All started with a joint investigation into corruption at Kyrgyz customs released by Azattyk, Kloop, and OCCRP in November and December 2019 that ended up with a lawsuit filed by the Matraimovs family.
The 17th of December 2019 will be remember in Kyrgyzstan by independent journalism as a great battle won by “freedom of speech”, and this is why.
Attacks did not stop the media
According to different public reports the 17th of December a number of alternative media sites were attacked by denial of service attacks, including:
- factcheck.kg
- ecomonist.kg
- kloop.kg
- kaktus.media
- sokol.media
- vb.kg
- knews.kg
- today.kg
- politklinika.kg
The very same day, a fake copy of the Turkish newspaper Sözcü Gazetesi was created (with the URL sozcu.today) which published a fake article reporting that the journalists of Radio Liberty (Azattyk) were involved in the killing of Aierken Saimaiti. Saimati was gunned down in Istanbul on November 10 2010, when secretly providing reporters with evidence of corruption in Kyrgyzstan.
The denial of service attacks and the fake website were launched just before the REaction 2.0 demonstration in Alo-Atto (Bishkek), a second rally against corruption and just before the first hearing of the legal suit of the Matraimov’s family against three media in Kyrgyzstan, namely Azattyk, Kloop and 24.kg.
Attack comes from same infrastructure
Thanks to collaboration between three of the sites affected by the denial of service attacks, Qurium could review and compare logs of their traffic and in record time confirm that the attack signatures matched the traffic that we received against kloop.kg.
Kloop.kg stood online
The attack against kloop.kg started the 17th of December 2019 at 14:15 PM UTC just a few hours after the release of the re-print of the article by factcheck.kg that reviewed social media pictures of the Matraimov family, estimating the money spent on luxury watches, clothes and cars. The article was re-printed and commented by the different online media that later suffered the denial of service attacks.
During hours, a number of news sites were under attack, and many of them opted to make their content only available inside Kyrgyzstan as the attacks were sourced from compromised computers (bots) outside of the country.
Attack signatures match known “stress testing service”
The attack against Kloop.kg started by flooding the website with web requests (GET Floods) that were increasing in intensity as the attacker realized that kloop.kg remained online. At some point, the floods required us to handle 50.000 requests/second that soon piled up our application layer firewalls.
The attacker started with floods coming from 100 computers (bots) that bursted at times to 5000 bots.
The bots originated from Indonesia, Russia, Brazil, India, Thailand, Ukraine. China with high presence of machines flooding from Digital Ocean’s data centers.
The following graph shows the amount of virtual machines from Digital Ocean used during the attack. The attacker combined compromised infected machines (normal users running Windows) with traffic coming from data centers.
The attacker was using the service “check-host” to verify if the website was still reachable. We also noticed in the “check-host” picture that “kloop.kg” is blocked inside Kazakhstan and that is why the monitoring service used by the attacker reports “Connection time out”.
When the attacker realized that application layer attacks (L7/GET Floods) did not work, he changed strategy. At 16:55 PM the attacker started to flood the website with high volumes of traffic. The volumetric attack was composed of “CLDAP UDP” amplification that reached 65 Gbps.
In our infrastructure we recorded how the volumetric attack was increasing with the time. Starting with 250,000 packets per second and peaking around 2 million packets per second.
The attacker also flooded with “GRE” traffic, traffic that is normally used by companies specialized in DDoS mitigation to tunnel and clean attacks.
Attributing the attack infrastructure to “Booter.pw”
The attack signatures are familiar to us as we have dealt in the past with attacks coming from the same infrastructure. With high degree of confidence we believe that the attacks are sourced by the DDoS service: Booter.pw.
Booter.pw was used at the beginning of 2019 to silence dissident voices in the Philippines and the attack signatures match the same traffic that we back-traced back then.
Our reading of these events is that the cyber attacks did not serve to silence the media in Kyrgyzstan. Power to investigatory journalism and solidarity!.
UPDATE: 19 December 2019
During the LIVE broadcasting of the court case, an attack of two hours flooded the page covering the event.
References
- https://kloop.kg/blog/2019/12/18/idet-bespretsedentnaya-ddos-ataka-na-smi-opublikovavshie-novyj-tekst-o-matraimovyh/
- https://kloop.kg/blog/2019/12/17/factcheck-kg-podvergsya-ddos-atake-posle-publikatsii-o-bogatstvah-zheny-matraimova/
- https://knews.kg/2019/12/18/proshla-bespretsedentnaya-ddos-ataka-na-smi-opublikovavshie-novyj-tekst-o-matraimovyh-kloop/
- https://knews.kg/2019/12/17/voznikli-problemy-v-rabote-sajta-factcheck-kg-vozmozhno-vzlom-ili-hakerskaya-ataka/
- https://www.vb.kg/doc/384159_ddos_ataki_na_smi_i_zapretnaia_tema_matraimova.html
- https://www.azattyk.org/a/30331730.html
- https://www.azattyk.org/a/30331611.html
- https://www.azattyk.org/a/30331294.html
- https://rus.azattyk.org/a/30331651.html
- https://economist.kg/2019/12/18/proshla-besprecedentnaya-ddos-ataka-na-smi-posle-publikacii-rassledovaniya-o-matraimovyh/
- https://kaktus.media/doc/403002_ddos_ataka_na_internet_resyrsy_v_kyrgyzstane:_osnovnoe_kibernapadenie_shlo_iz_kitaia_i_uar.html
- https://kaktus.media/doc/402968_riad_saytov_smi_podverglis_ddos_atake_posle_pyblikacii_materiala_o_jene_rayyma_matraimova.html
- https://kaktus.media/doc/402976_iz_za_ddos_ataki_kaktus.media_otkryvaetsia_poka_tolko_v_kyrgyzstane.html
- https://24.kg/obschestvo/138321_tratyi_jenyi_matraimova_DDoS-ataka_sayta_Factcheckkg_prodoljaetsya/
- https://24.kg/obschestvo/138261_hakerskoy_atake_podverglis_saytyi_spublikatsiey_otratah_jenyi_matraimova/
- https://pk.kg/news/16714
- https://today.kg/news/177152/
- https://today.kg/news/176896/
- https://today.kg/news/176710/