HSM 438 - Cyberterrorism and Information Warfare: Case Studies

This case study analyzes three major cyberterrorism and information warfare events: the Russian denial-of-service attack on Estonia in 2007, cyberattacks during the 2008 South Ossetia war between Georgia and Russia, and the US State Department computer compromise in 2006. For each case, it identifies the victim and aggressor, explains the type of cyberattack used (denial-of-service or malicious code implantation), details the technique and outcome, and outlines the victim's subsequent preventative measures. The analysis compares and contrasts the attacks, concluding that robust antivirus software and regular network monitoring are critical for preventing future recurrences. The document emphasizes the importance of updated antivirus systems to protect networks from malware.

Running head: CYBERTERRORISM
Cyberterrorism or Information Warfare
Name of the student:
Name of the university:
Author note:

1CYBERTERRORISM
Russian Denial-of-Service attack
The cyberterrorism took place on 26th April, 2007 making Estonian government victim of
the attack. The attack was performed to protest against the removal of Bronze soldier monument
in Tallinn that was done by the Estonian government (Von Solms & Van Niekerk, 2013). The
government websites were targeted by the attack along with Estonian banks, universities and
newspaper. The full-scale cyber-attack was performed by an unknown attacker against the
government. The attack was not determined in the first twenty-four hours however was
discovered by Jaak Aaviksoo who was unable to log in to prime ministers website of Reform
Party.
The type of cyber-attack that was performed on Estonian government websites was
denial-of-service attack. The attack blocked access of authorized users to the network making the
entire network unavailable. The communication between the servers and users were blocked. The
attack was done in the form of distributed denial-of-service attack that destroyed information
infrastructure. Attackers targeted the government website first and then spread the attack further
to other political party that included Estonian parliament official site (Dunn Cavelty, 2013).
News publications were also targeted in the following weeks. The banking system of the country
was brutally damaged blocking online banking operations for Estonians. As a step to solve the
problem, international traffic was blocked by the Estonian government. It took the decision of
separating Estonia from rest of the world.
Cyberattacks during the 2008 South Ossetia war between Georgia and Russia

2CYBERTERRORISM
The attack was performed on August 7, 2008 against Georgian government websites. It
was described as a war between Russia and Georgia guided by cyber-attacks due to political and
military unrest between them (Clarke & Knake, 2014). Website of Georgia’s president was first
targeted. The Russians were the aggressor of the cyber terrorism. Russia controlled various
government websites of Georgia that includes commercial websites. However, the accusation
was strongly denied by a Kremlin representative who said that instead a number of Russian
media websites were falling victim of a series of cyber-attacks.
The type of attack that used was distributed denial of service attack. Georgian internet
servers were turned into zombies and servers based in Turkey and Russia rerouted the traffic.
Russian hackers controlled both the servers (Kozlowski, 2014). Even Germany was able to route
the traffic temporarily. Hacking was also used by Russian hackers to hack Georgian President
website and posted images that compared the president with Hitler. The Georgian government
announced a state of war to prevent further cyber-attacks. Estonia helped Georgia to overcome
the situation of cyber-attack even though Georgia did not request help.
US State Department Compromised Computers in the East Asia Bureau in July 2006
The cyber-attack was done in late May 2006 making an employee in East Asia Pacific the
victim. The aggressor of the cyberterrorism was US State Department. The attack was performed
by implanting malicious code on employee computer (Broadhurst & Chang, 2013). Initially the
e-mail was legitimate and was sent to email address of actual Department. An attachment with a
word document was sent and when the employee clicked on the attachment, backdoor

3CYBERTERRORISM
communication was established by hidden malicious code outside the Departments network
through Trojan horse.
To prevent these type of attacks through emails in the future, strong anti-virus needs to be
installed in every computer and servers. This would protect the computers from malicious codes
that might turn the whole network into a zombie (Rosenzweig, 2013). Regular monitoring of the
network might also be beneficial. The victim of the attack can take immediate action once the
attack is detected. Loss of vital information will be reduced if immediate actions are taken
against the attack.
The two types of attacks that are identified in the above cyber-attack case studies are
distributed denial-of-service attack and attacks through implanting malicious codes. Both type of
attacks leads to loss of important information however, the methods through which it is
performed are different. In distributed denial-of-service attack, a computer is selected where
virus would be introduced. The computer is termed as a bot. The virus will be communicated to
other computers and thus the entire network through the bot. The network would then be termed
as a botnet. Any communication of data between server and computer within the network is
denied.
Malicious codes are sent through emails that are kept hidden. Once the victim clicks on
the attachment the malicious code spreads all over the network. Both these attacks can be
reduced by using strong anti-viruses and regularly monitoring the network. The existing anti-
viruses needs to be updated to protect the network from malwares.

4CYBERTERRORISM
Reference List:
Broadhurst, R., & Chang, L. Y. (2013). Cybercrime in Asia: trends and challenges. In Handbook
of Asian criminology (pp. 49-63). Springer, New York, NY.
Clarke, R. A., & Knake, R. K. (2014). Cyber war. Tantor Media Incorporated.
Dunn Cavelty, M. (2013). From cyber-bombs to political fallout: Threat representations with an
impact in the cyber-security discourse. International Studies Review, 15(1), 105-122.
Kozlowski, A. (2014). Comparative analysis of cyberattacks on Estonia, Georgia and
Kyrgyzstan. European Scientific Journal, ESJ, 10(7).
Rosenzweig, P. (2013). The alarming trend of cybersecurity breaches and failures in the US
government. Heritage Foundation.
Von Solms, R., & Van Niekerk, J. (2013). From information security to cyber security.
computers & security, 38, 97-102.