Feeds

Cyberwarriors on the Eastern Front: In the line of fire packet floods

Former senior Estonian defence official talks cyberwar

Protecting users from Firesheep and other Sidejacking attacks with SSL

Clueless spotters green-lit porn site for cyber carpet bombing

Just one person, an ethnic-Russian Estonian national, has been charged and convicted of the attack. Dmitri Galushkevich, 20, was fined the local equivalent of $1,200 after he was convicted of attacks against the Reform Party of Estonian Prime Minister Andrus Ansip.

"He was not accountable as an organiser but a schoolboy providing targets via chat forums," Almann explained, adding in some instances the attackers were misdirected by their spotters on the ground.

One wave of attacks, for example, took out an adult entertainment (porn) website instead of an Estonian state security site.

Estonia's analysis of the attacks reveals that small-scale ping attacks, used to carry out reconnaissance of targets, preceded the main assaults, which came in phases. "The main phase of the attack involved voluntary political botnets, predominately located in Russia, which Almann described as "easy to block", as well as assaults of growing sophistication from compromised machines around the world.

The attacks against Estonia, the first of their kind on a country-wide level, have been studied intensively by military planners since. In 2008, cyberattacks on Georgian websites and communication facilities accompanied a ground war between Russia and Georgia.

Estonia, along with Poland, stepped in to offer backup hosting of Georgian government website. Almann argues this process needs to be more organised. "We need pan-European backup hosting for critical websites," he said.

Rules of engagement

Almann reckons that rules for the investigation of cyberattacks need to be established by more countries signing up to the Council of Europe Convention on Cybercrime. Russia and China and several other key countries have not signed the treaty while some countries in Europe, including the UK, have signed but not ratified the regulations.

Russia might be encouraged to sign the treaty by making it a condition of World Trade Organisation negotiations, he suggested, adding the issue of cyberconflict ought to be on the agenda of G8 talks that include Russia and the world's seven biggest economies.

Some observers have suggested that a Geneva Convention for cyberwar might be needed, an idea Almann regards as a non-starter even though he's equally adamant that cyberwar is all too real.

"With applications such as Stuxnet attacks are growing more sophisticated," Almann said. "There are really serious capabilities out there."

"However banning the use of cyberweapons is not realistic. Cyberwar is out there and everybody is involved."

Offence is the best form of attack

Plenty of governments talk about boosting the capability of their cyber-defences but very few, at least publicly, talk about cyber-offensive capabilities. Cyber-offensive capabilities might involve attacking a particular botnet of compromised PCs or disrupting the communication channels an enemy is using to co-ordinate attacks. Almann reckons most countries are developing cyber-offensive capabilities. "Sovereign nations need the capability. It's unavoidable," he said.

However establishing rules to govern the use of such weapons is something else, in Almann's opinion.

"A Geneva Convention for cyberwar is not going to work," he said. "I'm a lawyer and I wouldn't know what to write. The field is so fast-developing that you are going to get it wrong.

"This is not burning issue and shouldn't divert attention from dealing with shortcomings of critical national infrastructure systems," he added.

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.