Russia’s Digital Weapons Refined Against Ukraine

The Petya virus, targeting Microsoft Windows-based systems, spread like wildfire across Europe and, to a lesser extent, America, affecting hundreds of large and small firms in France, Germany, Italy, Poland and Britain.

While many Europeans saw the June cyber attack as just another wild disruption caused by anonymous hackers, it was identified quickly by experts, like Victor Zhora CEO of Infosafe, as another targeted assault on Ukraine. Most likely launched by Russia, it was timed to infect the country’s networks on the eve of Ukraine’s Constitution Day.

The cyberattack started through a software update for an accounting program that businesses use when working with Ukrainian government agencies, according to the head of Ukraine’s cyber-police, Sergey Demedyuk. In an interview with VOA in his office in the western suburbs of Kyiv, Demedyuk said, “every year cyberattacks are growing in number.”

“Sometimes when targeting a particular government agency or official, they mount complex attacks, first using some disguising action, like a denial-of-service attack, and only then launch their main attack aiming, for example, at capturing data,” he said.

Ukraine’s 360-member cyber police department was formed in 2015. The department is stretched, having not only to investigate cybercrime by non-state actors but also, along with a counterpart unit in the state security agency, defend the country from cyberattacks by state actors. Demedyuk admits it is a cat-and-mouse game searching for viruses and Trojan horses that might have been planted months ago.

Eye of the digital storm

Since the 2014 ouster of pro-Russian President Viktor Yanukovych, Ukraine has been in the eye of a sustained and systematic digital storm of big and small cyberattacks with practically every sector of the country impacted, including media, finance, transportation, military, politics and energy. Sometimes, the intrusions are highly tailored; other times, more indiscriminate attacks like Petya are launched at Ukraine.

Russian officials deny they are waging cyber warfare against Ukraine. Zhora, like many cybersecurity experts, acknowledges it is difficult, if not impossible most times, to trace cyberattacks back to their source.

“Attribution is the most difficult thing. When you are dealing with professional hackers it is hard to track and to find real evidence of where it has come from,” he said. “But we know only one country is the likely culprit. We only really have one enemy that wants to destroy Ukrainian democracy and independence,” he added.

Ukraine’s president, Petro Poroshenko, has been less restrained in pointing the finger of blame. Last December, he said there had been 6,500 cyberattacks on 36 Ukrainian targets in the previous two months alone. Investigations, he said, point to the “direct or indirect involvement of [the] secret services of Russia, which have unleashed a cyberwar against our country.”

Ukraine’s cyber-police head agrees. Demedyuk says his officers have been able to track attacks, especially denial-of-service intrusions, back to “Russian special services, tracking them to their own facilities and their own IP addresses.” But the original source of more complex intrusions, he said, are much harder to identify, with the hackers disguising themselves by using servers around the world, including in Asia and China.

Digital weapons refined

Digital intrusions have seen data deleted and networks crippled with real life consequences. And digital weapons are being refined often with the knowledge gained from each intrusion.

Zhora cites as an example of this evolution the difference between two large cyberattacks on the country’s electricity grid, the first in December 2015 and the second at the end of last year, which cut off energy to hundreds of thousands of people for several hours.

With the first attack the hackers used malware to gain access to the networks and then shut the system down manually.

“They sent an email and when someone opened it, the payload was downloaded and later it spread across the network and they used the path created for the hackers to get to the administrator’s work station and then in a live session switched off the subsystems overseeing electricity distribution,” he said.

But with the 2016 attack no live session was necessary.

“They used a malware which opened the doors automatically by decoding specific protocols and there was no human interaction. I think they got a lot of information in the first attack about the utility companies’ networks and they used the knowledge to write the malware for the second intrusion,” he said.

Digital threats to US

In his speech midweek in Washington, Coats specifically cited possible digital threats to America’s critical infrastructure, including electrical grids and other utilities, saying it is of rising concern.

“It doesn’t take much effort to imagine the consequences of an attack that knocks out power in Boston in February or power in Phoenix in July,” he said.

After the second cyberattack on Ukraine’s electrical grid, a group of American government and private sector energy officials was dispatched to Kyiv, where they spent a month exploring what happened, according to Ukrainian officials.

One lesson the visitors drew was that it would be much harder in the US to switch the grid back on after an intrusion. The Ukrainians were able to get the electricity moving again by visiting each substation and turning the system on again manually, an option apparently more challenging in the US, where grid systems are even more automated.

“Virtual attacks are every bit as dangerous as military ones, we are living on a battlefield,” Zhora said.

Ein News

You Might Also Read:

Who Is Behind Petya?:

Ukrainian Security Call in FBI, NCA & Europol:

 

« Kaspersky Says We Can Trust Him
In Demand: New Tech Against Drone Attacks »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Cloud Credential Council (CCC)

Cloud Credential Council (CCC)

The CCC is a leading provider of vendor-neutral certification programs that empower IT and business professionals in their digital transformation journey.

Homeland Security Advanced Research Projects Agency (HSARPA)

Homeland Security Advanced Research Projects Agency (HSARPA)

HSARPA's Cyber Security Division (CSD) was set up to address DHS cyber operational and critical infrastructure protection requirements.

LexisNexis Risk Solutions

LexisNexis Risk Solutions

LexisNexis Risk Solutions provides technology solutions for Anti-Money Laundering, Fraud Mitigation, Anti-Bribery and Corruption, Identity Management, Tracing and Investigation.

Gurucul

Gurucul

Gurucul predictive security analytics protects against insider threats, account compromise and data exfiltration on-premises and in the cloud.

EuroISPA

EuroISPA

EuroISPA is a pan European association of European Internet Services Providers Associations and the world’s largest association of ISPs.

Emirates International Accreditation Center (EIAC)

Emirates International Accreditation Center (EIAC)

EIACI is the national accreditation body for the United Arab Emirates. The directory of members provides details of organisations offering certification services for ISO 27001.

Node4

Node4

Node4 provide advanced, cloud-led digital transformation solutions, delivered with technical expertise, innovation and exceptional service to drive your business forwards.

Triaxiom Security

Triaxiom Security

Triaxiom Security offers penetration testing, security audits, and strategic consulting customized to meet your needs.

Prelude Research

Prelude Research

Prelude offer the first autonomous platform built to attack, defend and train critical assets through continuous red-teaming.

Sentra

Sentra

Sentra is focused on improving data security practices within the cloud, mitigating the risks of damaging data leaks by providing comprehensive visibility into critical data assets.

Apollo Information Systems

Apollo Information Systems

Apollo is a value-added reseller that provides our clients with the complete set of cybersecurity and networking services and solutions.

Cyber-Security Council Germany

Cyber-Security Council Germany

The German Cyber Security Council's objective is to consult businesses, government agencies and political decision-makers and to support them against cybercrime.

Lansweeper

Lansweeper

Lansweeper is an IT Asset Management platform provider helping businesses better understand, manage and protect their IT devices and network.

SecurityLoophole

SecurityLoophole

SecurityLoophole is an independent cyber security news platform with global coverage. Latest updates, reports, news and events related to cyber security.

Catalyst Campus For Technology & Innovation

Catalyst Campus For Technology & Innovation

Catalyst Campus is a collaborative ecosystem to create community, spark innovation and stimulate business growth.

Breathe Technology

Breathe Technology

Breathe Technology has been providing Managed IT Support/ Service Desk, Cloud Services, Cyber Security & Communications to businesses and schools since 2003.