[MUSIC]
So, please welcome Johannes Klöck with how to use internet scans and
passive measurements to analyze Russian attacks and their impact in Ukraine.
>> [APPLAUSE]
>> Hello, welcome.
My name is Johannes Klöck.
I'm here for talking to you about how to use internet scans and
passive measurements to analyze Russian attacks and the impact in Ukraine.
I'm Sion Kofon of IFAS Strike Labs,
it's a company about which is does scanning whole the day, the internet.
And then we do also a lot of research,
have also published last CAHOS communication camp.
I have published here a talk how to set up a search engine and
which ways you can globally scan the internet several times.
And now we use much more of this data for making advanced research.
So, but before we start with the Russian attacks and
how we can measure the impact using global internet scans.
I'm here more also to talk about why the resilience of the Ukraine in terms of
internet is so high.
So maybe, so at first it's really sad that the power of the beamer is not that high.
I hope you can see something.
Interesting point is that when we talk about Ukraine,
we can see that approximate 55% of all end users in Ukraine
are served by very small ISPs.
So we can see this there in a circle.
We can see that like 45% are served by larger ISPs,
which serve more than 1% of the whole end clients.
But 55% of all end clients in Ukraine are served by an ISP that
is managing less than 1% of the whole clients in Ukraine.
When you compare it to Germany, on the next slide,
we can see that in Germany in comparison to that only 18%
of end users are managed by very small ISPs, less than 1%.
So we can see that in Ukraine we have much more diversity in terms of small ISPs.
They are each connected to each other.
And when one ISP has maybe no power or maybe fails out,
the traffic can go route through another ISP.
And this makes it much more resilient.
Here in Germany we have approximate one third of all end clients
on Deutsche Telekom.
The other third is on Vodafone.
This means at least when one of these ISPs get knocked out by somehow a strike,
we will have big troubles here in Germany.
And we are not thinking-- the next point is also the day kicks, right?
That's also a point.
But in Ukraine, they have a huge amount of very small ISPs serving approximate half
of the whole end clients we have there.
And this makes the internet itself in Ukraine very robust
compared to Western countries.
Before I explain about the results we have,
I just want to tell something about how we collected the data.
So what we are, we have our own internet service provider.
We have our two different slash 22s.
This means over 2,000 different IP addresses which we use for internet scanning.
This means we are scanning the internet.
And each time when we connect to a new system, we use a new IP address.
And this leads to the fact that we like half an hour,
we visit with the same address, the same network.
So each 30 minutes.
This gives us a very good opportunity to be another radar of a lot of intrusion detection systems
and prevents a lot of blocking.
Our staff has been developed in a free university of Berlin
financed by the Federal Ministry of Education Research and Former Times.
This was around '14 to '15, '17.
Then we found out of that a company and did some cool interesting stuff.
And now we are coming to the point that when we are doing all the time the internet scans
and see, okay, where are the clients we have seen, especially in Ukraine,
when the war started, that a lot of clients availability dropped.
And they said, okay, that's very interesting.
We need to investigate it because it makes sense when maybe a lot of power outage we have.
And we know that the Russians have attacked a lot of critical infrastructure
in the Ukraine.
Then where there's no power, there's also a high chance that you have no internet
because also routers and so on need a lot of power, right?
And especially in the end, in the small office, home office from the people,
where there's not so small routers, no power, there will be also no internet.
That is why we have taken as base reference for our analyzers October 21,
which is approximately half a year before the Russians started their attacks,
as the reference said, okay, these amount of servers we have seen is the 100%,
the baseline.
And then we have seen how are the services behaving when the Russians started their attack.
And here we see the first chart.
I hope you can see it somehow.
On the left, we have started by 100% for different protocols for HTTPS, SSH,
HTTP host, DNS host, SMTP hosts.
And we can see in the middle of the chart that there is approximately the end of February,
beginning of March 22, where the red arrow is somehow seeable.
We can see there's a huge drop in service availability.
This is here, for instance, this is a special area of Ukraine.
This is in the northeast Ukraine.
This is northeast also from Kiev.
This is the region where when we have here, Charnivy, this is the oblast of Kiev,
got invaded by Belarus and by Russia and got occupied by approximately 70%.
And we can see that during the occupation, a lot of services in that area went down,
especially the web services and also the mail services.
But one service still was very steady.
This was DNS.
And this was some of the thought, okay, that's very interesting.
We can see a lot of services dropped by approximately 60%, but only DNS is quite still stable.
When we compare now, especially the results from the beginning of March with the end of
the beginning of April, we can see that in the beginning of April, remember, the Russians
had a lot of logistic problems.
They needed to retreat going back to Belarus, et cetera, and then they released Kiev, right?
And then we can see the services are going up again.
So some people said that, oh, maybe they have just fixed the infrastructure and then the
services go up, right?
But we see that all the time DNS is very steady.
We have talked to some companies that have third-party providers based in Ukraine, and
they told us that before the Russians have invaded them, they have shut down their system
for data integrity protection and also data theft protection, right?
And that's why they have brought down their servers, but DNS was still active because
if you have ever tried to boot up a whole AD Windows infrastructure without DNS, it's
not possible, right?
That is the last core services you will remain, and that is why we see that we have seen DNS
was quite steady and all other services went down by 60%, and after the Russians retreated
and went back to their country, to Belarus, it went up again, right?
This was very interesting.
We have seen this kind of behavior and seen, okay, we need to now make more intense scans
on an hourly basis to understand and to see maybe we can also see where some Russian rockets
attack some power plants and if we can maybe see in that region, we can see that a lot
of servers are also going down and going up after some other hours when the power is up
again.
And I will show that.
Here we can see also a very special case that is a Mario pole.
You can maybe see we have also set 100% for all protocols, and then for all protocols,
it goes down by 90%, right?
Mario pole is a city that's very close to the cities that were attacked very hard, very
first by a lot of critical airstrikes and so on.
On the right side, you could normally see data from the European Space Administration.
They have done some radar scans and have seen that approximately 90% of all buildings are
now like 10 up to 50 meters lower than before because they got completely destroyed, right?
And using our internet scans, we can also see that approximately 90% of all network
services we have identified in that region are also not existing anymore since the beginning
of the invasions and the attacks of the Russians.
This means we could also just sitting here in Berlin scanning from our IP addresses,
we can just use it like a radar looking if you're up, are you up, are you up?
Oh no, you're down.
And then we can see that 90% of all service in Mario pole went down like in the first
two weeks of the attacks by the Russians and 90% are not still available anymore.
And this shows us that also for a long time, for at least three months, this shows us that
you can use internet scans for use some kind of battle damage assessment to see how big
is the attack and how big is the result of the attack also for the region.
This information is for instance important for when you are the Ministry for Foreign
Affairs and you support some NGOs, for instance, right?
Then it would be very interesting to see how big is the grade of destructions in a certain
area.
And you can use this kind of information for rough estimation.
So what we then did is that we said, okay, we have selected 400,000 static IP addresses
in Ukraine.
It's like having vantage points for measuring.
And then we have scanned these 400,000 static IP addresses every four hours just for looking
where in the region services are going up or going down.
Very important, static is very important because if you use dynamic IP addresses, dynamic IP
addresses are very often up or down because people switch off their mobile router or get
a new IP address, whatever.
That is why we have chosen static IP addresses.
And as you can remember, we know that especially in October 2022, this was the first big attack
of the Russians against the critical infrastructure of the Ukraine.
A lot of reports also from Reuters has shown this was the first well-known Russian attack
against the critical infrastructure.
And then we have chosen open source intelligence.
Here on the right side, you can see somehow a map from Wikipedia, which has collected
tons of reports from social media and also from newspapers where in a certain region
Russian have attacked and where we have received a power outage in that region.
And the interesting point is that in all regions where we have seen that the open source intelligence
says, or here the social media says there was a power outage, we can also see that we
have a drop in our scans.
So for instance, here we can see on the map on Chenevy, which is in the northeast, this
is a country that which got not, this is an uplast like a state of the Ukraine, which
got not directly hit, also received not a power outage, but all surrounding states or
uplasts of Chenevy have received power outages.
And we can also see this in the data.
On the right side, when you can see a small drop, this is a drop we can see on the power
outages in Chenevy because all the border regions also received a power loss.
And for making, showing you that also the opposite also works very well, we can see
that in Odessa, which is in the southwest of Ukraine, we can see there was no power outage
given by the social media and in other newspapers.
And there we can see the data acquired steady, steady, steady line on the availability of
the network services.
Now we are going directly to Sumi, which is an uplast, which received a bigger power outage
and there we can see here on the right side, a big drop by approximately 90 up to 80% across
all protocols.
When we remember we have seen the Chenevy first stuff we have seen there was still DNS
was still running. In that case, we can see that HTTP, SSH, HTTPS and DNS, all services
went down exactly at the moment as the social media also reports there has been Russian
attacks in the security infrastructure and also says there was a power outage.
And we can just say, okay, yes, we can also measure that.
This is also, we can also estimate here, we can see the power drop and we can just estimate
that the power outage was around 12 hours.
So we say when approximately 80% of all services up again, we say the power outage is over.
We can see after 12 hours 80% are reached and then they took three further days to get
up to 100%.
That is very interesting.
Also when you are an NGO it is very interesting to understand how many fuel I need to take
or how to cover these power outage time for instance or how to maybe what kind of turbines
do energy turbines do as you create need.
And so this is very interesting data because you can just on a social media you can just
see there was some kind of power outage but you can't half measure how long it is.
And here we have very good qualified data for doing that.
So this data here was for Sumi.
We can also see this for Poltava.
Poltava is the same.
We can see here on the right side a drop across all protocols and also here in this time this
was eight hours but it was not that big.
It was approximately only by 40% drop.
We can also see this here for Ternopil.
There was a first strike on the night from the 6th to the 7th October and also on the
10th October we can see also a bigger drop.
And then what's very interesting you can see here they have been fighting really really long
for getting up to the 100% because at first they just went to the 80% and then you get
up and they get down and so on.
You can see that the energy grid was very unstable for at least three up to four days.
So here we have just a table which shows us where power outage has been detected by the
open source and social media and what our results are showing.
We can see that very often when we have power outage detected we also have our mechanisms
detected in it or our algorithm.
And we did a Pearson correlation coefficient analyzer and we got a strong correlation because
we got a result from 0.74 which indicates a strong correlation using our methodology
for detecting power outages in Ukraine.
It has a strong correlation to the open source and social media reports.
So this means that the algorithm and the technology is working and it's very interesting.
So now we can see the next like approximately half a year later on the 9th of March the
Russians attacked again the critical infrastructure of the Ukraine.
And the very interesting point is that we measured it again and this time we can see
for instance here for Dnipropetrovsk Oblast there was only a small power outage like 20%
for eight hours.
We can also see this here for Kivororod which was also a very small power outage like 40%
only for eight hours.
So when we now go further and investigate it we understand we have seen here that on
the October the power outage was every time like 80% for 12 up to 15 hours.
And then it took like three days they recovered completely to 100%.
But half a year later the Russian attacks are not so have not such big impact because
here we can see power outages now only maximum 80% very close to the 100% 100% and then it's
easier.
I talked to some Ukraine guys and they said yes because we learned to deal with that.
A lot of Ukrainian civilian people have now small energy turbines, generators and so on
and they self power them for the time of the outage.
We have also the United States have provided big very big power generators, huge turbines
like big cars that are able to distribute power for the whole district of a city.
So they distributed the power supply of the Ukraine using mobile generators, the civilians
on their own and also by the government supported by the Germans and the United States.
And we can see in our measurements that the impact of the power outages are much lower
than before because we can see it's not over the 50% before we had like 80-90% now it's
maximum 50% and also the time of the power outages has decreased by 50% because we now
have only like eight hours up to the 100%.
It's very interesting to see that the Russian attacks against the power grid is less efficient
than before in October and that is measurable by internet scans.
This is so fascinating right that you can sit here and see the data and analyze it from
home not being there but you can make very interesting research about these kind of topics.
Okay now we are also looking for the Russian control right so we have here Zaborozhina
which is under Russian control and we can see that the power attacks against the Zaborozhina
against the Russian controlled area has no impact.
So we can see that the Russians are not attacking their own region right they are not impacted
by their own attacks because there's also cross-check you have to do right maybe there's
some general failure in my methodology but this is very interesting to see that the Russians
are all the time steady in their controlled area and that they attack only the Ukraine
power grid system and they do not impact themselves.
Okay this was about kinetic strike detection and to understand how you can use internet
scans for detection and to analyze it.
Now we are going to more presumably Russian attacks so very interesting is we have Kherson.
Kherson is a city which was very heavily contested and which went under control in the end of
March and April under the Russians and what we can see here is the BGP dependency graph
this means we can see here from Kherson Telecom which is an ISP an internet service provider
of Kherson we can see where do they give or who is the main upstream provider of Kherson
Telecom right so this means when you serve on your network where is the traffic for Kherson
Telecom clients going through.
And here we can see it was taken by Ucomline, Ucomline was the upstream provider of Kherson
Telecom and in the beginning of May in the first May we can see there is a switch.
The switch there is a switch that say have give 100 percent of the traffic to Ucomline
which is Ukraine ISP and then there was a switch to Miranda AS Miranda Autonomous System
so who is Miranda?
Just looking Miranda Media Limited is the ISP is the new upstream provider of Kherson
Telecom in the first of May there was a change on the BGP data very interesting first of
May is also a holiday in Ukraine right day of labor and we can see Miranda Limited is
ISP which is has been founded in 2014 on the Crimea interesting right and when we see also
on the right data they states it's in Crimea and belongs to the Russian Federation so we
see it looks like a Russian ISP doing some more investigation we can see here that also
Miranda Limited is responsible for the internet C cable that connected Crimea and Russia mainland
right and very interesting point is that these internet cable was finished in 2014 very close
to the invasion to Crimea and these internet cable was also provided by a Chinese cable
layer called Ying Gong Wan right isn't fascinating to understand these political behaviors behind
that so we have here clearly an Russian ISP and ISP that is also operating a C cable connecting
Crimea and Russian mainland and so it makes totally sense that they are the new upstream
provider of Kherson Telecom a city they have invaded and very interesting is that you can
see later as there was on the 4th of May we can see there is somehow back switch to data
group as of going back to Ukraine ISP and then there is also New York Times report which
says yes very important a lot of different reports especially in Kherson Russian people
arrived Russian soldiers arrived and tried to get control about the internet infrastructure
and also telecommunication companies so this time here in the first time of war we can
really see that the internet as part of critical infrastructure is also a tactical objective
obviously right so Russians came and say please switch off your routes going to Miranda ISP
that's how it's working and interesting point is that we can see so here we can see that
on the 4th of May there was switch back to the Ukraine ISP and it looks like then they
used maybe more forces or so that different there's a huge topic on the Facebook channel
of Kherson Telecom where the CEO says yes there was no connection I was not forced by
the Russians but I thought it's better to use the Russian internet than the Ukrainian
because it's more stable and so on and so on right so but it's very hard to say here
from Germany what's the retry but we can see that in the end of May 31 May we can see since
November 2022 it was all the time Miranda as was the primary upstream provider of Kherson
Telecom and then we can remember that in 9 November the Russians retreated from Kherson
they went back and the interesting is we can also see this in the BGP data because exactly
to the 9th November Kherson Telecom has no upstream provider anymore the Russians have
cut the lines and then they moved away from Kherson right and this is also seeable by
the BGP data very interesting is Kherson Telecom went never up again they are now completely
away and I have heard some rumors that the CEO of Kherson Telecom went also in prison
or gets accused but there's still some some social media stuff right it's very hard to
prove the truth we can just see here the data on the BGP and we can see that the Russians
have somehow tried to get control about the upstream of Kherson Telecom in the end of May
they have received the control all traffic went through Kherson Telecom it's very important
because for censorship of course you can also identify maybe partisan troops try to communicate
using the internet whatever and then when they retreated from Kherson the lines got cut
and we can see no connection anymore for Kherson Telecom so this was the second part now we
are coming to the third part of the talk we also operate a third /22 just as a black sensor
network it's an under name from a different company and the black sensor network we call
internally the cyber echelon right this means it's just collecting the data just when you
make some ping probe some TCP-SYN traffic whatever it's just it's a sinkhole it's just recording
all the data and enriches the data who is connecting what is the what is the autonomous
system from the IP addresses that get sent from and so on but you will never receive
an answer from this black hole network using this we can also understand how are people
scanning and if maybe there's a new RDP vulnerability for instance we can use this kind of technology
to see who is scanning for new RDP ports or for new vulnerabilities and so on that is
for why we have these sensor network but the interesting point is that we have approximately
160 million packets per day and the over 90 percent of all the data is TCP data we receive
5% UDP data 3% ICMP pings so and the interesting point here is that we can see here on the
left or you can see nothing but I will now explain the chart okay so imagine it's like
that and then we have time of war and then immediate increase of the TCP packets we receive
from the Ukraine so suddenly this war begins and we receive a lot of traffic from the Ukraine
on our sensor network and that's very interesting we thought why so when we try to understand
TCP handshake normally you send a SYN you get a SYN ACK back then you send an ACK connection
established layer 4 communication very easily and then we have looked what kind of packets
do we receive and then we have seen we receive SYN ACK packets so this means we receive packets
from server they say yes we it's okay that you tries to connect to me I want to set up
a connection also to you right makes no sense because we have a black hole sensor network
we have never sent some kind of connection request so why do we receive SYN ACK communication
and then we have thought about it okay makes sense somebody is spoofing randomly IP addresses
sending it out against Ukraine targets and then Ukraine targets are responding with SYN
ACK packets back to our sensor network because when you randomly spoof IP addresses you will
also randomly spoof some IP addresses of our black hole sensor networks we have 1000 IP
addresses there will be some when you send tons of packets there's a very good chance
that you will also spoof some of our IP addresses so just it's illustrated the attacker is sending
spoofed SYN packets to the Ukraine victim and the victim is replying with SYN ACK packets
and some of the SYN ACK packets are also hitting our sensor network and in that way we can
identify who is the victim of the DDoS attack right so we can see we can see that especially
in the beginning of April so on a chart you can't see here but you have to imagine now
we can see that in the beginning of April the first April there's a high spike up to the
end of May and then there's anything anymore right so somebody has somehow fired a DDoS
attack against Ukraine server and in that case we have looking who is the IP address
that's sending us the SYN ACK packet it was President Gov UA right so somebody DDoSed
President Gov UA by randomly spoofing IP addresses and it's very easy to do that and it's also
hard to fight against this kind of traffic and you just rent some bulletproof holster
which allows SYN TCP IP spoofing and then you can I don't know for 500 euros you can
also get 10 gigabit connection and then you try to fire against it the problem is against
this kind of traffic is it's very hard it's not that you receive DDoS traffic from a certain
autonomous system and then it's very hard to block because you receive completely different
packets from a lot of different ISPs because they randomly spoof the IP addresses but the
other point on these kind of attackers you have to buy a lot of bandwidth but normally
there was also another talk today two hours before very often DDoS attacks are also executed
that you try to identify a multiplier like DNS or NTP server you send traffic and they
send a 10 or 20 times amount back to the victim in that case here we have people that are
spoofing IP addresses and sending it directly to the victim and the victim is replying somehow
to us because they also spoofed our IP addresses and we can see that the exact in the beginning
of April the first April is it they started the attack and the end of April they finished
and then we can also see that in the beginning of May they started the attack winding up
going down the end of May and then exact and the beginning on June they are starting the
attack and the end of June they stopped so we can really see a very good pattern on these
kind of Russian attacks it's so it's in the beginning of the month it looks like somebody
has paid maybe somebody for doing something and then starting on the first of May yes
sir we are starting on the first of May you know so it makes no sense that you really
start it's begin exactly the beginning of the month you DDoS attacks so that's a freelancer
the hacker would never work like that right so starting exactly on the first of the month
yeah very interesting to see that so the second attack we have investigated here on the beginning
of June and the beginning of July was booking Gov. UA this is a portal where you can book
your train stuff where you can get your tickets where you can travel around Ukraine which
is also important for truth movements because also the Russian soldiers move by train of
course when they go home for some stuff and so on and so we can also see they have attacked
the presidential website and also the critical infrastructure the train systems the booking
system okay so also so now putting stuff in a nutshell we can use internet scans combined
with open source intelligence data and also a satellite imagery we remember on the European
space administration picture of Mario Pol and we can also to make strong correlations
for various events in the Ukraine in the in the Ukraine Russian conflict we can use very
intense internet scans like we have done in the scanning Ukraine's aesthetic server every
four hours to measure the impact of kinetic attacks by the Russians or to do or to use
it for some kind of better damage assessment to see how efficient are the Russian attacks
and we can also is also another point imagine that somebody on social media says a huge
nuclear bomb or whatever has exploded somewhere you could also use this kind of stance to
make some kind of fake news detection because if you have really really large damage event
somewhere you could use these internet scans also to verify these kind of information are
they really strongly hit is there really a large bombing whatever then we would see that
in our data so you could also use this kind of approach for fake news detection in the
end or for verification we have also learned that Ukraine internet consists of much more
small ISPs compared to the Germany they are much more resilient because more than 50 percent
of the end clients are are served by very small ISPs that serve less than one percent
of the whole clients we can use the BGP data to understand who is trying to capture critical
infrastructure special communication infrastructure and to route traffic through their own country
for censorship for instance and we have also learned that we can use a black hole sensor
network for understanding who is the victim in the Ukraine for a certain type of DDoS
attacks and we have also seen that in the DDoS attacks we have investigated there is
a some kind of campaign of campaigning because the attacks started every time on the first
of the month and ended in the end of the month which shows us this is a some kind of foreign
cyber campaign maybe behind it okay so this was my talk I thank you very much for your
attention I know it was very hard and we do have a few minutes for questions please line
up at the microphone countries in Europe are divided approximately equally right now in
terms of which ones require registration of identity to obtain SIM cards and those that
don't the Russo-Ukrainian war is between two powers on opposite ends of this spectrum and
Ukraine no registration is required in the Russian Federation it is well this is less
relevant now as the Russian troops retreat early in the war Russian troops were obtaining
Ukrainian SIM cards through looting and other measures that enables them to stay in touch
and coordinate because they were given inadequate radio signals equipment and one of the interesting
questions at the time was how open source foreign open source intelligence operatives
or the Ukrainian government could try to determine which cellular signals to intercept or disrupt
given that no registration was available is this a problem you've encountered how would
you recommend as a strategy in this theoretical scenario well so mobile network communications
was not part of my talk it's a very it's it's a very good question but in the end I'm not
expert for the mobile network communication I can just say from a network perspective
that the mobile communications are mostly behind the network address translation and
that and that you can't reach them via the scans very often so that's why they are out
of my scope because I cannot scan them right so that's why I'm not dealing about I'm sorry
I have no good question ma'am it's not my my subject hi thank you for the talk you mentioned
this provider in cherson which is now gone do you have any indication what the clients
of this provider are now doing have they switched to another one did you see any increase for
in another isp a good question this is a very interesting point we have not investigated
that but if you maybe give me later a card or contact information we can do this and
and I can send you this right very good point so very often they have their own ranges and
they are belong to the ripe and I think that the IP addresses are now dead until they get
released by the ripe again because of course so that's that what I would think now but
maybe we can identify some HTTPS certificates and can see where these servers I have maybe
moved to another isp it's a very good idea we can investigate it very good point good
idea hello and thank you for your talk I was very interesting I wanted to ask about the
coordination like you scan like 400,000 IPs on Ukraine every four hours did you have any
kind of coordination with them because it's a war right so I imagine from the other side
they are trying to defend and then you're just hitting the things and not only you but like
all the other companies right so did you do any coordination like these are our IPs like
we are doing this sir it's so when you for instance when you go when you look who is
the IP address who's scanning you can see it's IFA strike lab it's research net you
have an abuse address when you email to the abuse address you get a complete answer about
the research project we are doing technically it's like every four hours one packet per
system it's nothing right so it's it's yeah but but the traffic we issue is very it's
it's just a sin a sin packet on HTTP on HTTPS it's it's it's it's really under the backscatter
of all scanning we have all the time so it's like this is some kind of background noise
all the time that's everybody everybody is getting everybody like that and this one packet
every four hours they are they are not even identifying it we know so we got no compliance
complaints on from Ukraine so that point it was like there was no Korean nation because
there was no impact in the end and was also predicted by several be no impact okay hello
thanks for the talk and I would assume that especially owners of static IP addresses have
a quite professional hardware setup containing uninterruptible power supply of some sort
so is it really that four hours accurate what you showed off or might there be a heavily
impact because they might be able to power up from scratch even in the beginning of the
war you're from Germany right yes yes okay very typically because that every 24 hour
you get a new IP address is a very typical German stuff right so especially when you
think on cable modems you have even now in Germany very often static IP addresses so
I have also static IP address at my home so and especially when you go abroad having static
IP addresses on a broadband connection it's very usual in the foreign countries so yes
of course it's more likely that you have maybe more professional setup because each professional
setup will have a static IP address but compared to to like standard DSL connections here in
Germany and even they have now more than 24 hours a static IP address yes there could
be a somehow small shift that will be more professional and we receive lower or maybe
not that good results but when this effect would be really there then we wouldn't have
seen like 90 percent power loss on the on the attacks in October right and because we have
seen that I would say this is not a factor that impacts our result very much because
the special equipment could be maximum 10 percent of our results because we have seen
a drop on 90 percent and the 10 percent remaining have maybe professional equipment yes sure
hey thanks for the talk I was wondering whether you have any insight and type of devices or
the locality of the static IPs you are measuring so is it a representative sample of the Ukrainian
infrastructure internet infrastructure yes so what we have done is we have looked for
ISPs so we have seen that we have really from all ISPs a good sample rights and from all
prefixes and so on so this it's not like we have four one hundred thousand IP addresses
from like two ISPs that's something of course we have checked and that's a very good distribution
across all ISPs and also across all locations in the Ukraine so yeah sure thank you very
much very good question hi question previous reports on scanning the infrastructure send
the reports to the Ukrainian government for approval before publishing did you ask them
before publishing if you can so what we have done as I was on a conference from the Ministry
for Foreign Affairs of Germany and there I have met the vice deputy for the Ministry
of Communication and IT something like that and I talked to him and he said oh very interesting
data please send it to me right so there was not so so for him it was not like it's very
sensitive data or something like that and from our perspective I'm here in Germany and
we have freedom of research and when I found out those very interesting results I want
to publish it and to explain to people that you can use these very interesting types of
data and this internet scanning stuff also to understand what goes up in the Ukraine
also to fight against fake news and some other stuff right so that's so but in the end this
I have there was no coordination because how you I cannot just pick up a phone say hi I'm
Johannes Klick I want to talk with the vice president whatever and I want to internet
scan it is okay for you that's not how it's how it's working right it's like I will get
in a spam and then I wait for two hours and then it works right so that's but but nobody
was complaining and it's so yeah there's a word of course yes and they they they have
been very thankful for the insights because they have not been aware that we could have
been able to measure that the second Russian attacks are less powerful than the first wave
we have seen so in the end all Ukrainian guys I have talked to they have been very thankful
for these very interesting insights and to prove that they have been more resilient against
the Russian attacks that was all feedback I have received all the time thank you so much
for your research I'm wondering are you able to see starlink devices are able to see people
move to satellite internet or is this something that you're blind to so we have not investigated
that so when the star like when you have a device that is it depends I have not investigated
when they have IP addresses and known net network behind it you will have direct contact
to these networks but very often satellite networks and other stuff is netted or like
mobile communications but you have also every time the opportunity to have m2m connections
machine to machine connections static IP addresses I don't know what the exact setup is I have
not investigated starlink because a lot of other researchers concentrating on starlink
and what's going up in Ukraine and I wanted to make other stuff in the end but it's still
interesting so I can look up if you maybe find something and if I find no connection
to starlink I would highly bet that they have a network address translation okay thank you
good question thank you your house click thanks
(audience applause)
(ethereal music)
[MUSIC PLAYING]