July 3rd, 2007
US-CERT heads to Estonia to help, learn about cyberattack
US-CERT (Computer Emergency Response Team) is headed to Estonia to do a little forensics on the well-reported cyberattack that took out much of the small country’s infrastructure, InfoWorld reports.
Gregory Garcia, assistant secretary for cyber security and telecommunications with DHS, said: “We are sending someone from our organization … to help them with forensic analysis and to do some additional training on how to secure their infrastructure”.
Estonia accused Russia of attacking its networks and early press reports backed the charges up, but now investigators now say they don’t know exactly was behind the incident.
“The data that we have does not speak to who’s behind it. There’s no smoking gun,” said Jose Nazario, senior security engineer with Arbor Networks, who has studied the attacks.
Unlike other Internet conflicts, the Estonian attacks do not seem to have been backed by a particular hacking group, said Gadi Evron, a security evangelist with Beyond Security. “They were of immense variety [and came] from the population of the Russian-speaking blogosphere,” he said.
Some attackers ran simple scripts on their PCs, while others trained sophisticated groups of botnet computers at the Estonian systems, Evron said. “Many of the attacks were from fake sources and compromised computers around the world,” he added.
US-CERT is interested to see what it can learn from the attack and how the US should respond to cyberwarfare.
“It’s a little bit more complicated than conventional warfare,” Garcia said. “It’s a little difficult to trace back where a particular attack is coming from, which makes it more difficult to respond.”
