Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

16 2. POLITICAL CYBER ATTACK COMES OF AGE IN 2007determined as far as the computer that ran the denial of service program, where that computeris identified by its IP address.If messages can be sourced accurately, they could be part of a botnet that has been rentedfrom its original owner for the attack. For example, a person sitting in St. Petersburg cancommand a computer that is in France to carry out a denial of service attack against anothercomputer in Estonia.If the attack is grassroots and generated by posting inflammatory messages on Web sites,the attribution of the attack hinges on accurately identifying the author of the messages. Thisidentification can often be impossible, as described in Chapter 1.Identifying the true source of a Web site defacement attack is as difficult as correctly identifyingthe author of a public blog or forum post. Web site defacements usually arise fromvulnerabilities in Web sites or the servers that host them. Attackers can use co-opted proxyservers (systems that exist solely to relay application level traffic) or open proxy servers onthe Internet to mask the source of their attack. Other uses of proxy servers are discussedin Chapter 5.Sometimes an attacker will ransom the target of the denial of service attack. The target willreceive a communication claiming responsibility for an ongoing or very near future attackand ask for payment to stop the attack. In these instances, attribution is at least a little easier,as the blackmailer will probably be very closely tied to the attack.ESTONIA IS HIT BY CYBER ATTACKSOn April 27, 2007, the Estonian government completed long-running plans to relocate anational monument. This monument was originally installed by the USSR in 1944 to honorSoviet soldiers who died during the Second World War. The government’s plan to movethe monument was opposed by the ethnic Russian population of Estonia. The relocation ofthe monument triggered a wave of protest both in Tallinn and on the networks of Estonia thatwould last until May 18 (Figure 2.1).The ethnic Russian population of Estonia, who views the monument as a symbol of Russiansacrifice and victory in its fight against Nazi Germany, 11 took to the street in protest of thestatues relocation. b There were violent altercations between security forces and rioters thatlasted for days. At the beginning of the protests on April 27, a post was made to an Internetforum that gave instructions for participating in a distributed denial of service attack againstEstonian government systems.By April 29, the riots in the streets of Tallinn had been calmed. On the Internet, a multifacetedcampaign of denial and disruption was under away against Estonia’s electronic infrastructure.Inspired and directed by posts on the Internet, thousands of users in Russiasimultaneously transmitted network packets at Estonian computer systems. The attacks camein four major forms: grassroots network packet flood, rented network packet flood, Web sitedefacement, and junk e-mail.b In contrast, the majority of ethnic Estonians interprets the monument as a symbol of Russian occupationwhich merely replaced the oppressive Nazi-regime, emplaced in 1939 when Stalin and Hitler divided Europewith the Molotov-Ribbentrop Act. 12