A Thursday denial-of-service attack that took down Twitter and caused disruptions for Facebook and LiveJournal was reportedly a coordinated attack on a single blogger.
The target is apparently a Georgian blogger known as Cyxymu, according to Mikko Hyponnen, a researcher with F-Secure. The attacks affected Cyxymu's Twitter, YouTube, Facebook, and LiveJournal accounts, and also resulted in spam messages sent from Cyxymu's account.
"Launching DDoS attacks against services like Facebook is the equivalent of bombing a TV station because you don't like one of the newscasters," Hyponnen wrote in a blog post.
"Whoever is behind this attack, they had significant bandwidth available," he continued. "Our best guess is that these attacks were done by nationalistic Russian hackers who wanted to silence a visible online opponent. While doing that, they've only managed to attract more attention to Cyxymu and his message."
Cyxymu's Twitter account has since been restored. In a Tweet posted about eight hours ago, he blamed the Russian KGB for the attack.
Facebook confirmed to CNet that Cyxymu was the target of the attack. Facebook did not immediately respond to a request for comment.
Twitter did not provide any details on what took down its site. "As to the motivation behind this event, we prefer not to speculate," co-founder Biz Stone wrote in a blog post.
"The continuing denial of service attack is being mitigated although there is still degraded service for some folks while we recover completely," Stone wrote. "Please note that no user data was compromised in this attack."
Stone noted that the "attack was a reminder that there's still lots of work ahead."
In a separate blog post written later that morning, Stone said that the attacks "appear to have been geopolitical in motivation. However, we don't feel it's appropriate to engage in speculative discussion about these motivations."
LiveJournal said in its own blog post that the site was up, but still experiencing some connectivity problems. "LJ may behave a little quirky for the time being," the company said.
UPDATE: McAfee also confirms that the attack was targeted at Cyxymu.
"Reportedly, the attack packets sent to the targeted social-media sites were requests to fetch the pages hosted for this user, who had just a few days ago blogged about the upcoming one-year anniversary of the war between Georgia and Russia," McAfee's Dmitri Alperovitch wrote in a blog post.
The spoofed spam sent from Cyxymu's e-mail address "appears to have been distributed, at least partially, by the same botnet as the one that was used for the DDoS," he wrote.
About 29 percent of the machines spreading the spam were located in Brazil, McAfee said.
The target is apparently a Georgian blogger known as Cyxymu, according to Mikko Hyponnen, a researcher with F-Secure. The attacks affected Cyxymu's Twitter, YouTube, Facebook, and LiveJournal accounts, and also resulted in spam messages sent from Cyxymu's account.
"Launching DDoS attacks against services like Facebook is the equivalent of bombing a TV station because you don't like one of the newscasters," Hyponnen wrote in a blog post.
"Whoever is behind this attack, they had significant bandwidth available," he continued. "Our best guess is that these attacks were done by nationalistic Russian hackers who wanted to silence a visible online opponent. While doing that, they've only managed to attract more attention to Cyxymu and his message."
Cyxymu's Twitter account has since been restored. In a Tweet posted about eight hours ago, he blamed the Russian KGB for the attack.
Facebook confirmed to CNet that Cyxymu was the target of the attack. Facebook did not immediately respond to a request for comment.
Twitter did not provide any details on what took down its site. "As to the motivation behind this event, we prefer not to speculate," co-founder Biz Stone wrote in a blog post.
"The continuing denial of service attack is being mitigated although there is still degraded service for some folks while we recover completely," Stone wrote. "Please note that no user data was compromised in this attack."
Stone noted that the "attack was a reminder that there's still lots of work ahead."
In a separate blog post written later that morning, Stone said that the attacks "appear to have been geopolitical in motivation. However, we don't feel it's appropriate to engage in speculative discussion about these motivations."
LiveJournal said in its own blog post that the site was up, but still experiencing some connectivity problems. "LJ may behave a little quirky for the time being," the company said.
UPDATE: McAfee also confirms that the attack was targeted at Cyxymu.
"Reportedly, the attack packets sent to the targeted social-media sites were requests to fetch the pages hosted for this user, who had just a few days ago blogged about the upcoming one-year anniversary of the war between Georgia and Russia," McAfee's Dmitri Alperovitch wrote in a blog post.
The spoofed spam sent from Cyxymu's e-mail address "appears to have been distributed, at least partially, by the same botnet as the one that was used for the DDoS," he wrote.
About 29 percent of the machines spreading the spam were located in Brazil, McAfee said.
Comments
Post a Comment