https://cfp.nonamecon.org/nnc2020/talk/AD7LMJ/ Cyber attacks against Georgia in October 2019 drew international attention. Georgian hosting provider was attacked and hundreds of websites (hosted there) defaced. In February 2020 US State Department along with the UK, NATO, Ukraine, Estonia, Poland, etc. condemnds these attacks and declared that it was part of a wider operation by Russian Military Intelligence Service (GRU). This cyber-attack prompted us to gather and research openly available data on the level of security in Georgian cyberspace. And we would like to present this research and talk about the October cyberattacks within regional political and security context.

1. Cyber Attacks Against Georgia
Georgian Cyber Security Landscape
info@cyberhouse.ge

2. About
Mikheil Basilaia
https://www.linkedin.com/in/mikheilbasilaia/
Cyberhouse (cyberhouse.ge)
• Security and IT Audit
• Consulting & Compliance: NIST Framework, ISO 27k, SWIFT CSP, COBIT, BCP & DR
• Outsourcing: Security Operations, SOC
• Penetration Testing
Own Product: cyberclass.ge (Cyber Hygiene and Phishing Platform)

3. Cyber Attacks Against Georgia
• October, 2019
• 15,000 websites hacked?
• What happened really?
• October, 2019
• 15,000 websites hacked?
• What happened really?

4. What we know about the attack
• Public sources say not much
• 1 hosting provider hacked
• Up to 300 websites defaced
• Cover-up for larger and stealth attack?
9/3/2020 4

5. Aftermath
• No official report, no news
• Match, 6 – USA, UK, Norway, Czech Republic, Estonia, etc.
condemned Russia for the attack
• UK NCSC – “almost certainly” GRU
9/3/2020 5

6. What’s Next
• Cyber security hot international politics issue
• GRU/FSB not deterred
• To watch:
• Elections in Georgia – 31st of October, 2020
• Elections in USA – 3rd of November, 2020
9/3/2020 6

7. Georgian Internet Security Landscape
• Research with open source tools
• Gathering already available data (Shodan. . .)
• Freely available here:
https://www.cyberhouse.ge/blog/2020/06/03/%e1%83%a5%e1%83%90%e1%83%a0%e1%83%97%e1%83%a3%e1%83%
9a%e1%83%98-%e1%83%98%e1%83%9c%e1%83%a2%e1%83%94%e1%83%a0%e1%83%9c%e1%83%94%e1%83%a2-
%e1%83%a1%e1%83%98%e1%83%95%e1%83%a0%e1%83%aa%e1%83%98%e1%83%a1/
• (Only in Georgian for the moment  )
9/3/2020 7

8. Contents
• SSL/TLS
• NTP
• Mail Servers
• SMB
• Technologies Used
9/3/2020 8

9. Findings
• 71% of servers have at least 1 SSL/TLS vulnerability
• 56% have High/Critical SSL/TLS vulnerability
• Though big improvement from 2018
• DDoS Attacks (DNS, NTP): 4 GBPS
9/3/2020 9

10. Findings
• Up to 100 mail servers with high critical vulnerabilities
• SMB: WannaCry still actual
• Technologies: Yandex Metrica used by 3% of websites
9/3/2020 10

11. info@cyberhouse.ge
mikheil.basilaia@cyberhouse.ge