DDoS attack on Georgia president website

ATTACK : DDoS attack on Georgia president website

By John Leyden

21st July 2008

http://www.theregister.co.uk/2008/07/21/georgia_presidential_site_ddos/

A denial of service attack hit government websites in the former Soviet republic of Georgia over the weekend amid growing diplomatic tensions between the country and Russia.

The DDoS assault on the website (http://www.president.gov.ge) of Georgian President Mikhail Saakashvili rendered it unavailable over the weekend. The attack was run via botnet networks of compromised PCs. Shadowserver charts the command and control servers used in the attack, in an analysis (http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20080720).

The identities of those behind the attack are unknown, but Jose Nazario, security analyst at security tools firm Arbor Networks, reports that some among the messages contained in the floods of spurious traffic (HTTP, SYN, ICMP) read "win+love+in+Rusia", indicating a possible political motive for the attack.

Communications between compromised clients and the command and control network coordinating the attack are taking place over encrypted SSL channels, as per security vendor PC Tools.

Tensions between Russia and Georgia have flared over Georgia's proposed membership of NATO. Over the weekend Russian warplanes flew over Georgia's rebel region of South Ossetia, in a show of military muscle.

Interest in tracking and preventing incidents of politically-motivated cyber attacks has risen up the political agenda since a sustained series of assaults took out the internet infrastructure of Estonia last year. Russian nationalists were blamed for those attacks amid dark mutterings from Estonian ministers that Moscow might be to blame. Such accusations have never been substantiated and only one arrest - of a locally-resident ethnic Russian - was made.