major media sites in the democratic world suddenly were technically shutdown…the list goes on.

One estimate in the Estonian attack is that hackers may have infiltrated up to 25% of the world’s computers without their owner’s knowledge and making it next to impossible to determine where the attacks emanated. If nothing else, this should result in big bonus time for Internet security experts.

Those in the know say this is not the first time such attacks have come out of Russia. And US Deputy Secretary of State John Negroponte says that countries need to start working on defenses for such attacks, since, he believes, they will become more of an issue in the future.  

Which gives ever more reason why, when Microsoft and other trusted software vendors issue updates to protect against unscrupulous people taking over our computers that it’s a pretty good idea to install that update.

ftm Follow Up & Comments