Flash mobs may have been responsible for those denial-of-service (DoS) attacks in Estonia last May. So says Gadi Evron, security evangelist for Beyond Security, who gave a thorough presentation last week at Black Hat and then again at Defcon, recounting in detail the events surrounding the attack, some of which he experienced first-hand, surrounding the attack. Although he originally joked that the KGB was to blame--and quickly explained that the KGB no longer existed--Evron said could not prove conclusively that the Russians were behind the events. Yet he did call it the first true cyberwar, if only that the commerce and day-to-day functions of one country were interrupted significantly. Evron said we can all learn by what was done. Unlike the United States and many other countries, Estonia's 1.4 million people are among the most wired populations in the world, so for several days, ordinary people were unable to pump gas, buy bread, or pay their bills because of a nationalistic dispute with another country. And remember, this was just a small attack, a taste of what's to come.

[...] there was some forensic evidence that suggested a part of this attack was organized. For example, the initial inciting spam. There was also at least one bot agent written specifically to wreak havoc [...]

[...] What's significant is that the denial of service attacks affected the Estonian economy. This wasn't just an attack on the government; it affected the average person on the street. Many Estonians rely on the Internet for basic services such as paying for food, water, and gas. By shutting down access to banks, these services could not be paid. "The more technology there is within a country, the more dependent the country is on technology" he said, "and therefore, the more vulnerable." He said the same applies to the Internet. What happened in Estonia, Evron said, could happen somewhere else, perhaps on a larger scale, in the future.

Evron said we also need to rethink what we consider our critical assets our in light of this. "The critical infrastructure was not what we expected; it was (not the government, but) the private and business sectors." Evron said ISPs, banks, and even the media need to be protected against such attacks. The media, he said, are necessary to get information out in a time of crises.

[read the full article]

On preventing DDOS attacks -- CERT