Jul 21, 2008 : Georgia President's Site Attacked

📅 July 21, 2008 - A distributed denial-of-service attack bumped the website of Georgia's president offline over the weekend, marking the latest incident in the growing number of online attacks on countries undergoing political tension with Russia, as reported on IDG News Service.


Georgia's presidential website (president.gov.ge/) was unavailable from early Saturday until Sunday, according to reports by the Shadowserver Foundation, an organization that monitors online security breaches.

The attack was carried out by a botnet, or a network of computers that can be configured to flood a website with an abundance of traffic, said Shadowserver, which adds that the command-and-control server for the attack stems from the United States.

Based on the "MachBot" code, the attack communicates to other compromised PCs over the HTTP.

Shadowserver also said that the tactic used to control this particular botnet "is frequently used by Russian bot herders," while "the domain involved with this C&C [command-and-control] server has seemingly bogus registration information but does tie back to Russia."

According to Jose Nazario, a senior security engineer with Arbor Networks, the command contained in the traffic directed at the website featured the combination of words, "win+love+in+Rusia."

Shadowserver said the web host for the command-and-control server had been shut down Sunday.

Though the reason for the attacks have not been determined, Georgia is one of many former Soviet satellites, along with Estonia and Lithuania, that is trying to understate its historical ties with Russia.

Georgia has upset Russia by petitioning a move to join NATO, a security alliance that is largely in favor of Western policies. The country has also butted heads with Russia over the handling of South Ossetia and Abkhazia, which are both seeking independence.

Earlier this month, Lithuania saw 300 websites defaced after a new law that bans the public display of Soviet era symbols, as well as the playing of the Soviet national anthem, was put in effect. The hacking was caused by an unpatched flaw in a web server at a web host.

In April and May 2007, Estonian websites were hit with significant DDoS attack that was allegedly associated with angry protests from ethnic Russians over a decision to move a Soviet World War II monument to a less prominent location.