DDoS attacks on Estonia "not from Kremlin"

Attacks aimed at Estonian government websites came from everywhere except from the Russian government, study suggests.

The DDoS attacks affecting Estonia were the spontaneous product of a loose federation of separate attacks rather than a concerted effort by a single government agency, according to data gathered by an IT security company.

The information collated by Arbor Networks showed that the source of attacks were worldwide rather than just from a few locations. The attackers used a giant network of botnets - perhaps as many as one million computers in places as far away as the US and Vietnam, to increase the impact of the attack.

The attacks came after a statue of a Russian soldier was moved from the centre of the Estonian capital Tallinn to a suburban graveyard, prompting outrage from Russia.

The DDoS attacks at their height streamed 90Mbps of data at Estonian networks for period of up to 10 hours. The company said that this was the equivalent of downloading the whole of Windows XP every six seconds.

"We do know that the sites affected (the Parliament, the Ministries of Finance and Agriculture and others) were offline or unavailable for hours at a time during the attacks," said Jose Nazario, senior security engineer at Arbor Networks.

"This is disruption, but as to how much this affected daily life for the average Estonian, it is not very clear."

He said that there was no evidence that these attacks targeted resources that every citizen would use (such as electricity grids or other control systems). And no sizable attacks against Estonian internet infrastructure were observed.

"Most of the attacks appeared more about making a statement at a high profile website or two than about disrupting Estonia's online life or economy," he said.

Nazario said that the source of the attacks were global in nature and not concentrated in one country.

"We know from tracking botnets that at least one or two botnets were involved in some of the attacks," said Nazario. "However, we've also seen non-botnet tools that turned peoples' computers into packet sources."

He said while there were signs of Russian nationalism at work, there was no government connection.

"None of the sources we have analysed from around the world show a clear line from Moscow to Tallinn; instead, it's from everywhere around the world to Estonia. Spoofed sources are easy to provide, but we see no evidence of who is behind the attacks supposedly coming from Moscow," said Nazario.

Featured Resources

2021 Thales access management index: Global edition

The challenges of trusted access in a cloud-first world

Free download

Transforming higher education for the digital era

The future is yours

Free download

Building a cloud-native, hybrid-multi cloud infrastructure

Get ready for hybrid-multi cloud databases, AI, and machine learning workloads

Free download

The next biggest shopping destination is the cloud

Know why retail businesses must move to the cloud

Free Download

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans
Laptops

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Veritas Backup Exec 21.3 review: Covers every angle
backup software

Veritas Backup Exec 21.3 review: Covers every angle

14 Oct 2021