The cyber raiders hitting Estonia

As Estonia appeals to its Nato and EU partners for help against cyber-attacks it links to Russia, the BBC News website's Patrick Jackson investigates who may be responsible.

Estonia, one of the most internet-savvy states in the European Union, has been under sustained attack from hackers since the ethnic Russian riots sparked in late April by its removal of a Soviet war memorial from Tallinn city centre.
Websites of the tiny Baltic state's government, political parties, media and business community have had to shut down temporarily after being hit by denial-of-service attacks, which swamp them with external requests.
Some sites were defaced to redirect users to images of Soviet soldiers and quotations from Martin Luther King about resisting "evil".
And hackers who hit the ruling Reform Party's website at the height of the tension on 29 April left a spurious message that the Estonian prime minister and his government were asking forgiveness of Russians and promising to return the statue to its original site.
 
Getting hit hard
 
The government's response has been to close down sites under attack to external internet servers while trying to keep them open to users inside Estonia, but the attacks are taking a toll and have been likened by the defence ministry to "terrorist activities".

"Of course [sites] can be put up again, but they can be attacked also again," Mihkel Tammet, head of IT security at the Estonian defence ministry, told BBC World Service's Newshour programme.
Estonia, he said, depended largely on the internet because of the country's "paperless government" and web-based banking. "If these services are made slower, we of course lose economically," he added.
While the government in Tallinn has not blamed the Russian authorities directly for the attacks, its foreign ministry has published a list of IP addresses "where the attacks were made from".
 
The alleged offenders include addresses in the Russian government and presidential administration.
Dmitry Peskov, the Kremlin's chief spokesman, told the BBC's Russian Service there was "no way the [Russian] state [could] be involved in cyber terrorism".
 
"When you look at the IP addresses showing where the attacks are coming from, then there's a wide selection of states from around the world," he added. "But it does not mean that foreign governments are behind these attacks. Moreover, as you probably know, IP addresses can be fake." Russia's own presidential website, he said, came under attack itself "hundreds" of times daily.
 
'Private attacks'
 
David Emm, senior technical consultant at Moscow-based antivirus software company Kaspersky Lab, believes the hackers are likely to be "younger types who, in other days, would have been writing and spreading viruses".
"I would not be surprised if switched-on people were using technical means of expressing themselves," he told the BBC News website's technology correspondent, Mark Ward.
 
Anton Nossik, one of the pioneers of the Russian internet, sees no reason to believe in Russian state involvement in the hacking, beyond the fanning of anti-Estonian sentiment.
"Unlike a nuclear or conventional military attack, you do not need a government for such attacks," he told the BBC News website. "There were anti-Estonian sentiments, fuelled by Russian state propaganda, and the sentiments were voiced in articles, blogs, forums and the press, so it's natural that hackers were part of the sentiment and acted accordingly."
 
Hackers, he points out, need very little money and can hire servers with high bandwidth in countries as diverse as the US and South Korea.

The expertise is "basic", he says, with virus scripts and source codes available online and there are "hundreds of thousands of groups who have the resources to launch a massive virus attack".
"The principle is very simple - you just send a shed load of requests simultaneously," he says.
Estonia's blocking of external servers is in his opinion a smart response but can only work for a country of "1.4 million with a non-international language". In Russia, for instance, foreign servers account for 60% of the net, he says. For Mr Nossik, of more concern is how the global net can protect itself against the big virus attacks like the Backbone Denial-of-Service attack in February which hit three key servers making up part of the internet's backbone. "Compared to the scale of the problem in general, Estonia is small," he says.[1]



Reference:
[1]http://news.bbc.co.uk/2/hi/europe/6665195.stm