Hackers took down the website for the president of Georgia in yet another attack on the governments of former Soviet states. The website was knocked offline by a distributed denial-of-service (DDoS) attack over the weekend, yet another in a series of cyberattacks attacks against countries experiencing political friction with Russia.
The presidential website was down for about a day starting early Saturday until Sunday, according to the Shadowserver Foundation, which tracks malicious Internet activity.. Experts said the attack was executed by a botnet, or a network of computers that can be commanded to overwhelm a website with too much traffic.
The command-and-control server for the attack is based in the United States, Shadowserver said. The botnet appears to be based on the "MachBot" code, which communicates to other compromised PCs using HTTP.
The tool used to control this kind of botnet "is frequently used by Russian bot herders," according to Shadowserver. "On top of that, the domain involved with this C&C [command-and-control] server has seemingly bogus registration information but does tie back to Russia."
One of the commands contained in the traffic directed at the website contained the phrase “win+love+in+Rusia," wrote Jose Nazario, a senior security engineer with Arbor Networks, on a company blogg.
On Sunday, it appeared that the host for the command-and-control server had been taken offline, Shadowserver said.
The motivation for the attacks is not entirely clear. But Georgia is just one of several former Soviet satellites including Estonia and Lithuania seeking to downplay their historical legacy with Russia.
Georgia has angered Russia by pushing for entry to NATO. It has also tangled with Russia over the handling of South Ossetia and Abkhazia, two rebellious regions pushing for independence.
Three hundred Lithuanian websites were defaced around 1 July following a new law prohibiting the public display of symbols dating from the Soviet era, as well as the playing of the Soviet national anthem. The hacking was blamed on an unpatched vulnerability in a web server at a hosting company.
Estonian websites were pounded by a massive DDoS attack in April and May 2007. The attacks were believed to have been connected to a decision to move a monument honouring Soviet World War II soldiers to a less prominent place, which ignited protests from ethnic Russians.