A Series of Russian Attacks against Georgia and Estonia (Cyber Warfare)

• Case Studies – 1 Estonia 2007 :

The Estonian government had, almost completely, a web-based infrastructure.

A statue of a Soviet soldier in the capital, Tallinn, was moved from the city center to a war cemetery.

The reaction from the Russian population (both in Russia and of Russian heritage living in Estonia) was a large-scale denial of service attack against most of the day to day government services, news sites, banking, and e-commerce.

A sovereign state was prevented from conducting its functions for two weeks. Estonia is part of NATO and called for support to fight off this attack.

NATO Cooperative Cyber Defence Centre of Excellence was formally established in May 2008 in Tallinn, Estonia, to enhance NATO’s Cyber defense capability. The international effort includes Estonia, Latvia, Lithuania, Germany, Hungary, Italy, Poland, Slovakia, Spain, and USA as Sponsoring Nations.

Published a paper on the subject in November 2008 entitled “Cyber Attacks Against Georgia: Legal lessons Identified.” discussing possible applicability of the Law of Armed Conflict (LOAC) to the cyber attacks that occurred in August 2008.

LOAC is also known as the International Humanitarian Law, relies on two primary rule groups : jus ad bellum (justice to war) and jus ad bello (justice in war), rules for how a country proceeds to a state of war and, for it conducts its war effort.

• Case Studies – 2 Georgia 2008 :

South Ossetia became de facto independent from Georgia in 1991 but remained part of Georgia, with peacekeeping force of Russian and Georgian forces.

In August 2008 Georgia moved forces into South Ossetia to suppress separatist activities. Russia counterattacked to protect South Ossetia citizens.

Before they attacked, Georgian networks were attacked :

• Web page defacements
• Denial of services attacks against government systems,
• Specific malware launched and
• Spamming email flood attacks.

Problems with traffic getting out of Georgia (communication pipes running through the enemy’s territory).

A well-coordinated effort run by a group out of Russia.

No clear evidence of state direction or sponsorship .

• Case Studies – 3 Georgia 2009 :

In 2009, one year after the invasion of Georgia by Russian troops, the Georgian blogger Cyxymu became the focal point of a series of DDoS attacks that would end up taking Twitter offline and hampering Facebook access, inconveniencing millions of users.

The DDoS attack consisted of a combination of email spam, a TCP-Syn

attack, and a HTTP-query DDoS attack:

• Email spam (called a “joe-job”) was sent by a 300-node botnet normally affiliated with sending out online casino spam.
• The TCP-Syn attack was sent by a 3,000-node botnet.
• An HTTP-query DDoS eats up a server’s resources by sending more hits than it can process to its website.

To date, none of the individuals responsible has been identified, There was a definite lack of chatter on Russian hacker forums about this incident unlike the Russia-Georgia cyber war of 2008—implying that this was more likely to be a locally orchestrated small group of individuals rather than the call to cyber arms that was seen previously. 

– Another Example of a CyberWarfare what happened between Google and China –>

• Case Studies – 4 Google 2009 :

Google announced they had been attacked by China (for information on dissidents and proprietary). Known as Operation Aurora.

Google threatened to pull out of China and stopped censoring search results .

Google shared information with the NSA and made it a national security matter

China, called by US Secretary of State, denied involvement.

It was a crime, but it heightened tensions between the two countries .

• Cyber War ?

So, has there been a cyber war ?

No country has declared a war or has openly stated they have come under a hostile act of war.

Some day, these acts may be considered acts of war

not everybody agrees that there is such a thing

 

Stuxnet Worm (Iranian centrifuge destroyer)

What the news says it was ??

– Iranian centrifuge destroyer

• It’s one goal was to destroy the Iranian nuclear  program

– Developed by the United States and Israel
– ‘Mission: Impossible’-like virus
– It will kill your unborn children

• Assuming they are born in a hospital using PLC (Programmable Logic Controllers
  ) machines

 

What it really was ??

– Malware that spread on networks to infect systems running WinCC
and PCS 7 SCADA
– Took advantage of the fact that PLCs are usually unsecured
– Once inside, had the ability to reprogram PLC controlling
machinery

• Gave the possibility of altering how machinery being controlled will run

– Self-replicates through removable drives exploiting a vulnerability allowing auto-
execution. Microsoft Windows Shortcut ‘LNK/PIF’ Files Automatic File Execution
Vulnerability
– Spreads in a LAN through a vulnerability in the Windows Print Spooler. Microsoft
Windows Print Spooler Service Remote Code Execution Vulnerability
– Spreads through SMB by exploiting the Microsoft Windows Server Service RPC
Handling Remote Code Execution Vulnerability
– Copies and executes itself on remote computers through network shares.
– Copies and executes itself on remote computers running a WinCC database
server.
– Copies itself into Step 7 projects in such a way that it automatically executes
when the Step 7 project is loaded.
– Updates itself through a peer-to-peer mechanism within a LAN.
– Exploits a total of four unpatched Microsoft vulnerabilities, two of which are
previously mentioned vulnerabilities for self-replication and the other two are
escalation of privilege vulnerabilities
– Contacts a command and control server that allows the hacker to
download and execute code, including updated versions.
– Contains a Windows rootkit that hide its binaries.
– Attempts to bypass security products.
– Fingerprints a specific industrial control system and modifies code on the
Siemens PLCs to potentially sabotage the system.
– Hides modified code on PLCs, essentially a rootkit for PLCs

Targeted Attack !!

The goal is not to blow up the centrifuge!
It will induce problems slowly, making sure that all sites get affected
before problems surface.
It holds the aggressive DEADFOOT condition only for short periods, and
then resumes undisturbed operation for periods of many days.

Results of the Stuxnet attack

In late 2009 or early 2010, Stuxnet destroyed
about 1,000 IR-1 centrifuges out of about 9,000
deployed at Natanz FEP
It rattled the Iranians, who were unlikely to know
what caused the breakage
It delayed the expected expansion of the plant
It consumed a limited supply of centrifuges to
replace those destroyed.