{"id":17567,"date":"2022-03-01T00:15:23","date_gmt":"2022-03-01T00:15:23","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/03\/01\/russia-ukraine-cyberwar-hasnt-unfolded-as-expected\/"},"modified":"2022-03-01T00:15:23","modified_gmt":"2022-03-01T00:15:23","slug":"russia-ukraine-cyberwar-hasnt-unfolded-as-expected","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/03\/01\/russia-ukraine-cyberwar-hasnt-unfolded-as-expected\/","title":{"rendered":"Russia, Ukraine cyberwar hasn\u2019t unfolded as expected"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n
\n

As of Monday, five days after tanks moved into Ukraine, the Internet and other key Ukrainian infrastructure were still functioning, the outgunned Ukrainian military was still coordinating effectively and Russia\u2019s vaunted disinformation capabilities were failing to persuade Ukrainians that resistance is futile.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

\u201cWe imagined this orchestrated unleashing of violence in cyberspace, this ballet of attacks striking Ukraine in waves, and instead of that we have a brawl. And not even a very consequential brawl, just yet,\u201d said Jason Healey, a former White House staffer for infrastructure protection and intelligence officer who\u2019s now a research scholar on cyber conflict at Columbia University.<\/p>\n<\/div>\n

\n

A vastly larger, more powerful military \u2014 one especially feared for its cyber-military prowess \u2014 has allowed Ukrainians almost unfettered access to the Internet. This has helped them get weapons to citizens <\/b>and harness social media to rally global political support through direct, emotional appeals backed by stirring visuals.<\/p>\n<\/div>\n

\n

\u201cIt\u2019s certainly not what anyone predicted,\u201d said Dmitri Alperovitch, a longtime cybersecurity executive and U.S. government adviser who heads Silverado Policy Accelerator.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

Ukraine\u2019s core cyberdefense has done better than expected because it focused on the issue after Russian hackers briefly knocked out power to swaths of the country in 2015 and 2016, said David Cowan, a veteran cybersecurity venture capitalist and corporate director, and because it has had help from American and European experts.<\/p>\n<\/div>\n

\n

\u201cI would have thought that by now Russia would have been disabled a lot more infrastructure around communications, power and water,\u201d Cowan said. \u201cIf Russia were attacking the U.S., there would be more cyber damage.\u201d<\/p>\n<\/div>\n

\n

The absence of major disruptions predicted by cyberwar doctrine has allowed Ukraine\u2019s President Volodymyr Zelensky to deliver propaganda coups with little more than a smartphone and a data link. Images of civilian casualties, the brutal shelling of cities and also some Russian losses have undermined that nation\u2019s claims of a limited and humane \u201cspecial military operation.\u201d A viral audio clip of Ukrainian soldiers on a tiny island telling a Russian warship to \u201cgo f— yourself\u201d has become a defining moment of national resistance.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

\u201cIt\u2019s become a global participatory thing. Everybody thinks they\u2019re part of it,\u201d said Doug Madory, director of Internet analysis for Kentik, which tracks global data flows. \u201cIt would be a lot harder to do all that if there was a blackout.\u201d<\/p>\n<\/div>\n

\n

Ukraine has not escaped unscathed, and some experts warn that cyberattacks or Internet outages could grow as Russia\u2019s invasion intensifies in the face of unexpectedly stout resistance.<\/p>\n<\/div>\n

\n

Russia or its allies already have deployed software to wipe data off some Ukrainian computers, including border control offices. But such intrusions are not nearly as widespread as in past attacks such as NotPetya, in which fake ransomware<\/a> attributed to the Russian government caused billions of dollars in damages, much of it in Ukraine.<\/p>\n<\/div>\n

\n

\u201cI do not think the destructive malware had an impact of any significance,\u201d said Vikram Thakur, head of threat intelligence at Broadcom\u2019s Symantec division.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

Russia also may be holding back to some extent, for strategic reasons or because the timeline for the invasion was so closely held that cyber teams did not know what to target or when.<\/p>\n<\/div>\n

\n

An invading army might be expected to quickly cut backbone cables or switch them off through hacks, said Madory, a former Air Force communications engineering officer.<\/p>\n<\/div>\n

\n

But neither has happened. And Madory isn\u2019t sure why.<\/p>\n<\/div>\n

\n

\u201cIs it following the playbook? I don\u2019t know if we have the right playbook,\u201d Madory said. \u201cSo far the Internet is still up.\u201d<\/p>\n<\/div>\n

\n

\u201cYou need to develop access and know how those targets are going to fit into the overall plan of the campaign,\u201d said Trey Herr, director of the Cyber Statecraft Initiative<\/a> at the Atlantic Council.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

He and other experts point to several possible explanations, starting with the possibility that the Russians thought Ukraine would fall so quickly that it wasn\u2019t necessary to damage systems they would want operational once an occupation began. Disabled telecommunication systems \u2014 or ones that are bombed \u2014 can require costly, time-consuming repairs.<\/p>\n<\/div>\n

\n

It\u2019s also possible that the Russians themselves needed a functioning telecommunications system, including high-speed data links, for their own communications. Images from Ukraine have shown Russian soldiers appearing to use smartphones. Modern militaries typically have sophisticated radios for battlefield communications, but glitches might have forced reliance on Internet-based systems instead.<\/p>\n<\/div>\n

\n

Finally, there are downsides to using even the most sophisticated cyberweapons. A system shut down by a hacker can\u2019t be used for ongoing intelligence gathering, typically a high priority in wartime. Even destroyed computers can be replaced \u2015 sometimes within just a few hours.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

\u201cIf I wipe a bunch of their computers today, I can\u2019t do that tomorrow,\u201d said Jake Williams, a former National Security Agency hacker, now on the faculty of the information security research group IANS. \u201cA big question is: When do you pull the trigger?\u201d<\/p>\n<\/div>\n

\n

The best time, he said, is typically at the beginning of a conflict, when depriving victims of the ability to detect attacks and communicate with the outside world can be demoralizing. By the time tanks are rolling in the streets and cities are being bombed, the most effective moment for cyberattacks often has passed.<\/p>\n<\/div>\n

\n

Many experts said they expected more serious cyberattacks to come in the next few weeks, in Ukraine and elsewhere.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

\u201cPutin has not initiated significant retaliation yet for any U.S., E.U., NATO sanctions, probably because he is too busy dealing with the surprising level of Ukrainian resistance and failures by the Red Army,\u201d said Richard Clarke, the first White House cyber coordinator and author of one of the first books on cyberwarfare.<\/p>\n<\/div>\n

\n

\u201cWe still believe retaliation, including cyberattacks, is coming.\u201d<\/p>\n<\/div>\n

\n

Columbia\u2019s Healey said that the more Russia is isolated from Western markets and financial networks, the less it has to lose by attacking them.<\/p>\n<\/div>\n

\n

But for now, Ukraine has rallied to its side a stunningly broad, hodgepodge alliance to fight back on the Internet.<\/p>\n<\/div>\n

\n

Tech savvy cabinet member Mykhailo Fedorov successfully appealed to Tesla founder Elon Musk to distribute Starlink satellite Internet terminals that would withstand cellular network disruptions, and he asked PayPal and credit card companies to stop processing payments in Russia.<\/p>\n<\/div>\n

\n
\n
\n

@elonmusk<\/a>, while you try to colonize Mars \u2014 Russia try to occupy Ukraine! While your rockets successfully land from space \u2014 Russian rockets attack Ukrainian civil people! We ask you to provide Ukraine with Starlink stations and to address sane Russians to stand.<\/p>\n

\u2014 Mykhailo Fedorov (@FedorovMykhailo) February 26, 2022<\/a><\/p><\/blockquote>\n<\/div>\n<\/div>\n

\n

More surprisingly, Fedorov welcomed the contributions from activist hackers, forming a volunteer \u201cIT Army\u201d<\/a> and urging it to hack Russian government and commercial sites.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

Existing cyber activist networks have taken up the cause with glee. One of the most popular Twitter accounts promoting the loose Anonymous movement, YourAnonNews, has been suggesting unorthodox tactics to its more than 7 million followers, such as leaving business reviews on Google maps that pass along to ordinary Russians banned information about events in Ukraine.<\/p>\n<\/div>\n

\n

Though some covert government operatives could be using the cover of Anonymous to contribute to attacks, one of the account\u2019s administrators said it was not working directly with any officials. \u201cWe see many Anonymous activists participating, and the support is overwhelming,\u201d the person said.<\/p>\n<\/div>\n

\n

On Monday, some Russian news sites were hacked and briefly defaced with calls for Russia to pull back.<\/p>\n<\/div>\n

\n

Even the most widely expected alliance, between the Russian government and organized criminal ransomware groups that have long been tolerated or encouraged there, are not following the script.<\/p>\n<\/div>\n

\n

The ransomware gang Conti was first out of the gate with a public comment, declaring that it was loyal to Russia and that it would respond to any attacks on it with renewed penetration of U.S. critical infrastructure.<\/p>\n<\/div>\n

\n

But like many Russian-speaking crime groups, Conti has members in Ukraine, some of whom objected fiercely, said Dmitry Smilyanets, a former Russian hacker who analyzes the gangs for security company Recorded Future.<\/p>\n<\/div>\n

\n

The pushback prompted a revised statement that Conti was beholden to no government. But one angry participant in the group\u2019s closed chats still leaked more than a year\u2019s worth of private discussions that named victims and included drafts of payment demands.<\/p>\n<\/div>\n

\n

\u201cThat leak will destroy Conti,\u201d Smilyanets said.<\/p>\n<\/div>\n<\/div>\n