Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

SILENCING NOVAYA GAZETA AND OTHER RUSSIAN DISSIDENTS47was able to successfully defend them from a DDoS attack, whereas 55% stated that theirInternet connections were shut down instead. It is possible that smaller Internet providers,with a low profit margin, could view independent media and human rights groups as clientswhose political positions potentially lead to higher costs than profitable when it comes tomaintaining their Internet presence.The Harvard researchers also interviewed a dozen of the administrators of sites that hadexperienced cyber attacks. The interviews show that many assaults take on the form of hybridattacks, in which DDoS is paired with a different form of attack. For example, in the anonymoussurvey results of Zuckerman et al., according to one system administrator, a dissident organizationexperienced a DDoS attack followed by an attempted extortion in which he was pressedto retract a particular story (according to the system administrator, the organization refused tocomply). Another interviewee reported the occurrence of not only high-volume multigigabitDDoS assaults but also the harassment of individual users of the site, on which additionallyinflammatory information was posted in an effort to trigger government persecution. Anotheradministrator reported a creative style of denial of service, where the attacker had hacked intothe system and modified the Web site to display fake antivirus messages to the users in anattempt to scare them from accessing the site. These fake antivirus messages also containedlinks that initiated the download of malware that conceivably might have comprised Trojansallowing the attacker access to the visiting individual’s computer systems as well. 4The interviews by the Harvard researchers also showed that the site administrators hada strong belief that their national government was ultimately responsible for the attacks.However, none of those interviewed had any clear evidence indicating that this was the case.Despite the lack of evidence, there are some interesting indicators that their suppositionswere right. For instance, an interviewee from Vietnam pointed out a press report of aVietnamese military official claiming responsibility for the attack. Another Vietnameseadministrator reported that his national government often filtered his site, but lifted thismeasure to constrain traffic just in time for a major DDoS attack to hit the site. He claimedthat the assault was later attributed to a botnet. An Iranian administrator reported that aDDoS attack against his Web site was traced back to a site hosting the official governmentnewspaper. It appeared that third-party visitors of the newspaper Web site inadvertentlytriggered a Javascript (computer code embedded as a part of a Web page) that flooded theopposition group’s Web presence with requests and eventually shut it down. 5The small size of providers catering to dissident groups and independent media makethem particularly vulnerable to DDoS attacks. A cyber-capable government or its skillful supporterscan easily take a dissident site offline for a week or more at a time. In the remainderof this chapter, we describe specific case studies of cyber attacks targeting dissident groups,particularly in Russia and Iran.SILENCING NOVAYA GAZETA AND OTHER RUSSIAN DISSIDENTSNovaya Gazeta b is a Russian newspaper known for its investigations into official corruption,human rights abuses, and illicit government affairs. 6 One of its most prominent staff membersb An English-language version of the medium is available under http://en.novayagazeta.ru/.