Posted on Thursday, May 17th, 2007 | Bookmark on del.icio.us

Estonian DDoS Attacks – A summary to date

by Jose Nazario

Time sure flies. I looked up from working and noticed I hadn’t blogged in a while. And I noticed that I hadn’t been analyzing the Estonian DDoS attacks in a week or two.

ATLAS gives us an amazing view into the Internet’s activities. ATLAS collects DoS attack data from around the world through sharing arrangements and even from some of our Peakflow SP deployments. As such, the recent DDoS attacks on Estonia are visible, in part, from within ATLAS. I’ve always had a soft spot in my heart for Estonia. Since the fall of the Iron Curtain, it’s become technically advanced, society has done wonders to improve itself and it’s jumped, quite successfully, into the modern world. It has a nearly model economy, based in large part on the teachings of Milton Friedman who favored free markets unfettered by state control.

As you can imagine, having development access to the ATLAS data repository allows me to build new reports and crunch the data in new and exciting ways. I analyzed about 2 weeks of DDoS attacks on Estonia this morning using internal tools and reporting systems, and here’s what I found.

We’ve seen 128 unique DDoS attacks on Estonian websites in the past two weeks through ATLAS. Of these, 115 were ICMP floods, 4 were TCP SYN floods, and 9 were generic traffic floods. Attacks were not distributed uniformly, with some sites seeing more attacks than others:

Attacks Destination Address or owner
35 “195.80.105.107/32″ pol.ee
7 “195.80.106.72/32″ www.riigikogu.ee
36 “195.80.109.158/32″ www.riik.ee, www.peaminister.ee, www.valitsus.ee
2 “195.80.124.53/32″ m53.envir.ee
2 “213.184.49.171/32″ www.sm.ee
6 “213.184.49.194/32″ www.agri.ee
4 “213.184.50.6/32″
35 “213.184.50.69/32″ www.fin.ee (Ministry of Finance)
1 “62.65.192.24/32″

The attacks themselves haven’t been steady, at least from the perspective given by ATLAS. If we look at how many attacks occurred on every day, we can see that they peaked a week or so ago, but they haven’t necessarily stopped.

Attacks Date
21 2007-05-03
17 2007-05-04
31 2007-05-08
58 2007-05-09
1 2007-05-11

As for how long the attacks have lasted, quite a number of them last under an hour. However, when you think about how many attacks have occurred for some of the targets, this translates into a very long-lived attack. The longest attacks themselves were over 10 and a half hours long sustained, dealing a truly crushing blow to the endpoints.

Attacks Date
17 less than 1 minute
78 1 min – 1 hour
16 1 hour – 5 hours
8 5 hours to 9 hours
7 10 hours or more

Finally, this is a decent sized botnet behind the attack, with aggregate bandwidth at our points of measurement maxing out at nearly 100 Mbps.

Attacks Bandwidth measured
42 Less than 10 Mbps
52 10 Mbps – 30 Mbps
22 30 Mbps – 70 Mbps
12 70 Mbps – 95 Mbps

Largest attacks we measured: 10 attacks measured at 90 Mbps, lasting upwards of 10 hours. All in all, someone is very, very deliberate in putting the hurt on Estonia, and this kind of thing is only going to get more severe in the coming years.

Links around the net to more information about the attacks:

Share

46 Responses | Add your own



Comment Post by: Security Watch » Blog Archive » CERTs to the Rescue — May 17th, 2007 @ 7:21 pm EST  Reply

[...] Arbor Network show some interesting analysis of traffic relating to the above attacks on thier Blog. [...]

Comment Post by: Massive DoS attacks on Estonia at Security Samizdat — May 18th, 2007 @ 4:27 am EST  Reply

[...] Updated (May-18): The Arbor Networks blog (”Security to the Core”) has some information about the targets of the attacks and other quantitative data. [...]

Comment Post by: Brian Honan — May 18th, 2007 @ 5:37 am EST  Reply

Interesting to also see that TERENA has published details as to how the European CSIRT community have responded to assist Estonia deal with the attacks.

http://www.terena.org/news/fullstory.php?news_id=2103

Comment Post by: Estonia suffers cyber-warfare DD0Ses at LifeParticles.com — May 18th, 2007 @ 8:40 am EST  Reply

[...] Cory Doctorow: Russia is accused of being the first country to declare cyber-war on another nation: the ongoing Estonian conflict has been accompanied by a massive DDoS attack on critical Estonian networks: [...]

Comment Post by: Just wonderful things » Estonia suffers cyber-warfare DD0Ses — May 18th, 2007 @ 9:57 am EST  Reply

[...] Cory Doctorow: Russia is accused of being the first country to declare cyber-war on another nation: the ongoing Estonian conflict has been accompanied by a massive DDoS attack on critical Estonian networks: [...]

Comment Post by: www.andrewhay.ca » Suggested Blog Reading - Friday May 18th, 2007 — May 18th, 2007 @ 10:02 am EST  Reply

[...] Estonian DDoS Attacks – A summary to date – Good analysis of the issues that Estonia was facing. Largest attacks we measured: 10 attacks measured at 90 Mbps, lasting upwards of 10 hours. All in all, someone is very, very deliberate in putting the hurt on Estonia, and this kind of thing is only going to get more severe in the coming years. [...]

Comment Post by: BelchSpeak — May 18th, 2007 @ 12:09 pm EST  Reply

Jose, thanks for the facts. How about a little opinion now? Do you think this was state sponsored in that the government or military launched the attacks?

Or was it the common criminal element that herds botnets just piling on?

Comment Post by: fresh wordpress installation » Estonia suffers cyber-warfare DD0Ses — May 18th, 2007 @ 12:15 pm EST  Reply

[...] Cory Doctorow: Russia is accused of being the first country to declare cyber-war on another nation: the ongoing Estonian conflict has been accompanied by a massive DDoS attack on critical Estonian networks: [...]

Comment Post by: The Waving Cat » Blog Archive » Russia engaging in cyber war against Estonia? — May 18th, 2007 @ 2:10 pm EST  Reply

[...] Link, via. (Summery of the attacks.) [...]

Comment Post by: Security Bytes » New details from cyberattack on Estonia — May 18th, 2007 @ 2:36 pm EST  Reply

[...] This morning I wrote about the blistering cyberattacks against the Baltic nation of Estonia in recent weeks. We’ve since come across an interesting blog posting from Jose Nazario over at Arbor Networks offering more detail on the size and scope of the attacks. [...]

Comment Post by: Cyber attacks against Estonia « More shameless remarks by Larko — May 20th, 2007 @ 4:16 pm EST  Reply

[...] Cyber attacks against Estonia Jose Nazario writes about the ongoing Ddos attacks against Estonia (via Peeter Marvet): We’ve seen 128 unique DDoS attacks on Estonian websites in the past two weeks through ATLAS. Of these, 115 were ICMP floods, 4 were TCP SYN floods, and 9 were generic traffic floods. Attacks were not distributed uniformly, with some sites seeing more attacks than others [...]

Comment Post by: 100iso.it » Blog Archive » Se la NATO entra in una Guerra informatica — May 20th, 2007 @ 6:14 pm EST  Reply

[...] “GLi attacchi sono stati massicci, ben indirizzati e ben organizzati”, ha detto il ministro della difesa estone Jaak Aaviksoo: il governo accusa Mosca di aver deciso e diretto l’assalto, sostenendo di aver identificato i responsabili e sottolineando come le autorità russe si siano rifiutate di collaborare. Le ramificazioni arriverebbero fino agli uffici presidenziali, a cui apparterrebbero alcuni degli indirizzi IP che avrebbero partecipato all’attacco. [...]

Comment Post by: Privacy and Identity Theft » Blog Archive » The Estonian DDoS Attacks - Do Governments Really Get it? — May 20th, 2007 @ 8:14 pm EST  Reply

[...] I’m travelling in Europe this week, and tonight we were discussing the massive DDoS attacks that have been happening against Estonian websites for several weeks. [...]

Comment Post by: Web2.0 Effect Blog Web 2.0 Blog Technology Help » Blog Archive » Cyber war in Estonia — May 21st, 2007 @ 6:10 pm EST  Reply

[...] Arbor Networks’ Jose Nazario has now blogged his initial analysis of the event. He reports that Arbor Networks recorded 128 unique DDoS attacks on Estonian-based URLs. Most lasted less than one hour, with the longest lasting 10 hours and thirty minutes. As for the strength, measured in how many packets of information flooded the given URL to make it inaccessible, the attacks were relatively light, with only ten of the attacks measuring 90-plus Mbps, including one of the 10 hour attacks. At its peak on May 9, the attack shut down up to 58 sites at once. [...]

Comment Post by: monsterlippa » Blog Archive » Attivismo contro l’Estonia — May 22nd, 2007 @ 10:31 am EST  Reply

[...] Gli attacchi Distributed Denial Of Service contro la rete estone degli ultimi giorni sono stati da molti attribuiti alla Russia. Secondo John Bambenek dell’ISC al SANS invece questo è probabilmente un caso di hacktivism. Le tante proteste e i boicottaggi dal lato filorusso indicano che in molti, infervorati dalla questione, hanno messo al lavoro le loro botnet. Gestire una botnet e usarla per lanciare un DDOS ICMP non è per niente difficile come per esempio avvelenare un oppositore col Polonio 210. [...]

Comment Post by: Kas Vene Föderatsioon oli seotud küberrünnakutega? « neeger!@#% — May 22nd, 2007 @ 12:23 pm EST  Reply

[...] Eesti vastu korraldati rohkelt rünnakuid ja see on parim Venemaa valitsust rünnakutega siduv asitõend? What the fuck? [...]

Comment Post by: ddos de da: Internet attacks still considerable · Security to the Core | Arbor Networks Security Blog — May 25th, 2007 @ 8:34 pm EST  Reply

[...] Bits and Pieces: November 12DDoS Attacks from NowhereEstonian DDoS Attacks – A summary to dateDDoS & Symantec’s Internet Security Threat ReportOn DDoS Attack Activity [...]

Comment Post by: After Estonia: Cyberwar Is Not The Biggest Threat | 0HV.NET : Internet Blog — May 30th, 2007 @ 2:16 pm EST  Reply

[...] If you want to see what types of attacks are being conducted, check out this dashboard developed by Arbor Networks, called Atlas, for a daily summary. And here’s a blog post by Arbor’s Jose Nazario, a security researcher, describing some details of the attacks on Estonia. [...]

Comment Post by: O bazar de nes » Ciberguerras e software libre — June 1st, 2007 @ 10:25 am EST  Reply

[...] Unha vez atendida a tipoloxía do ataque (ver tamén os datos), é sinxelo comprender que -a pesar das medidas que se poidan tomar nos servidores destino do ataque- a potencia do mesmo radica no número de computadores cautivos da netbot (ata un millón parecen ser os usados neste caso). Por isto, a robustez contra ataques informáticos DDOS radica máis en aumenta-la seguridade do usuario medio que de grandes gastos nos servidores atacados. Como indicaron Bruce Schneier e compañía hai anos: o monocultivo informático é unha peza clave da fortaleza dos atacantes. Porque a tecnoloxía non é boa nin mala, pero tampouco neutra. [...]

Comment Post by: Privacy and Identity Theft » Blog Archive » The New Face of DDoS: Spamhaus attacked, and Estonia asks Russia for help — June 7th, 2007 @ 6:13 pm EST  Reply

[...] 2. In May 2007, Estonian government agencies and online companies were DDoSed in a massive politcally motivated attack from all around the Globe. At least one Estonian bank shut off access to their site from networks outside the country. Russia was blamed for many of the attacks. Now Estonia is < a href=”http://www.reuters.com/article/internetNews/idUSL0671620620070606″>asking the Russian government for help to find the cyber-criminals. [...]

Comment Post by: Security Watch » Blog Archive » Botnets - Digital Weapons of Mass Destruction? — June 8th, 2007 @ 8:19 pm EST  Reply

[...] Jose Nazario from Arbor networks conducted an analysis of the IP addresses observed from the analysis of their Atlas systems where he highlights the attacks cannot be proven to be sponsored by Russia.  Indeed in an interview Jose Nazario concedes that while the IP addresses do not prove Russia mounted these attacks, they also do not exonerate Russia either.  On the other hand, the Asymmetric Threats Contingency Alliance (ATCA) claim they have evidence proving Russia colluded with the owners of various Botnets to carry out these attacks. [...]

Comment Post by: Abram Razzuvaev — June 10th, 2007 @ 7:09 pm EST  Reply

Hi collegues,

I try to understand the speculation on DDoS on Esstonia and found-out the subj. a bit crazy.

First …. can you possibly let us now, was any legal estonian defenitions for DDoS-attack or it was illegal speculation of security-minded-fricks and gov. pr-managers?

If I”l take wikipedia term, “”is an attempt to make a computer resource unavailable to its intended users” – it means for me, if anybody from another country access the web site on another lang. – he became guilty, if web hoster whant this. Stupid!

Second
It’s nice to see matrix bandwith–destination. For example – how much traffic have been sent to gov. resources. I founded in google, they have only 4 Mbit link to Internet. May they can afford more in 21 centuary, to assure that people will be provided with information ?

Comment Post by: Are you prepared for cyberwar? « subatomico security — June 24th, 2007 @ 8:20 am EST  Reply

[...] But now, first with the Estonian DDoS attacks allegedly coming from Russia, and then with last week’s attack against Pentagon computers, the topic is back on the spot: cyberwar. [...]

Comment Post by: Bathayon » After attacks, US government sending team to Estonia — July 3rd, 2007 @ 7:59 pm EST  Reply

[...] “The data that we have does not speak to who’s behind it. There’s no smoking gun,” said Jose Nazario, senior security engineer with Arbor Networks, who has studied the attacks. [...]

Comment Post by: After attacks, US government sending team to Estonia - MTB - Technology Feed - All About Technology — July 4th, 2007 @ 1:45 am EST  Reply

[...] “The data that we have does not speak to who’s behind it. There’s no smoking gun,” said Jose Nazario, senior security engineer with Arbor Networks, who has studied the attacks. [...]

Comment Post by: Leaderless resistance against the Church of Scientology? — January 26th, 2008 @ 5:22 pm EST  Reply

[...] colleague Chris Diehl at JHU APL suggested the Estonian cyberwar might be a good example to study how the Blogosphere was used for this by combining sentiment [...]

Comment Post by: Westlife — February 25th, 2008 @ 2:36 am EST  Reply

It’s nice to see matrix bandwith–destination. For example – how much traffic have been sent to gov. resources.

Comment Post by: Technology latest news » Blog Archive » After attacks, US government sending team to Estonia (InfoWorld) — February 28th, 2008 @ 9:39 am EST  Reply

[...] no smoking gun,” said Jose Nazario, senior security engineer with Arbor Networks, who has studied the [...]

Comment Post by: Sobre DDoS, CastleCops, y la lucha común contra las redes criminales en internet | nv1962 — July 13th, 2008 @ 12:33 am EST  Reply

[...] la cosa puede llegar a ser bastante grave, como el año pasado cuando multitud de servidores de entidades oficiales en Estonia sufrieron un ataque masivo de DDoS, según parece a manos de nacionalistas rusos. Y hace poco más de una semana, se repite con un [...]

Comment Post by: Zero Day mobile edition — September 5th, 2008 @ 8:41 pm EST  Reply

[...] It is also possible that such a widget could directly declare its purpose. During the recent Estonian and Georgian DDoS event, a simple script was circulated that allowed the average citizen to participate in the DDoS attack. [...]

Comment Post by: Week’s Links | lonerunners.net — November 9th, 2008 @ 5:58 pm EST  Reply

[...] Estonian DDoS Attacks – A summary to date [...]

Comment Post by: Stop DDoS and Worms at ISP Level? | The Shivling — September 21st, 2009 @ 2:45 pm EST  Reply

[...] the part of ISPs, and, potentially, governments, considering the magnitude of attacks suffered by Estonia in 2007, as well as China’s and North Korea’s burgeoning military / government-sponsored [...]

Comment Post by: Fighting DDoS Attacks at the ISP Level : Information Security Resources — September 29th, 2009 @ 9:44 pm EST  Reply

[...] the part of ISPs, and, potentially, governments, considering the magnitude of attacks suffered by Estonia in 2007, as well as China’s and North Korea’s burgeoning military / government-sponsored cyberwar [...]

Comment Post by: Information Warfare in China « Freedom Nation — October 23rd, 2009 @ 5:20 am EST  Reply

[...] warfare (IW) so far happened 2 years ago during the conflict between Estonia and Russia (details here) and in Georgia in 2008 (the apparent cooperation of Russian government with the perpetrators led [...]

Comment Post by: DDoS: News Reports, interview, Panel Discussions (2006-2009) | Data Communications & Networking — March 10th, 2010 @ 1:00 pm EST  Reply

[...] Estonian DDoS Attacks – A summary to date, by Jose Nazario, ArborSERT blog, May 21, 2007 [...]

Comment Post by: DDoS Attack on Myanmar Takes the Country Offline | __--::: Deepquest :::--__ — November 4th, 2010 @ 3:12 pm EST  Reply

[...] a few notable exceptions. At 10-15 Gbps, the Burma attack is also significantly larger than the 2007 Georgia (814 Mbps) and Estonia DDoS. Early this year, Burmese dissident web sites (hosted outside the [...]

Comment Post by: Project on Information Technology & Political Islam » Blog Archive » News: “Attack Severs Burma’s Internet” — November 6th, 2010 @ 4:10 pm EST  Reply

[...] a few notable exceptions. At 10-15 Gbps, the Burma attack is also significantly larger than the 2007 Georgia (814 Mbps) and Estonia DDoS. Early this year, Burmese dissident web sites (hosted outside the [...]

Comment Post by: Distributed Denial of Service (DDoS) Attacks/tools « TieuVinhLong — November 7th, 2010 @ 6:33 am EST  Reply

[...] Estonian DDoS Attacks – A summary to date, by Jose Nazario, ArborSERT blog, May 21, 2007 [...]

Comment Post by: n — January 5th, 2011 @ 5:49 pm EST  Reply

these attacks need to be addressed more, its crazy in this day and age we are getting hacked so much and private information is being stolen

Comment Post by: Tools DDos » _AmoresWebDesign -Cyber BlogAmoresWebDesign -Cyber Blog — May 4th, 2011 @ 2:47 pm EST  Reply

[...] Estonian DDoS Attacks – A summary to date, by Jose Nazario, ArborSERT blog, May 21, 2007 [...]

Comment Post by: Distributed Denial of Service (DDoS) Attacks/tools | Chuotnhat.com — May 27th, 2011 @ 12:01 am EST  Reply

[...] Estonian DDoS Attacks – A summary to date, by Jose Nazario, ArborSERT blog, May 21, 2007 [...]

Comment Post by: Ciberguerras e software libre « No sólo software — June 15th, 2011 @ 10:44 am EST  Reply

[...] vez atendida a tipoloxía do ataque (ver tamén os datos), é sinxelo comprender que -a pesar das medidas que se poidan tomar nos servidores destino do [...]

Comment Post by: History of DOS -Denial of Service Attack — September 3rd, 2011 @ 9:00 am EST  Reply

[...] Estonian DDoS Attacks – A summary to date, by Jose Nazario, ArborSERT blog, May 21, 2007 [...]

Comment Post by: DDoS Attacks Links | U.S. Cyber Labs- Cyber NoteBook — September 11th, 2011 @ 4:04 pm EST  Reply

[...] Estonian DDoS Attacks – A summary to date, by Jose Nazario, ArborSERT blog, May 21, 2007 [...]

Comment Post by: seo — November 3rd, 2011 @ 6:16 am EST  Reply

seo…

[...]Estonian DDoS Attacks – A summary to date | DDoS and Security Reports | Arbor Networks Security Blog[...]…

Leave a Comment