After Estonia came Lithuania. In 2008 this former Soviet republic antagonised the Kremlin when its parliament voted to ban the public display of both Nazi and Soviet symbols. This triggered an immediate massive cyber attack: on 30th June the Lithuanian telecommunications service reported an attack by hackers on 300 websites, where they had pasted Soviet red flags and anti-Lithuanian slogans.
In August 2008, the war between Georgia and South Ossetia triggered a cyber attack on Georgia’s internet infrastructure. At the same time a number of groups appeared, among them ‘Civil Anti-terror’ (www.anticenter.org ↑ ) and ‘Internet Underground Community vs. Terrorism’ (www.peace4peace.com ↑ ), whose aim was to mobilise web users against sites that supported the Chechen rebels, and who suggested using DoS attacks to do this. In 2007 we noticed the National Anti-Terrorist Committee, whose chair is the head of the FSB, taking an interest in the patriotic hackers of ‘Civil Anti-terror’ and trying to contact them, seeing them as potential allies.
The same year saw the emergence of a figure known as ‘Hacker Hell’ as the main scourge of liberals on the Russian Internet. A group of supporters attached themselves to him on the ‘Live Journal’ blog site, calling themselves sometimes ‘the Hell Brigade’, sometimes ‘the Hell Party’, and then settling on ‘the FSB Brigade for the Strangulation of Democracy’ (http://fsb-brigada.livejournal.com/ ↑ ). While most of his gang busied themselves with trolling on liberal sites, posting inflammatory messages to disrupt discussions, Hell was hacking into opposition leaders’ email accounts – most famously, those of Aleksey Navalny and his wife in October 2011. Among his other victims were the blogger Andrey Malgin, an exposer of corrupt officials, and ex-MP Viktor Alksnis, who led the campaign against the illegal sell-off of public land in the trendy residential Moscow district of Rublyovka. And in January 2012, when opposition hackers accessed the email account of the Nashi press officer Kristina Potupchik, it turned out that the Kremlin’s youth movement was planning a DDoS attack on the Kommersant newspaper’s website.
Misha Glenny, a British investigative journalist, the author of “Dark Market: Cyberthieves, Cybercops and You” (2011)
The largest concentration of hackers in the Russian Federation is in Saint-Petersburg. The question is why they are based in Saint-Petersburg, why they are allowed to develop the companies like the Russian Business Network? (RBN is the multi-faceted cybercrime group originated as an Internet Service Provider for child pornography, phishing and malware distribution based in Saint Petersburg). Why they were allowed to develop huge computing capacity for spam, for child pornography, credit card fraud and so on? Given the ability of the FSB to monitor what is going on, if there is a such big operation, then they must have known.
Who are the hackers?
The question has always been: is this campaign the work of ‘real’, expert hackers, or of activists mobilised by the Kremlin?
Vladimir Pribylovsky, who runs the opposition websitehttp://www.anticompromat.org/ ↑ and is also president of the ‘Panorama’ Information and Research Centre think tank, was himself a few years ago a victim of Hacker Hell, who hacked not only into Pribylovsky’s ‘Live Journal’, but also into his daughter’s Facebook page. We met Pribylovsky in a Moscow café, where the former dissident, translator of Animal Farm and leader of a party with the exotic name of ‘Subtropical Russia’, told us that he has no illusions about Hell’s hacking qualifications. ‘No, they aren’t real hackers. Hell can’t create programmes; he is engaged in social engineering, asking questions for mugs like me to answer. For example, you get a fake dialogue box, ostensibly from Google, telling you that you urgently need to change your password. So you type in your password and then they use it to get into your account – classic phishing. My password (for email, Live Journal, everything) used to be the number of my internal ID document. Then after the first time I got hacked, I changed it to the number of my international passport. A year later he worked it out and got me again. And there are still people who use ‘12345’ as their password.’
Our contacts in the hacking community agree about Hell: ‘This is someone who knows how to work with archives and documents (that’s his day job); he can search out and analyse information. But technically he’s not a hacker, and all his hacks are based on guessing the answers to security questions on ‘old’ post boxes and social networks accounts.‘
We also have the impression that the relationship between the hackers and the security services are not working out very well for the latter, and this has been confirmed by what has happened to the ‘anti-terrorist’ sites. According to our sources, the idea of attacking rebel sites did not appeal to cyber criminals: ‘After the anti-terror sites started getting a lot of publicity, which was mostly the work of a well-known character who goes by the username ‘SEVERA’, rumours started going around the hacker-criminal community about him having links with the FSB, and this didn’t go down well, especially as he was a member of closed, ’secret’ credit card fraud forums like VN – VendorsName, which are not open to just anybody.’
The St Petersburg hacker SEVERA (whose real name is thought to be Pyotr Levashov) is one of the best known kings of spam, whose activities have earned him a place of honour on the database of Spamhaus, an international organisation that fights spam and phishing. He owes his great popularity to the clever fake antivirus programmes he disseminated to scale up his botnet, and which he then used to spread spam. He’s been known in computer circles since the end of the 90s, and many hackers suspect that the extent of his operations and incredible luck in his relations with the authorities can be put down to collaboration with the FSB. SEVERA’s attempts to publicise his antiterrorist initiatives on closed forums have linked his name firmly with the security services and alienated other hackers, who have been put off from taking part in these initiatives. Both ‘Civil Anti-terror’ and ‘Internet Underground Community vs. Terrorism’ are inactive at present. The number of politically inspired DDoS attacks, however, continues to rise, although when the hacker community is involved with them it is in an unexpected fashion.
DDoS attacks as business
The St Petersburg hacker Andrei, username Sporaw, rose to fame in the early 2000s, when he gave comments on the hacking community in Russia for the BBC and the newspaper ‘Vedemosti’. Sporaw is very critical of the liberal opposition and western values: his website’s home page shows the state emblem of the USSR on a red background, with the caption ‘The country which does not exist’.
At the TED (http://www.ted.com/pages/about ↑ ) Global conference in Edinburgh in June 2011, Mikko Hypponen referred to Sporaw as a Russian hacker whom he recognised by his signature in the body of his ‘exploit’ (a programme that takes advantage of software vulnerability). This signature contained the number of Sporaw’s car, a black Mercedes S600, which Hypponen had learned from a photo of the car on the hacker’s ‘Live Journal’ page. And at the end of January 2012 the well known blogger Anton Nossik accused Sporaw of hacking into Aleksey Navalny’s email account (for which ‘Hacker Hell’ later admitted responsibility) and of working for Kremlin spin doctors, on the grounds that Sporaw argued for the authenticity of the intercepted Navalny’s emails.
In correspondence with us, Sporaw denied categorically that he had been involved in hacking into Navalny’s emails, although he admitted that he was a close follower of online political debate. We went on to discuss his views on the 4th December DDoS attacks, and asked what resources he thought the attackers would have needed to carry them out:
‘There are two alternatives. One is people, loads of people. And most of them wouldn’t even need to be particularly technically competent - just a huge number of people with a few techies in amongst them. In general the attacks came from imageboard forums such as ‘4chan’, ‘2ch[annel]’ and the Russian analogue ‘2ch.so’. Their DDoS attacks were on the level of “download this script and send it every computer you can access – at home, at work.” And what you would then get was something primitive, like a site being subjected to constant bombardment by a ping flood (http://en.wikipedia.org/wiki/Ping ↑ ). That’s what they did in Estonia and Georgia.
To understand how dumb these hackers are, you need only look at the tool they use – the DDoS - LOIC (Low Orbit Ion Cannon). That means that people have access to a ‘handy programme’ that allows them to create DoS (denial of service) attacks (specifically DoS – not DDoS (distributed denial of service) attacks. The DDoS is dependent on the enormous number of people involved.
Attacks like this are coordinated through internet chat sites, forums and imageboards. The more people involved, the more ‘effective’ the attack. The downside is obvious: most of those people are not technically literate and launch the attack from their own internet address.’
‘So what is the second alternative? ‘, we asked Sporaw.
‘The other alternative is a DDoS using botnets, of which there are two types. Botnets of the first type are very simple and usually very small, consisting of 1000-5000 active systems; the second are professional botnets whose bots are measured in tens and hundreds of thousands, the so-called ‘million-bots’. The first type are usually the work of ‘schoolkids’ – barely competent people who create botnets using other peoples’ technical knowledge. You can find lots of techies on open source forums like ‘antichat’, ‘damagelab’, ‘xaker.ru’, ‘xakery.ru’. Anyone who wants to create a DDoS just has to go to these public sites to get help – ‘Nashi’ members, ‘Navalny’s Army’, anyone. The second type of botnet, on the other hand, is not usually set up specifically for a DDoS, but a DDoS can be a spinoff.’
How many people does Sporaw think might be involved in this?
‘In simple botnets, usually just one person, the botnet’s owner – if you don’t count the help from the forums, where you can find, for example, an author of stolen or bought malware; a service to disable anti-viruses; a setting up service; an exploit service; traffic exchanges etc.. Botnets of the second type usually involve a team of two to five people – an owner or owners responsible for revenue generation, infrastructure organisation and strategic management; coders, database and web part developers, testers, support and admin people (often outsourced).‘
Stanislav Shevchenko, who for 11 years was deputy head of KasperskyLab’s innovation department (he left the company in autumn 2011), agrees with most of Sporaw’s analysis. He believes that botnets are not created to order for political purposes, they are made for long term, repeated use, where DDoS attacks are just one option.
‘You can in fact just buy them. You go on the internet and type “I want to buy a botnet.” And there they are, for sale – complete or in part; you can also rent one if you prefer.’
So how many botnets does Shevchenko believe there are on the net – millions?
‘We are talking here about serious botnets, that are powerful enough to affect serious websites. To take down online newspaper ‘Gazeta.Ru’, for example, you would need a botnet of hundreds of thousands of computers. But there are certainly not millions of botnets of this size. Perhaps a few dozen.’
Hacktivism
At the peak of political hacking in 2011-2012, two types of cyber attack predominated - DDoS attacks and email hacking, and these were used by both pro-Kremlin cyber activists and the opposition. In response to hackers’ attacks on the emails of Navalny and of Grigory Melkonyanetz, one of the heads of ‘Golos’, opposition hackers broke into the email account of Kristina Potupchik, the press officer of ‘Nashi’. After the DDoS attacks on liberal media sites on the day of the parliamentary elections, the Central Election Committee sites ‘webvybory2012.ru’ and ‘cikrf.ru’ were attacked on the day of the presidential election.
The ‘Anonymous’ movement has admitted responsibility for hacking the email of Kremlin youth movement functionaries in January 2012. Interestingly enough, the tactics used by this group’s Russian branch are very different from those used in other countries. In the West, ‘Anonymous’ attacks sites belonging to the CIA and the UK’s Home Office, but in Russia they didn’t try to hack into government or other official sites, but merely individuals’ email accounts. We asked Russian ‘Anonymous’ activists to explain this difference in tactics.
‘We have completely different aims - the problems we face in Russia are not the same as those in the West. It’s horses for courses. At that particular moment there was a general feeling among people like us that we needed to get hold of genuine internal correspondence between officials connected with government websites. There was no other particular reason for choosing those targets.’
We suggested that there seemed to be very few actual expert hackers involved in the political cyberspace battle in Russia, on either the Kremlin or the opposition sides, and that it appeared to be more like a battle between opposing political activists. Did they agree?
‘You’re right, there are not that many expert hackers. The Kremlin doesn’t need them because it has other means of extracting information (you remember when the head of ‘Golos’ had his notebook seized)? There’s no one the government needs hackers to attack – they don’t have any specific use for them. And we also don’t have any particular need for serious hacking at present or in the near future. Why do we need access to government sites and documents, when the most serious crimes are being committed by government officials in a pseudo-private capacity?
That’s one half of the answer. The other is that there is a wide variation in the skills our members bring to the movement. One person is only able to press a key on ‘putinvzrivaetdoma.org’ to start a DDoS attack, another can hack into someone’s emails by working out their password, a third is able to hack into a site. Naturally, there are a lot more people at the first level than the third and the actions of the people at the first level could indeed be described as a battle of activists.’
So despite the increasing number of cyber attacks on the Russian political internet, the people behind them are usually activists, rather than professional hackers. For Russian cyber criminals hacking remains first and foremost a business: they will take political orders, but only on a commercial basis, and even then they prefer to work not for the security services, but for Kremlin youth organisations, since this work brings them huge profits without any risk of losing their anonymity.
Published on OpenDemocracy.Net 25.04.2012
