Twitter Snag Tied to Attack on Georgian Blog

By Brian Krebs
Washington Post Staff Writer
Saturday, August 8, 2009

A politically motivated cyber attack against a single blogger in the former Soviet republic of Georgia is being blamed for a Thursday outage that left millions worldwide unable to access their personal Facebook and Twitter Web pages.

The attacks continued to affect Twitter service on Friday for some users of the popular microblogging site, after completely shutting down the site for hours the previous day. Facebook fared better; service returned to normal on Friday for its 200 million users.

Early Thursday morning, a flood of e-mail spam was blasted out on the Web, directing recipients to visit a single individual's personal Web page set up at various social networking sites, including Twitter, Facebook, LiveJournal and YouTube, according to Bill Woodcock, research director of Packet Clearing House, a San Francisco nonprofit that provides support and training to companies that manage Internet traffic and development.

Woodcock said the spam also contained links to Web pages featuring the political musings of a 34-year-old blogger in Tbilisi, Georgia, who has been chronicling the tensions between his country and Russia.

McAfee, the computer security firm based in Santa Clara, Calif., said it began tracking a separate attack in which hijacked computers were directed to visit that blogger's pages repeatedly, in an apparent bid to prevent other visitors from viewing his content.

The twin attacks quickly overwhelmed Twitter and other social networking sites, said Dmitri Alperovitch, McAfee's vice president of threat research.

"It looks like Twitter and Facebook were just caught up in the collateral damage from an attack on this one blogger's site," Alperovitch said.

Twitter co-founder Biz Stone declined to speculate about the nature of the attacks, saying only that they "appear to have been geopolitical in motivation."

"The attacks continue to change in nature and intensity," Stone said. "We're tuning our systems to better deal with this type of assault now and in the future."

Facebook spokeswoman Rebecca Hahn noted that the attacks appeared to be directed at one person, and not at the sites themselves. "Specifically, the person is an activist blogger and [hijacked computers were] directed to request his pages at such a rate that it impacted service for other users."

Reached via instant message, the blogger, a man who would only identify himself by his first name -- Georg -- said his site was attacked on the one-year anniversary of the war between Russia and Georgia, a brief but costly battle that was accompanied by cyber attacks on Georgian government Web sites.

"I think [it is] because I have different opinion in Russian-Georgian war history [than that which agrees] with Russian [government] propaganda," Georg wrote.

Staff writer Cecilia Kang contributed to this report.

© 2009 The Washington Post Company