Russian Presidential Elections: Cyber Developments

One of the services that my company Taia Global provides is a subscription bi-weekly cyber intelligence report that focuses primarily on the Russian Federation. I normally don't make these reports public however considering the upcoming Russian Presidential election on March 4th, I've made our report for this important event available for free in .pdf format. An introduction follows:


Russian Presidential Elections: Cyber Developments

Russia’s Presidential elections are scheduled for Sunday March 4th, 2012.  The Duma elections held last December were marked by widespread allegations of electoral fraud benefiting President Medvedev’s and Prime Minister Putin’s United Russia Party.  The allegations were documented by videos and first hand reports posted on social media, news sites, and election monitoring sites.

The public perception that United Russia stole the election led to protests coordinated through social media.  Protestors used US based Facebook and Twitter as well as Russian-focused social media.  Many sites were hit by cyber attacks that included massive distributed denial of service (DDoS) attacks that rendered sites unusable.  The DDoS attacks used previously undetected botnets and new malware variants.  Cyber attacks were conducted primarily against Russian-focused social media resources hosted in both Russia and the United States.  Twitter was hit by hashtag spamming.  Facebook was not attacked.

The Russian public assumes the government was behind the Duma election cyber attacks.  In contrast to past cyber attacks, neither patriotic hackers nor Russian youth groups claimed responsibility.  The Russian government did not comment on the attacks and did not initiate investigations to determine responsibility.  Indeed, RU-CERT (www.cert.ru), the Russian member of the Forum of Incident Response and Security Teams, seems completely oblivious to the DDoS attacks even though investigating cyber incidents falls within RU-CERT’s charter.

The DDoS attacks were usually tactically successful in rendering the target unusable.  However, the opposition quickly expanded the target set by moving posted material to additional sites inside and outside Russia.  As a result, the cyber attacks failed in their strategic objective of denying the opposition Internet access and instead became an opposition rallying point.

Since the Duma Elections

The cyber resources used by the opposition, the United Russia Party, and the Russian government have evolved since the Duma elections.  The opposition continued using Facebook and Twitter to organize protests demanding new Duma elections and fair Presidential elections.  Targeted web sites, such as the US hosted Feb26.ru, helped organize the Moscow ring road protest.  The Democratia2.ru web site provided a forum where the opposition organized groups around specific campaign issues and shared information documenting United Russia as “the party of crooks and thieves.”  The Democratia2.ru is hosted in Germany, however, the name servers are located in Russia where the Federal Security Service Information Security Center (FSB ISC) can monitor Russians visiting the site.

DOWNLOAD THE FULL REPORT HERE

Add to Cart View detail

7 Reasons Why China Isn't The World's Biggest Cyber Threat (And Who Is)

When it comes to threats in cyberspace, conventional wisdom and expert commentary assign the number one slot to the country with the most failed operations. A failed operation is defined within the intelligence agencies of most countries as a compromised operation; i.e., one whose existence was discovered. It's important to note that the attribution of any specific country to any specific attack is an untrustworthy mix of art and science based upon IP address, who was victimized, technical evidence in the code, and what "feels right" to the person or team investigating. Based upon this formula, China has been ceded the top position as the number 1 cyber threat in the world.


Instead, I propose that you put aside the marketing hype, the questionable attribution methods, and the upside-down formula of # of failed ops = greatest threat and re-evaluate the cyber threat landscape through a more rational lens. To that end and in the hopes of stimulating some informed discussion on the topic, here are 7 reasons why the Russian Federation should replace the Peoples Republic of China as the world's most dangerous cyber adversary.

1. Russia is the only nation that has engaged in a military action with a cyber warfare component: The Russia-Georgia War of August, 2008.
2. Russia is the only nation that has engaged in a cyber attack which crippled components of an entire nation's critical infrastructure sporadically over a three week period: The Estonia Cyber Attacks 2007
3. Russia's Prime Minister formerly ran industrial espionage operations for the KGB and still considers such operations an asset to the country.
4. Russia has built a parallel military and civilian information warfare infrastructure that it actively uses against internal and external adversaries. For example, the Federal Security Service's 16th Directorate which is responsible for the interception, decryption, and processing of communications has been recently been identified as Military unit (VCH) 71330.
5. The Russian government funds organizations like the Nashi which engage in cyber attacks and other malicious acts.
6. Individuals closely aligned with the Russian government are prominent venture capitalists who invest in the world's largest social network companies and in U.S. technology startups as a self-funding open source intelligence operation.
7. Unlike China, Russian cyber operations are rarely discovered, which is the true measure of a successful op.

-------------
For full disclosure, my company provides this type of research to corporate clients so that they can better gauge their risk among the world's threat actors.

Add to Cart View detail