By Gadi Evron
August 13, 2008
In recent days, news and government websites in Georgia have suffered
DDoS attacks. While these attacks seem to indirectly affect the backbone
of the Georgian Internet, it is still there.
News reports popped up everywhere, along with supposedly informed
technical analysis, claiming anything from the Georgian Internet routes
being hijacked to Russia launching a cyber offensive, but with little
Let's try to understand what is really happening over there, and what it
* 1.) There are botnet attacks against Georgian websites.
* 2.) These attacks affect the Georgian Internet infrastructure
indirectly, due to the mass of traffic sent, but the Internet
is still very much there.
* 3.) Some Georgian websites have been defaced with political
* 4.) Unrelated, a media war is being fought.
Up to the Estonian war, such attacks would be called "hacker enthusiast
attacks" or "cyber terrorism" (of the weak sort). Nowadays any attack of
a political nature seems to get the "information warfare" tag. When 300
Lithuanian websites were defaced last month, "cyber war" was the
buzzword, even though it ended up being an internal Lithuanian matter.
Running security for the Israeli government Internet operation and later
founding the Israeli government CERT, I found that such attacks were
routine. Seeing the panicked reaction this type of attack has generated
seems quaint from my perspective.
Not all fighting is warfare. While Georgia is obviously under DDoS
attacks that are political in nature, it doesn't so far seem different
from any other online aftermath by fans. Political tensions are always
followed with online attacks by sympathizers.
DDoS attacks harm the Internet itself rather than just this or that
website, which often requires some of us in the vetted Internet security
operations community to get involved in mitigating the attacks, if they
don't just drop on their own. Our purpose is not to get involved in any
local situation, but rather to preserve our common global critical
infrastructure - the Internet.
Could this somehow be indirectly related to Russian military action?
Yes, but there is no evidence to indicate it is the case as of yet. If
anything, the opposite seems likely at this point in time.
Visit Defcon Pics - Defcon Memory Repository