[Infowarrior] - Estonia computers blitzed, possibly by the Russians

Mon May 21 01:42:17 UTC 2007

Estonia computers blitzed, possibly by the Russians

By Steven Lee Myers
http://news.com.com/Estonia+computers+blitzed%2C+possibly+by+the+Russians/21
00-7349_3-6185120.html

Story last modified Sun May 20 06:00:04 PDT 2007

MOSCOW--The computer attacks, apparently originating in Russia, first hit
the Web site of Estonia's prime minister on April 27, the day the country
was mired in protest and violence. The president's site went down, too, and
soon so did those of several departments in a wired country that touts its
paperless government and likes to call itself E-stonia.

Then the attacks, coming in waves, began to strike newspapers and television
stations, then schools and finally banks, raising fears that what was
initially a nuisance could have economic consequences.

The attacks have peaked and tapered off since then, but they have not ended,
prompting officials there to declare Estonia the first country to fall
victim to a virtual war.

"If you have a missile attack against, let's say, an airport, it is an act
of war," a spokesman for the Estonian Defense Ministry, Madis Mikko, said
Friday in a telephone interview. "If the same result is caused by computers,
then how else do you describe that kind of attack?"

Officials in Estonia have accused Russia of orchestrating the attacks,
officially or unofficially. They raised the issue at a meeting of NATO on
Monday, with Defense Minister Jaak Aaviksoo saying that the alliance, which
Estonia joined in 2004, needed to urgently debate the question--once
seemingly a distant threat--of whether mass computer attacks posed a threat
to national security.

"Events of this nature make a lot of people sit up," a NATO spokesman,
Robert Pszczel, said in a telephone interview. "Today Estonia, tomorrow it
could be somebody else."

The Kremlin has repeatedly denied government involvement in the attacks,
dismissing Estonia's complaints as fabrications. Estonian officials,
including Prime Minister Andrus Ansip, have said security officials traced
the initial attacks to Russian computer servers, including domains
registered to the government and the administration of President Vladimir V.
Putin.

Since those computers could be used by another party, it is unlikely that
involvement of the Russian authorities can be proved, though an Estonian
government spokesman, Martin Jasko, said the timing and targets raised
suspicion enough.

The attacks began on the day that the Estonian authorities removed a
Soviet-era war monument that had been the source of protests and diplomatic
tensions with Russia for months. Russia reacted vehemently, accusing
Estonia, a former republic of the Soviet Union, of besmirching the memory of
Soviet soldiers who fought against Nazi Germany.

In the days that followed, Russia suspended rail service, ostensibly for
track repairs, while protesters in Moscow staged raucous demonstrations,
harassing Estonia's ambassador in one instance. Senior officials have called
for a boycott of Estonian goods, which at least one supermarket chain has
observed.

The tensions with Estonia, along with Russian disputes with Poland and
Lithuania, overshadowed a meeting in southern Russia near the city of Samara
on Friday between Putin and the European Union's leaders, including
Chancellor Angela Merkel of Germany, the Union's rotating president, and
José Manuel Barroso, the president of the European Commission, the Union's
governing body.

Tensions between Russia and Estonia were discussed at the meeting, but the
computer attacks were not, Taneli Lahti, a member of the European
delegation, said in a telephone interview.

Estonian officials assert that the cyberattack is the largest ever against a
country. NATO, which itself came under a similar though smaller attack
during its war against Serbia in 1999, sent a computer expert to Estonia
this week to observe the attacks firsthand.

The computer attacks have inundated Estonia's Web sites, overwhelming
servers and forcing them to shut down, sometimes for a few hours, sometimes
longer. Mikko, the Defense Ministry spokesman, said sites that typically
received 1,000 visits a day had been buried under as many as 2,000 a second.

The attacks spiked on May 3, the day of the most boisterous protests in
Moscow, and again on May 8 and 9, the days that Europe commemorates the
victory over Nazi Germany in World War II. For many Estonians the end of the
war ushered in nearly five decades of Soviet occupation, and the monument
was a symbol of it. Another spike in attacks occurred on Tuesday, forcing
one of Estonia's biggest banks to suspend access from abroad. Another bank
faced an attack last week.

As the attacks have continued, they are now being traced to computers around
the world, from Vietnam to the United States, according to Hillar Aarelaid,
the head of the country's newly created Computer Emergency Response Team.

Aarelaid said attacks involved "botnets," networks of computers that have
been compromised by an unauthorized user, who can then command and control
them, surreptitiously and usually nefariously. Instructions in Russian on
how to attack Estonian sites have circulated on the Internet, he added,
suggesting that the world's first cyberwar would continue.

"We can't say we have seen the biggest attack yet," he said, "because each
wave is bigger than the one before."