First Strike?: Russia Unleashed Cyber Attack On Georgia.

Editor's note: Here's an interesting article about a cyber-attack launched on select Georgian (government) websites, possibly the first indicator that Russia was going to go to war against Georgia. In future conflicts the precursor to armed conflict will not be a bomb being dropped on a city, or tanks massing at the border, but will be instead most likely be an attack by government/military sponsored hackers.

Georgia President’s web site under DDoS attack from Russian hackers
Originally posted on July 22nd by Dancho Danchev on : http://blogs.zdnet.com

From Russia with (political) love? It appears so according to a deeper analysis of the command and control servers used by the attackers. During the weekend, Georgia President’s web site was under a distributed denial of service attack which managed to take it offline for a couple of hours. The event took place in a moment of real life tensions between Russia and Georgia, with Russia clearly demonstrating its position against Georgia’s pro-Western government. Shadowserver’s comments, which originally picked up the attack first :

“For over 24 hours the website of President Mikhail Saakashvili of Georgia (www.president.gov.ge) has been rendered unavailable due to a multi-pronged distributed denial of service (DDoS) attack. The site began coming under attack very early Saturday morning (Georgian time). Shadowserver has observed at least one web-based command and control (C&C) server taking aim at the website hitting it with a variety of simultaneous attacks. The C&C server has instructed its bots to attack the website with TCP, ICMP, and HTTP floods. Commands seen so far are:

flood http www.president.gov.ge/
flood tcp www.president.gov.ge
flood icmp www.president.gov.ge

The server [62.168.168.9] which houses the website has been largely offline since the attack started. Passive DNS records show the system houses several other websites which are mostly unrelated to the Georgian government. However, the server does also host the Social Assistance and Employment State Agency website (www.saesa.gov.ge). This website along with the others on the host have been rendered inaccessible.

We do not have any solid proof that the people behind this C&C server are Russian. However, the HTTP-based botnet C&C server is a MachBot controller, which is a tool that is frequently used by Russian bot herders. On top of that the domain involved with this C&C server has seemingly bogus registration information but does tie back to Russia. “

Russia’s most recent cyber attacks successfully attacking Estonia, Lithuania and now Georgia, all share a common motivation despite that these attacks are executed from different parties, with Estonia still remaining the only coordinated attempt to attack a country’s Internet infrastructure next to Lithuania and Georgia’s lone gunman attacks.

The DDoS against Georgia President’s web site appears to be using a well known Russian malware variant from the Pinch family — whose authors got arrested after operating for several years online in 2007 — next to a command and control bot ( MachBot controller) primarily known to be popular in Eastern Europe, and including messages in the flood packets like “win+love+in+Rusia”, speak for itself. It’s also interesting that despite that they’ve dedicated a new command and control server to be used specifically for this DDoS attack, one that haven’t been seen in any third-party attacks, they made a small mistake further confirming the attacks has been launched by well known Russian botnet masters. Their mistake? Having the malware phone back to a well-known command and control seen in a great number of previous attacks, sharing DNS servers with a provider of DDoS attacks on demand, which despite announcing on its site that is no longer in business, continues offering botnets for rent services.

Russia’s politically motivated, or perhaps politically tolerated attacks, are all the result of Russia’s IT underground self-mobilization, feeling obliged to sent out a signal that they’re in fact actively participating in the political life and monitoring everything. Moreover, nationalistic articles in Russian newspapers often further fuel the tensions and literally seek involvement from Russian hackers, so even when they speculate about non-existent hacker discussions on coordinated attacks against a particular country, such discussions actually start taking place and the result has been pretty evident ever since.

The Real Reason Russia Is In Georgia?

BP shuts pipelines on fears over Georgia
By Isabel Gorst in Moscow
Published: August 12 2008 13:03 | Last updated: August 12 2008 13:03
BP shut down a pipeline carrying Caspian oil from Azerbaijan to the Georgian Sea on Tuesday citing concern about security in Georgia.

Toby Odone, a BP spokesman, said the 150,000 barrels a day pipeline from Baku to Supsa on the Georgian Black Sea had been closed as a “security precaution.”

A natural gas pipeline linking a BP-operated field offshore Azerbaijan with Georgia and Turkey has also been closed.

Exports through the Baku-Tbilisi-Ceyhan pipeline to the Turkish Mediterranean, the main artery for exports from BP’s huge Azeri field offshore Azerbaijan, halted last week after an explosion on the Turkish section of the pipeline. The pipeline carries 850,000 barrels a day

Kurdish separatists have claimed responsibility for the accident in Turkey.

Mr Odone said a fire at the site was extinguished on Monday, but the area was still “too hot” for repair work to begin and it was unclear when deliveries to the Ceyhan would recommence.

Mr Odone said “very small volumes of Azeri oil, less than 100,000 barrels a day,” are now being exported via railways across the Caucasus and a pipeline to Russia.

Mr Odone said BP was unaware of any attacks on oil and gas pipelines in Georgia despite Georgian claims that Russian warplanes had bombed the pipelines.

“We always knew the region was unstable and we will just have to wait and see what happens,” he said

Lado Gurgenidze, the Georgian prime minister, told the FT on Tuesday, that Georgian railways and oil ports and Black Sea ports were in working order.

Karim Massimov, the prime minister of Kazakhstan, said “no harmful action had been taken at Batumi” , a Georgian port owned by KazMunaigas, the Kazakh state oil company. However, Mr Massimov ordered a halt to exports across the Caucasus to Batumi on Monday.

The International Energy Agency warned on Tuesday that the conflict in Georgia threatens the strategic energy export corridor linking the Caspian and central Asia with western oil and gas markets.

“Recent escalation in the military engagement between Russia and Georgia poses a threat to certain key oil and gas pipelines which transit Georgia, the IEA said in a report issued shortly before Russia declared a ceasefire in Georgia.

The pipelines, built by foreign consortia with strong political backing from the US, have eased Russia’s stranglehold over oil and gas exports from the landlocked Caspian region

Is Georgia on George's Mind? USAF to fly supplies into war-torn Tbillsi.

U.S. to fly supplies into war-torn Georgia
By Michael Hoffman - Staff writer Air Force Times
Posted : Tuesday Aug 12, 2008 18:50:29 EDT

Air Force officials are putting plans together to fly supplies into Georgia following Russian President Dmitri Medvedev’s order to end all military operations in the former Soviet state.

Air Force C-17s flew all of Georgia’s 2,000 troops deployed in Iraq to the Georgian capital, Tbilisi, on Sunday and Monday after the Georgian government recalled the troops and asked the U.S. to do so.

Pentagon officials are not releasing when or where the cargo aircraft will disembark or whether the supplies are humanitarian or military at this time due to security issues, according to Lt. Col. Elizabeth Hibner, a Defense Department spokeswoman.

“We will hopefully be able to say more this afternoon,” she said.

Russian Prime Minister Vladimir Putin criticized the U.S. for flying Georgia’s troops home from Iraq while Russia’s troops advanced into the country after fighting broke out over the disputed regions of South Ossetia and Abkhazia.

“It’s a pity that some of our partners, instead of helping, are in fact trying to get in the way,” said Putin at a Russian Cabinet meeting. “I mean, among other things, the United States airlifting Georgia’s military contingent from Iraq effectively into the conflict zone.”

Despite Medvedev’s call for a halt to military operations, the Georgian government has reported more attacks including air strikes against two Georgian villages

UAV Crashes at USAF Academy?

Editors note: Who needs to scope out Area 51 when they are flying UAVs over the Air Force Academy.

-Steve Douglass

UAV crashes into light pole at academy
By Bruce Rolfsen - Staff writer Air Force Times

Posted : Tuesday Aug 12, 2008 16:12:43 EDT
The crash of unmanned plane at the Air Force Academy is under investigation by the National Transportation Safety Board.

The 9-foot-long plane, an experimental Raytheon Cobra, flew into a light pole July 28 as Raytheon Co. officials demonstrated the plane to academy staffers, according to the NTSB. No one on the ground was injured.

The propeller-drive Cobra took off from a road near the academy’s athletic fields. It performed all its preprogrammed maneuvers and was making its second landing attempt when it struck the light pole.

When the Cobra crashed around 12:30 p.m., it was under the control of its automated system. The Raytheon team had decided not to take manual control of the Cobra because they reportedly wanted to see if the aircraft would correct its own flight path, the NTSB said.

The impact left the right wing stuck in the light pole and the rest of the plane in pieces on the ground.

Minot Nuke Wing Re-Inspection Due to Recent Failures.

Minot nuclear wing to be reinspected this week
By Michael Hoffman - Staff writer Air Force Times

Posted : Tuesday Aug 12, 2008 16:14:57 EDT
Nuclear inspectors will re-inspect the 5th Bomb Wing at Minot Air Force Base, N.D., this week after the wing failed its nuclear surety inspection last May due to a litany of security and leadership errors.

Multiple security breakdowns of the base’s nuclear stockpile took place during simulated attacks with inspectors watching, according to a Defense Threat Reduction Agency report obtained by Air Force Times.

Last May’s inspection was the first since 5th Bomb Wing airmen mistakenly loaded six nuclear-tipped cruise missiles onto a B-52 Stratofortress last August and flew them to Barksdale Air Force Base, La., where the plane sat on the flight line unattended for hours.

DTRA inspectors gave the wing an “unsatisfactory” after the weeklong inspection concluded May 25, according to the report. Inspectors found one security forces airman playing video games on his cell phone while standing guard at a “restricted area perimeter” and another airman who was unaware of her “duties and responsibilities,” the DTRA report said.

Read the full story at: airforcetimes.com