Pro-Russian cyberattack fells Web 2.0 companies

It now appears that the failure of Twitter and the severe disruption of Facebook and LiveJournal Thursday were a concerted cyberattack against a pro-Georgian, anti-Russian blogger and his LiveJournal, Facebook and Twitter accounts. The attacks attempted to frame the blogger as a notorious spammer but they instead overwhelmed the three company’s servers

For example, USA Today:

A half-dozen security researchers interviewed this morning agree that Cyxymu was the target of denial-of-service attacks that got out of control

The Guardian reports

Max Kelly, Facebook's chief security officer, confirmedyesterday that the attack that disrupted the Twitter site and caused problems for Facebook and LiveJournal was aimed at Cyxymu. "It was a simultaneous attack across a number of properties targeting him to keep his voice from being heard," he said.

The blogger told theGuardian he was quite sure of the source:

"Maybe it was carried out by ordinary hackers but I'm certain the order came from the Russian government," said the blogger, whose monicker is a latinised version of the Russian spelling of Sukhumi, the capital of Georgia's other breakaway republic, Abkhazia.

However, USA Today defends the Russian government from any role

But it makes no sense that the Russian government would use a sledgehammer to squash a mosquito, says Nick Bilogorskiy, antivirus researcher at security firm SonicWall.

Bilogorskiy estimates that it took a few hundred thousand bots sending nuisance messages aimed at Twitter's servers to cut off Cyxymu's Twitter account. In today's cyber underground, it would cost about $5,000 to rent a botnet of that size to conduct such an attack, he says.

I think USA Today is one of the few places dismissing Russian government involvement in an attack designed to delegitimate a highly vocal critic of its foreign policy. As with militias, it is usually impossible for outsiders to distinguish the independent actions of fellow travelers from a concerted attack orchestrated by the national government.

Still, I agree with its point that the attackers have done a great job of making Cyxymu famous and amplifying (rather than muzzling) his voice. (The British press were already covering the 1 year anniversary of Russia’s invasion of Georgia, which went largely unremarked in the US). Fortunately for Cyxymu, this is martyrdom without having to die — almost like a failed assassination attempt.

Meanwhile, Twitter and other Web 2.0 companies will have to learn to strengthen their systems against future attacks.