The forensics of chasing war hackers

Washington Post:

Here in the Citizen Lab at the University of Toronto, a new breed of hackers is conducting digital espionage.

They are among a growing number of investigators who monitor how traffic is routed through countries, where Web sites are blocked and why it's all happening. Now they are turning their scrutiny to a new weapon of international warfare: cyber attacks.

Tracking wars isn't what many of the researchers, who call themselves "hacktivists," set out to do. Many began intending to help residents in countries that censor online content. But as the Internet has evolved, so has their mission.

Ronald J. Deibert, director of the Citizen Lab, calls the organization a "global civil society counterintelligence agency" and refers to the lab as the "NSA of operations."

Their efforts have ramped up in the past year as researchers gather evidence that Internet assaults are playing a larger role in military strategy and political struggles. Even before Georgia and Russia entered a ground war earlier this month, Citizen Lab's researchers noticed sporadic attacks aimed at several Georgian Web sites. Such attacks are especially threatening to countries that increasingly link critical activities such as banking and transportation to the Internet.

Once the fighting began, massive raids on Georgia's Internet infrastructure were deployed using techniques similar to those used by Russian criminal organizations. Then, attacks seemed to come from individuals who found online instructions for launching their own assaults, shutting down much of Georgia's communication system.

Two weeks later, researchers are still trying to trace the origins of the attacks. "These attacks in effect had the same effect that a military attack would have," said Rafal Rohozinski, who co-founded the Information Warfare Monitor, which tracks cyber attacks, with Citizen Lab in 2003. "That suddenly means that in cyberspace anyone can build an A-bomb."

The cyber attacks that disabled many Georgian and Russian Web sites earlier this month marked the first time such an assault coincided with physical fighting. And the digital battlefield will likely become a permanent front in modern warfare, Deibert said.

...

The small Toronto office of Citizen Lab, tucked in a basement of the university's Munk Centre for International Studies, serves as the technological backbone for the operations. World maps and newspaper clips cover the walls. Researchers move between multiple computer screens, studying lists of codes with results from field tests in Uzbekistan, Cambodia, Iran and Venezuela, to name a few.

"We rely on local experts to help us find out why a particular site is being blocked," Deibert said. It could be a problem with the Internet service provider, a temporary connection glitch or a downed server. "But what's more effective is blasting a site into oblivion when it is strategically important. It's becoming a real arms race."

He's referring to "denial of service" attacks, in which hundreds of computers in a network, or "botnets," simultaneously bombard a Web site with millions of requests, overwhelming and crashing the server. In Georgia, such attacks were strong enough to knock key sources of news and information offline for days.

Georgian Internet service providers also limited access to Russian news media outlets, cutting off the only remaining updates about the war. On the night of Aug. 12 -- the height of the fighting -- "there was panic in Tbilisi brought about by a vacuum of information," Rohozinski said.

Shadowserver saw the first denial of service attack against Georgia's presidential Web site July 20. When the fighting began, Andre M. Di Mino, Shadowserver's founder, counted at least six botnets launching attacks, but it was "difficult to tell if it was a grass-roots effort or one commissioned by the government."

...

It's unclear who is behind the attacks, however. In some cases, the locations of botnet controllers can be traced, but it's impossible to know whether an attacker is working on the behalf of another organization or government. "It's going to take a year to figure this out," Nazario said.

...

Computer experts tell me the reason it is so hard to trace these attacks is that the hackers take over computers not associated with them and use these zombie computers for the attacks. For some reason it is difficult to trace back through a string of zombies to the source.

I suspect that NSA or the Air Force are working on ways to forensically find these hackers and do it in a reasonable amount of time.

It would also not surprise me if counter measures are not developed to automatically attack the attackers. They would be like the HARM anti radar missiles which lock on to enemy radar sites as soon as they are turned on. In a hot war, that is what I would do.