Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2632 Thanks!
[Music]
so please welcome Johannes click with
how to use internet scans and passive
measurements to analyze Russian attacks
and their impact in
[Applause]
Ukraine hello welcome my name is Janna
click I'm here for talking to you about
how to use internet scans and massive uh
and passive measurements jaliz Russian
attacks and the impact in Ken I'm C
co-found of iast Labs is a company about
which is does scanning whole the day the
internet and then we do also a lot of
research have also published last uh C
communication Camp I have published here
a talk how to uh set up a search engine
and which ways you can globally scan the
internet several times and now we use
much more of this data for making
Advanced research so but before we start
with the Russian Tex and uh how how we
can measure the impact using Global
Internet scans I'm here more also to
talk about why the resilience of the
Ukraine in terms of Internet is so high
so maybe so at first it's really sad
that the power of the Beamer is not that
high I I hope you can see something um
interesting point is that when we talk
about Ukraine we can see that
approximate 55% of all ant users in
Ukraine are served by very small isps so
we can see this there in in a circle we
can see that like a 40 45% are served by
larger isps which serve more than 1% of
the of the whole end clients but 55% of
all ant clients in Ukraine are served by
an ISP that is managing less than 1% of
the whole of the whole clients in
Ukraine when you compare to Germany uh
on the next slide we can see that in
Germany in comparison to that only
18% of end users are managed by very
small isps less than less than 1% so we
can see that in Ukraine we have much
more diversity in terms of small isps
they are each connected to each other
and when one isps has maybe no power or
maybe Felts out the traffic can go root
through another ISP and this makes it
much more resilient here in Germany we
have approximate onethird of all end
clients are on deut Telecom the another
third is on waterphone this means at
least when one of these isps get knocked
out by somehow of a strike we will have
big troubl in Germany and we are not
thinking next point is also the day
kakes right that's also a point but in
Ukraine they have a a huge amount of
very small isbs serving approximate uh
half of the whole end clients we have
there and this makes us the internet
itself ukra very robust compared to
Western
countries um before I I explain about
the the U results we have I just want to
tell something about how we collected
the data so what we are we are our our
own internet service provider we have uh
our um two different sl22 this means
over 2,000 different IP addresses which
we use for internet scanning this means
we are scanning the internet and each
time when we connect to a new system we
use a new IP address and this leads to
the fact that we like half an hour we
visit with the same address the same
network so each each 30 minutes this
gives us very good opportunity to be
under the radar of a lot of intrusion
intrusion detection systems and prevents
a lot of of uh blocking um our staff has
been developed in a free University of
Berlin financed by the Federal Ministry
of Education research in former times it
was around 15 um 14 to 1517 then we
founded out of that company and did some
cool interesting stuff and and now we
are coming to to the point that we when
we are doing all the time the internet
scans and see okay where are the clients
we have seen especially in the Ukraine
When The War started that a lot of
clients availability dropped and we said
okay that's that's very interesting we
need to investigate it because it makes
sense when maybe a lot of power outage
we have and we know that the Russians
have attacked a lot of critical
infrastructure um in the Ukraine then
where where is no power there's also a
high chance that you have no internet
because also routers and so on need a
lot of power right and especially in the
end in the small office home office in
the from the people uh whereas not the
small routers no power there will be
also no inter it that is why we have
taken um as base reference for our
analyzis October 21 which is approximate
so half a year before the Russian
started their attacks as a reference
said okay this amount of servers we have
seen is uh the 100% the Baseline and
then we have seen how are the services
behaving when uh uh when the Russians
started their attack and here we see the
first chart I hope you can see it
somehow on the left we have started by
100% for different protocols for https
SSH HTTP host DNS host sntp hosts and we
can see in the middle of the chart that
there uh there's approximately March 20
in the end of February beginning of
March 22 where the red error is is is
somehow seeable uh we can see there's a
huge drop in service availability this
is here for instance this is a special
area of Ukraine this is in the Northeast
Ukraine this is Northeast also from from
KV this is the region where when we have
here uh CH this is the upblast of KV got
invaded uh via B BOS and Via Russia and
got occupied by approximately uh 70% and
we can see that during the occupation a
lot of services in that area went down
especially the web services and also the
mail services but one service still was
very steady this was
DNS and this some of we thought okay
that's very interesting we can see a lot
of services Dro by approximate 60% but
only DNS is quite still stable when we
compare now especially the uh the
results from the be from the end from
the beginning of March with the end with
beginning of April we can see that in
the beginning of April we remember the
Russians had a lot of logistic problems
they needed to retreat going back to
Bellos Etc and then they released KF
right and then we can see the services
are going up again again so some people
said that um oh maybe they have just
fixed the infrastructure and then the
services go up right but we see that all
the time DNS is very steady we have
talked to some companies that have third
party providers based in Ukraine and
they told us that before the Russian
have invaded them they have shut down
the system for data data Integrity
protection and also Data Theft
Protection right and that's why
they have brought down their servers but
DNS was still active because if you have
ever tried to boot up a whole ad Windows
infrastructure without DNS it's not
possible right that is the last core
Services you you will remain and that is
why we see that we have seen DNS was
quite steady and all other services REM
went down by 60% and after the Russians
uh retreated and went back to to to
their country into bellarus it went up
again right this was very interesting we
have seen this kind of behavior and seen
okay we need to now make more intense
scans on a uh on an hourly basis to
understand and to see maybe we can also
see where some Russian Rockets attack
some power plants and if can maybe see
if in that region we can see that a lot
of servers are also going down and going
up after some our hours when the power
when the power is up again and this I
will show that here we can see also a
very special case that is a Mario pool
you can maybe see we have also set 100%
for all protocols and then for all
protocols at when against goes down by
90% right mariole is a city it go it's
very close uh uh to the was CI that was
attacked very hard very first by a lot
of by a lot of critical uh air strikes
and so on um on the right side you could
normally see data from the European
Space Administration they have done some
radar scans and have seen that
approximately 90% of all buildings are
now like 10 up to 50 M lower than before
because they got completely destroyed
right and using our internet scans we
can also see that approximately 90% of
all Network Services we have identified
in that region are also not existing
anymore since the begin of the invasions
and the attacks of the Russians this
means we could also just sitting here in
Berlin scanning from our from our IP
addresses we can just use it like a
radar looking if you're up are you up
are you up oh no you're down then we can
see that 90% of all service in Mar pool
went down like uh in the first two weeks
of the attacks by the Russians and 90%
are not still available anymore and this
shows us that also for for for for a
long time for for at least three months
this shows us that you can use internet
scans for use some kind of battle damage
assessment to see how how how um how big
is the attack and and how big is the uh
in the end the the result of the attack
also for for the region this information
is for instance impossible uh important
for when you are the uh Ministry for
foreign affairs and you support some NGS
for instance right then they it would be
very interesting to see how big is the
grade of D structions in a certain area
and you you can use this kind of
information for for for for rough
estimation so what we then did is that
we said okay we have selected 400,000
static IP addresses in Ukraine it's like
having ventage points Vantage points for
for meion ring and and then we have
scanned these 400,000 static IP
addresses every 4 hours just for looking
when the uh when a certain region
services are going up or going down
very important static is very important
because if you use Dynamic IP addresses
Dynamic IP addresses are very often up
or down because people switch off their
mobile rout or get a new IP address
whatever that is why we have us and
stting choos and staing IP addresses and
as you can remember we know that
especially in October 2022 this was the
first big attack of the Russians against
the critical infrastructure um of the
Ukraine um a lot of reports also from
Reuters uh has shown this was the first
well-known Russian attack against the
critical infrastructure and then we have
ch choosen open source intelligence here
on the right side you can see somehow a
map from Wikipedia which has uh
collected tons of uh reports from social
medias and also from newspapers where in
a certain region Russian have attacked
and where uh we have received uh a power
outage in that region and the
interesting point is that um let's uh in
the end in in all regions where we have
seen that the open source intelligence
says or here the social media says there
was a power outage we can also see that
we have a drop in our scans so for
instance here we can see on the map uh
on chani which is in Northeast this is a
country that which got not uh this is an
oplas like a um state of the Ukraine um
which is uh which got not directly hit
also received not a power outage but all
surrounding states of or up blasts of
Chev have received re power outages and
we can also see this in the in the in
the data on the right side uh when you
can see a small drop this is a drop we
can see on the power outages in Chan
because all the Border regions uh also
received a power loss and for making uh
showing you that also the the opper side
also works very well we can see that in
Odessa which is in the southwest of
Ukraine uh we can see there was no power
outage given by the social media and in
other newspapers and there we can see in
the data a Qui steady steady uh steady
um line on the availability of the
Network Services now we are going
directly to to sui which is an upblast
which which received a bigger power
outage and there we can see here on the
right side a big drop by approximate uh
90 up to 80% across all protocols right
when we remember we have seen the CH uh
first stuff we have seen there was still
DNS was still running in that case we
can see that HTTP SSH https and DNS all
services went down exactly at the moment
as the social media also reports there
has been Russian attacks in critical
infrastructure and also says there was a
power outage and we can um just say okay
yes we can also measure measure that
this is also and we can also estimate
here we can see the power drop we can
just estimate that the that the power
outage was around 12 hours so we say
when when Approximately 80% of all
services up again we say the power
outage is over right there we can very
good see we can see like after 12 hours
uh 80% are are reached and then they
took like three further days to get up
to the 100% right and that is very
interesting so also when you're an Eng
it's very interesting to understand how
many fuel I need to take for for for
covering these power outage time for
instance right or or how to maybe um
what kind of turbines do do energy
turbines do ukra need and so on so this
is very interesting data because you can
just on the social media you can just
see there was some kind of power outage
but you can't hard measure how long it
is and here we have very good qualified
data for doing that so this was this
data here was for for sui we can also
see this uh for Paul tver PA tver is the
same we can see here here on the right
side a drop ac across all protocols and
also here in this time this was eight
hours um but it was not that big was
approximately only by 30% 40% the drop
we can also see this here for Tano peel
there was a first strike on the night
from the 6th to the 7th October and also
on the uh on the on the 10th October we
can see also bigger drop and then what's
very interesting we can see here they
have been fighted really really long for
getting up to the 100% because at first
they just went to the 80% and then we
get up and they get down Etc you can see
that the net the energy grid was very
was very unstable for at least three up
to four
days um so here we have just the uh a
table uh which shows us um where power
outage uh has been detected uh by the
open source and social media and what
our results is showing and we have um we
can see that very often when we have yes
powerage detected we also our mechanisms
that detected in it or our algorithm and
we did a piercing correlation
coefficient analyz coefficient analyzes
and we got a strong correlation because
we got a result from
074 which indicates a strong correlation
using our methodology for detecting
power aages in Ukraine uh has a strong
correlation to the open source and
social media
reports so this means that the algorithm
and the technology is working and it's
very interesting so now we can see uh on
the next uh like approximate half a year
later on the n9th of March the Russian
attacked again the critical
infrastructure of the Ukraine and um the
very interesting point is then we
measured it again and this time we can
see for instance here for de
prop oh sorry for that name but
neov opas there was only a small power
outage like 20% for eight hours we can
also see this here for korot which was
also a very small power outage like 40%
only for 8 hours so when we now go go go
further and investigated it we
understand we we have seen here that on
the October the power outage was every
time like 80% for for 12 up to 15 hours
and then it took like 3 days they they
recovered completely to 100% but half a
year later the Russian attacks are not
so have not such big impact because here
we can see power outage is now only
maximum 80% very close to the 100 100%
then it's easy
I talked to some Ukraine guys and they
said yes because we learned to deal with
that a lot of Ukraine civilian people
have now small energy uh turbines
generators and so on and they sales
power them for for the time of the out
for the outage we have also the United
United States have provided big very big
um Power um power generators huge
turbines like uh like big horse um that
are able to distribute power for whole
District of the city so they distributed
the power supply of the Ukraine using
mobile generators the civilians on their
own and also by the government supported
by the by the by the Germans and the
United States and we can see in our
measurements that the impact of the
power outages are much lower than before
because we can see it's not over the 50%
before we had like 80 90% now it's
maximum 50% and also the time of the
power Al has decreased by 50% because we
now have only like 8 hours up to the
100% that's very interesting to see that
the Russian attacks against the power
critical power grid is less efficient
than before in October and that is
measurable by internet scans this is so
fascinating right that you can sit here
and see the data and analyze it from
home not being there but you can make
very interesting research about these
kind of topics okay now we are also
looking for the Russian control right so
we have here Zaba which is under Russian
control and we can see that the power
attacks against zaban against the
Russian controlled area has no impact so
we can see that the Russian are not
attacking their own region right they
are not impacted by their own attacks
because there also a cross check you
have to do right maybe there's some
general failure in my methodology but
this is very interesting to see that the
Russians are all the time steady in
their controlled area and that they
attack only the Ukraine power grid
system and they don't not impact
themselves okay this was about kinetic
strike detection and to understand how
you can use internet scans for for
detection and and to analyze it now we
are going to more presumably Russian
attacks so very interesting is we have
Kon Kon is a city which was very heavily
contested and which went under uh under
control um uh in the end of March and
April and the Russians and we can and
what we can see here is the bgp
dependency graph this means we can see
here from Kon Telecom which is an ISP uh
an internet service provider of Kon we
can see where do they give uh or or what
do who is the main Upstream provider of
kosom Telecom right so this means when
you serf on on your network where is the
traffic for Kon Telecom clients going
through and here we can see it's uh uh
it was um taken by ukom line ukom line
was the Upstream provider of carom
Telecom and in the beginning of of May
in the 1st may we can see there is a
switch the switch there's a switch that
they have give 100% of their traffic to
ukom line which is Ukraine ISP and then
there was a switch to Miranda is Miranda
autonomous system so who is Miranda just
looking Miranda media limited is the ISP
is the new Upstream provider of Caston
Telecom in the 1st of May there was a
change on the bgp data very interesting
1 first of May is also an holiday in
Ukraine right day of Labor and we can
see Mir limited is an ISP which is has
been founded in 2014 on the CR
interesting right and when we see ALS on
the r data they stat it's in Kier and
belongs to the Russian Federation so we
see it looks like an Russian ISP doing
some more
investigation uh we can see here that uh
that also Miranda limited is responsible
for the internet SE cable that connected
cremier and Russia Mainland right and
very interesting point is that this
internet cable was finished uh in 2014
very close to the invasion to cremier
and the and this uh internet cable was
also uh provided by a Chinese cable
layer called Ying gong one right isn't
this fascinating to understand these
these political behaviors behind that so
we have here clearly an Russian ISP and
an ISP that has all so um operating a c
cable connecting chier and Russian
Mainland and so it makes totally sense
that they are the new Upstream provider
of Kon Telecom a city they have
invaded and very interesting is that you
can see later uh there was on the four
of May uh uh we can see there somehow
back switch to data group as going back
to to to an Ukraine ISP and then there
has also New York Times report uh uh
which says yes um very very important a
lot of different reports especially in
Kon U Russian people arrived Russian
soldier arrived and tried to get control
about um the internet infrastructure and
also telecommunication companies so this
time here in the first time of War we
can really see that the internet as a
part of critical infrastructure is also
a tactical objective obviously right so
Russians came and say please switch off
your roots going to Miranda that's how
it's how it's working and interesting
point that uh we can see so here we can
see that on the for M there was switched
back to the Ukraine ISP and it looks
like then they used maybe more forces or
so there different uh there's a huge
topic on on on on the Facebook channel
of channel of uh Kon Telecom where the
CEO says yeah there was no connection I
was not forced by the Russians but I
thought it's better to use the Russian
internet than Ukraine because it's more
stable and so on and so on right so but
it's very hard to say here from Germany
what's the really true but we can see
that um in the end of May the 31 may we
can see since November 2022 it was all
the time Miranda s was the primary
Upstream provider of Kon Telecom and
then we can remember that in N no in the
9th November the the Russians retreated
from Kon they went back and interesting
is we can also see this in the bgp data
because exactly to the 9th November Kon
Telecom has no Upstream provider anymore
Russians have cuted the lines and then
they moved away from Kum right and this
is also seeable by the bgp data very
interesting is Caston Telecom went never
up again they are now completely away
and I have heard some rumors that the
CEO of Caston Telecom went also in
prison or gets accused but this is still
some some Social Media stuff right it's
very hard to prove the truth we can just
see here the data on the bgp and we can
see that the Russians have somehow tried
to get the control about the Upstream of
Caston Telecom in the end of May they
have received the control all traffic
went through Caston Telecom it's very
important because for censorship of
course you can also identify maybe
partisan troops try to communicate using
the internet whatever and uh then when
they retreated from Kon um The Alliance
got cut and we can see no connection
anymore from Kon
Telecom so this was the second part now
we are coming to the third part of the
talk um we also operate a third sl22
just as a black sensor
Network it's uh under a name from a
different company and the black sensor
Network we call it internally the Cyber
ealon right um this means it's just
collecting um the data just when you
make some ping probe some TCP Sy traffic
whatever it's just it's a syn Hol it's
just recording all the data and then
riches the data who is connecting what
is the uh uh um what is the autonomous
system from the IP addresses that get
sent from and so on but you will never
receive an answer from this black hole
network using this we can also
understand how are people scanning and
if maybe there's a new RDP vulnerability
for instance we can use this kind of
technology to see who is scanning for
new RDP ports or for new vulnerabilities
and so on that is for why we have the
sensor network but the interesting point
is um that we have approximately 11 16
million packets per day and uh the Mage
the 90 over 90% of all the data is TCP
data we receive 5% UDP data 3% icmp
pinks so and the interesting point here
is that we can see here on the left are
we can see nothing but I will now
explain the chart okay so imagine it's
like that and then we have time of war
and then IM immediate increase of the
TCP packets we receive from the Ukraine
so suddenly this war begins and we
receive a lot of traffic from the
Ukraine on our sensor Network and that's
very interesting we thought why so when
we try to understand TCP hand check
normally you send a sin you get a sin
act back then you s an act connection
established layer for communication very
easily and then we have looked what kind
of packets do we receive and then we
have seen we receive Sy act packets so
this means we receive packets from
server they say yes we uh it's okay that
you tries to connect to me I want to set
up a connection also to you right makes
no sense because we have a black hole
sensor Network we have never sent some
kind of connection requests so why do we
receive Sun act communication and then
uh we have thought about and said okay
makes sense somebody is spoofing
randomly IP addresses sending it out
against Ukraine targets and then Ukraine
targets are responding with sin packets
back to our sensor Network because when
you randomly spoof IP addresses you will
also randomly spoof some IP addresses of
our black hole Cent networks we have
1,000 IP addresses there will be some
when you send tons of packets there's a
very good chance that you will also
spoof some of our IP addresses so just
to illustrate it the attacker is is
sending spoofed sin packets to the
Ukraine victim and the victim is
replying with sync packets and some of
the syn packets are also hitting our
sensor Network and in that way we can
identify who is the victim of the DOR
attack right so we can see um we can see
that especially in the beginning of
April so on a chart you can't see here
but you have to imagine now um we can
see that in the beginning of April the
first April there's a high Spike up to
the end of May and then uh uh then is
any anything anymore right so somebody
has somehow fired a DS attack against
Ukraine server and in that case we have
looking who who is the IP address that's
sending us the Sy packet it Wars
president go UA right so somebody dos
president gol UA by randomly spoofing IP
addresses and it's very easy to do that
it's also hard to fight against the kind
this kind of traffic and you just rent
some bulletproof holer which allow soon
uh uh TCP IP spoofing and then you can I
don't know for500 you can also get 10 GB
connection and then you try get to fire
against it the problem is again this
kind of traffic is it's very hard you
it's not that you receive DS traffic
from a certain autonomous system and
then it's very hard to block because you
receive completely uh different packets
from a lot of different isps because
they randomly spoof the IP addresses but
the other point on this kind these kind
of attackers you have to buy a lot of
bandwidth normally there was also
another talk today uh uh to ours before
very often DS attacks are also executed
that you try to identify multiplier like
DNS or ntp server you send traffic and
they send a 10 or 20 times amount back
to the victim in that case here we have
people that are spoofing IP addresses
and sending it directly to to the victim
and the victim is replying somehow to us
because they also spoofed our IP
addresses and we can see that the
exactly in the beginning of April first
April they started the attack and the
end of April they finished and then we
can also see that in the beginning of
may they started the attack ring up
going down the end of May and then exact
on the on June they are starting the
attack and the end of June they stopped
so we can really see a very good pattern
uh on these kind of Russian attacks it's
it's so it's in the beginning of the
month it's it looks like somebody has
paid maybe somebody for doing something
then starting on the 1st of May yes sir
we are starting on the 1 of may you know
so it makes no sense that you really
start in begin exactly the beginning of
the month your leers attack so that's
like a freelancer hacker would never
work like that right so starting exactly
on the on the first of the month um yeah
very interesting to see that so the
second attack we have investigated here
uh on the beginning of June and the
beginning of July was uh booking uh go
UA this is a portal where you can book
your train stuff where you can get your
tickets where you can travel around
Ukraine which is also important for
truth movements because also the Russian
soldiers move by train of course when
they go home for some stuff and so on
and so we can also see they have
attacked the uh the the presidential
website and also the critical
infrastructure the train system the
booking
system okay so also so now putting stuff
in a nutshell we can use internet scans
combined with open source intelligence
data and also satary iny we remember on
the European space ad Administration
picture of Mario pole and we can Al to
make strong correlations for various
events in the Ukraine in the in the
Ukraine Russian conflict we can use very
intense internet scans like we have done
in the scanning the Ukraine the static
server every four hours uh to measure
the impact of kinetic attacks by the
Russians or to do or to use it for some
kind of better damage assessment to see
how efficient are the Russian attacks
and we can um also also another Point
imagine that somebody on social media
says a huge nuclear bomb or whatever has
exploded somewhere you could also use
kind of stand to make some kind of fake
news detection because if you have
really really large Dam damage event
somewhere you could use these inent
scans also to verify these kind of
information are there really strongly
hit is there really a large bombing
whatever then we would see that in our
data so you could also use this kind of
approach for fake news detection in the
end or for
verification um we have also learned
that Ukraine internet consists of much
more small isps compared to the Germany
they are much more resilient because
more than 50% of the end clients are uh
are served by very small isps that are
serve less than 1% of the whole clients
we can use the bgp
data um to to understand who who is
trying to to capture critical
infrastructure especially to
communication infrastructure and to root
traffic through their own country for
censorship for instance and we have also
learned that we can use the black hoold
sensor Network for understanding
um who is the victim in Z Ukraine for
certain type of DS attacks and uh we
have also seen that in the D attacks we
have investigated there is some kind of
compaign of campaigning because the
attacks started every time on the first
of the month and ended in the end of the
month which shows us this is some kind
of foreign cyber campaign maybe behind
it okay so this was my talk I thank you
very much for your attention I know it
was very hot
[Applause]
and we do have a few minutes for
questions please line up at the
microphone countries in Europe are
divided approximately equally right now
in terms of which ones require
registration of identity uh to obtain
SIM cards and those that don't uh the
Russo Ukrainian war is between two
powers on opposite ends of this spectrum
in Ukraine no registration is required
in the Russian Federation it is well
this is less relevant now as the Russian
troops Retreat early in the war um
Russian troops were obtaining uh
Ukrainian SIM cards through looting and
other measures um that uh enabled them
to stay in touch and coordinate because
they were given inadequate radio signals
equipment um and uh one of the
interesting question questions at the
time was how open source uh foreign open
source intelligence operatives or the
Ukrainian uh government could try to
determine uh which side of their signals
to intercept or disrupt um given that no
registration was available is this a
problem you've encountered or how would
you recommend as a strategy in this
theoretical scenario well so mobile
network communications was not part of
my talk it's a very it's it's it's a
very good question but uh in the end um
I'm not expert for the mobile network
communication I can just say from
Network perspective that the mobile
Communications are mostly behind the
network address translation and that and
that you can't reach them via the scans
very often so that's why they are out of
my scope because I cannot scan them
right so that's why I'm I'm not dealing
about I'm sorry I have no good question
it's not my my
subject hi thank you for the talk uh you
mentioned this provider in Kon which is
now gone uh do you have any indication
what the clients of this provider are
now doing have they switched to another
one did you see any increase for in
another ISP uh good question um this is
a very interesting point we have not
investigated that but uh if you maybe
give me later a card or contact
information we can do this and and I can
send you this very good point so uh very
often they have their own ranges and
they belong to the ripe and I think that
the that the IP addresses are now dead
until they get released by The Ripe
again because of course so that's that
what I would think now but maybe we can
identify some htps certificates and can
see uh where these servers I have maybe
moved to another ISP it's a very good
idea we we can investigate it very good
point good idea hello um thank you for
your talk uh was very interesting um I
wanted to ask about the coordination
like you scan like 400,000 IPS on
Ukraine every 4 hours right uh did you
have any kind of coordination with them
because it's a war right so I imagine
from the other side they are trying to
defend and then you're just hitting
their
things and not not only you but like
other all the other companies right so
did you do any coordinations like these
are our IPS like we are doing this or
sir it's a um so when you for instance
when you go uh when you look uh who is
the IP address who's scanning you can
see it's alha strike lab it's research
net you have an abuse address when you
email to the abuse address you get a
complete answer um about the research
project we are doing technically it's
like every four hours one packet per
system it's nothing right so it's
it's yeah but but the the traffic we
issue is very it's it's just a a soon a
s packet on HTTP on htps it's it's it's
it's really uh under the back scatter of
all scanning we have all the time so
it's like there's some kind of
background noise all the time the
internet so everybody everybody is
scanning everybody like that and this
one packet every four hours they they
are not even uh identifying it you know
so we got no compliance complaints on on
from Ukraine so at that point it was
like uh there was no Korean Nation
because there was no impact in the end
and was also predicted but there will be
no
impact
okay uh hello thanks for the talk um I
would assume that especially owners of
static IP addresses have quite
professional Hardware set up containing
uninterruptible power supply of some
sort so is it really that 4 hours
accurate what you showed off or might
there be a heavy impact because they
might be able to power up from scratch
even in the beginning of the war you're
from Germany right yes yes okay very typ
because that every 24h hour you get the
new IP address is a very typical German
stuff right so especially when you think
on cable modems you have even now in
Germany very often static IP addresses
so I have also static IP address at my
home so and especially when you go
abroad having static IP addresses on a
broadband connection it's very usual in
the foreign countries so yes of course
it's more likely that you have maybe
more professional setup because each
professional setup will have a static IP
address but compared to uh to like uh
standard DSL connections here in Germany
and even they have now more than 24
hours AES static IP address um yes there
could be a somehow small shift
that they will be more professional and
we receive lower uh or or maybe not that
good results but when this effect would
be really there then we wouldn't have
seen like 90% power loss uh on the on
the attacks in October right and because
we have seen that I would say this is
not a factor that impacts our result
very much because the special equipment
could be maximum 10% of our results
because we have seen a drop on 90% And
the 10% remaining have maybe
professional equip
yes sure hey uh thanks for the talk I
was wondering whether you have any
insight in the type of devices or the
locality of the static IPS you're
measuring so is it a representative
sample of the Ukrainian INR internet
infrastructure or yeah yes so what we
have done is we have looked for isps so
we have seen that we have really from
all isps a good sample right and from
all prefixes and so on so this it's not
like we have 41 ,000 IP addresses from
like two isps that's something of course
we have checked and that's a very good
distribution across all all isps and
also across all locations in Ukraine so
y sure thank you very much very good
question hi question uh previous reports
on scanning the infrastructure send the
reports to the Ukrainian government for
approval before publishing did you ask
them before publishing if you can so
what we have done is I was on a
conference from the min Ministry for
foreign affairs of Germany and there I
have met the wise Deputy for the
ministry of communication and it
something like that and I talked to him
and he said oh very interesting data
please send it to me right so um there
was not so uh so for him it was not like
it's very sensitive data or something
like that and from our perspective I'm
here in Germany and we have freedom of
research and when I found out this very
interesting results I I want to publish
it and to explain the people that you
can use these very interesting types of
data and this internet scanning stuff
also to understand what goes up in the
Ukraine also to fight against fake news
and some other stuff right that's so but
in the end is I have there was no
coordination because how you uh I cannot
just pick up a phone say hi I'm johanes
C I want to talk with vice president
whatever and I want to internet scan it
is okay for you that's not how it's how
it's working right it's like I will get
in a Spam and then I wait for two hours
and then it RS it right so
that's but but nobody was complaining
and uh it's so yeah there's a war of
course yes and they they they have been
very thankful for the insights because
they have not been aware that we could
have been able to measure that the
second Russian attacks are less powerful
than the first wave we have seen so in
the end um all Ukrainian guys I have
talked to they have been very thankful
for these very interesting insights and
to prove that they have been more
resilient against the Russian attacks
that was all feedback I have received
all the time thank you so much for your
research I'm wondering are you able to
see starlink devices are you able to see
people move to satellite internet or is
this something that you're blind to so
um we I have not investigated that so
when you star when you have a device
that is it it depends um I have not
investigated when they have IP addresses
and no net Network behind it you will
have direct contact to to these networks
but very often satellite networks and
other stuff is netted or like mobile
Communications but you have also every
time opportunity to have um M2M
connections machine to machine
connections static IP addresses I don't
know what the exact setup is I have not
investigated Starling because a lot of
other researchers concentrating on
Starling and what's going up in Ukraine
and I wanted to make other stuff in the
end but it's still interesting so I can
look up if you maybe find something and
if I find no connection to Starling I
would highly bet that they have a
network address translation okay thank
you good
question thank you your
click
[Applause]
[Music]
thanks