Defense in Depth

After several days of Internet attacks by a group calling itself Anonymous, the Church of Scientology has responded with a comment about the posting of one of its videos. A response on Friday evening from the Church of Scientology did not address CNET News.com's specific request for comment on the denial-of-service attacks themselves. Instead, Karin Pouw, public affairs director for the Church of Scientology, focused on the leak of a Tom Cruise video on YouTube earlier in the week. The response reads, in full:

As the Church previously announced, the pirated and edited excerpts of Mr. Cruise were contained in an official Church event in 2004, an event attended by 5,000 Scientologists and their guests and further available for viewing in any Church of Scientology world over. Having presented these selective and out-of-context excerpts with the intent of creating both controversy and ridicule, nevertheless resulted in people searching for and visiting Church of Scientology Web sites as evidenced by "most searched for" lists of various search engines. Those wishing to find out the Church of Scientology's views and to gain context of the video have the right to search official Church Web sites if they so desire.

This week we've seen two Internet events that are more alike than dissimilar. On Wednesday, an Estonian court convicted a 20-year Russian for his part in last spring's distributed denial-of-service (DDoS) attacks on that nation. On Thursday, word of mounting DDoS attacks on the Church of Scientology spread. Ultimately, both events could have larger repercussions.

The attack on the Estonian Web sites was prompted by an Estonian government plan to move a statue and grave sites honoring Russian-Estonians who died fighting the Nazis. Gadi Evron of Beyond Security said at last year's Black Hat USA that he found only one case of unique code used in the attacks which lasted from April 27 through mid-May. Evron said the attack had the appearance of an Internet flash mob, and now, with the conviction, it appears to have been loosely organized by a group of college kids. Evron cited evidence of at least one e-mail inciting Internet action on a particular date at a particular time during Estonian attacks.

A similar event is happening now. DDoS attacks against the Church of Scientology appear to be coming from a loosely organized group of individuals calling themselves Anonymous or Anon. The attacks, according to Jose Nazario of Arbor Networks, appear to use common code and early attacks originated from one IP address.

As with the events in Estonia, as news spread, more individuals may now be targeting the Church of Scientology in a sort of "me too" frenzy. A Web site called Project Chanology continues to detail present and future actions by Anonymous and others.

The idea that a handful of skilled individuals could decide to "take out" a particular group or company or government for any reason is a very disturbing one indeed.

Dr. Jose Nazario of Arbor Networks has been looking at the technical side of the distributed denial of service (DDoS) attacks upon domain registered to the Church of Scientology International. In general he finds that while there have been a lot of DDoS attacks, the early ones were mild. They were, however, stronger than the DDoS attacks upon various Estonian sites last spring. As a protective measure, the Church of Scientology has since moved its domain to a more protected space.

Prior to the move, Nazario found that on January 19, there were 488 DDoS events, all of which appear to come from one IP address, "indicating," said Nazario, "that this is not a huge, broadly sourced attack (i.e. it may not have registered on other ISPs systems)." He also notes that the types of attacks he saw on Saturday were "common, garden-variety DDoS attacks."

Nazario's other findings include:

Maximum PPS rates seen: nearly 20,000 pps (packets per second), with an average attack size of 15,000 pps.

Maximum bandwidth seen per attack: 220 Mbps, with an average attack size of 168 Mbps. This is on the high side of an attack, but significantly smaller than the largest ones we commonly see nowadays.

Maximum duration of a single attack: 1.8 hours, which is on the long end of common, but the average attack lasted just under half an hour.

On January 21, the Church of Scientology moved its domain to Prolexic Technologies, a company that protects Web sites from DDoS attacks. Attacks against the site have increased, with a major assault on Thursday night at 6 p.m. EST.

Nazario says "I went looking and was unable to detect attacks against the Scientology Web site in particular. The new IP address of the CoS Web site is located within the Prolexic DDoS service network. It's difficult for (Arbor Networks) to detect these attacks in particular from the milleiu of DDoS attacks" inside the Prolexic service.

A group of vigilantes--calling themselves Anonymous, or Anon--are escalating their attacks against the Church of Scientology in what they consider to be Internet censorship by issuing new video challenges. In one video posted to YouTube, Anonymous addresses the many news organizations covering the war, stating that the group has been watching. While the individuals behind the effort generally support the coverage, they also severely fault the media.

"We find it interesting that you did not mention the other objections in your news reporting. The stifling and punishment of dissent within the totalitarian organization of Scientology. The numerous, alleged human rights violations. Such as the treatment and events that led to the deaths of victims of the cult such as Lisa McPherson.

This Cult is Nothing but a psychotically driven pyramid scheme.

Why are you, the news media, afraid of discussing these matters? It is your duty to report on these matters.You are failing in your duty."

Lisa McPherson was a member of the Flag Service Organization, a branch of the Church of Scientology, whose death in 1995 remains controversial. Although the Church of Scientology was initially held responsible, felony charges against it were dropped when the medical examiner ruled her death was an accident. A civil suit against the church by McPherson's parents was settled in 2004.

At one point in the video, Anonymous says, perhaps in response to its growing numbers of critics, "this is not religious persecution, but the suppression of a powerful, criminal fascist regime."

A request for comment from the Church of Scientology has not yet been answered.

On Friday, Anonymous also posted on YouTube a second YouTube video to the Church of Scientology, this time addressed to its many followers.

"Your religious beliefs are not wrong, like any other religion, and they are yours to keep. However beliefs should not come at a price. Not from your wallet or compromising your thoughts.

Those who have left feel a new life, a rebirth into true freedom. You can join them if you wish. You may not believe us. We ask of you one thing: Make up your own mind. That is a sentence of more profound meaning for you now than at any other time in your life."

Both videos continue a trend in using a computer-generated voice over stylized video. A Web site called Project Chanology continues to detail present and future actions by Anonymous and others.

A group of vigilantes calling themselves Anonymous have posted a video explaining the recent attacks against the Church of Scientology.

A copyright violation claim by the Church of Scientology against the posting of one of its videos to YouTube has prompted a full-on assault by a group calling itself Anonymous.

The video, in which Tom Cruise proclaims, in part, that Scientologists are the only experts on the mind, was pulled by YouTube over the weekend at the request of the Church of Scientology as part of a long-standing effort to keep copyrighted material from appearing on the Internet. Other sites have since posted the Cruise video in full.

In response to the take-down of the Cruise video, a group of vigilantes--calling themselves Anonymous, or Anon--have retaliated against what they consider to be Internet censorship. The group includes computer experts capable of Internet mischief. In recent days, local chapter sites for the Church of Scientology have been defaced, and in some cases denial of service attacks have also prevented access to the same sites. Real-world attacks have included fax-spamming those same offices.

As an explanation for these attacks, Anonymous posted its own video to YouTube. In the video, a computer-generated voice speaks over a rolling cloudscape, effectively putting the Church of Scientology on notice:

"Over the years, we have been watching you, your campaigns of misinformation, your suppression of dissent, your litigious nature. All of these things have caught our eye.

"With the leakage of your latest propaganda video into mainstream circulation, the extent of your malign influence over those who have come to trust you as leaders has been made clear to us. Anonymous has therefore decided that your organization should be destroyed, for the good of your followers, for the good of mankind, and for our own enjoyment.

"We shall proceed to expel you from the Internet and systematically dismantle the Church of Scientology in its present form."

The video ends, with the following statement:

"We are Anonymous
We are legion
We do not forgive
We do not forget.
Expect us."

A Web site called Project Chanology details present actions and those in the works by Anonymous and others.

The Church of Scientology, founded in 1953 by L. Ron Hubbard, is not without previous controversy on the Internet. In 1996, it sued Internet service provider Netcom (now a part of EarthLink) over copyrighted texts posted to the newsgroup alt.religion.scientology. The case was settled out of court for an undisclosed sum. In 2003, the Church of Scientology attempted to sue a Dutch woman and her ISP over similar writings but lost. The Dutch case, had it ended differently, could have changed the way ISPs handle third-party links by its customers. In 2007, writer Keith Henson was arrested as a fugitive. Under a California law that criminalizes any threat against someone else's "free exercise" of religion, Henson was convicted in 2001 for making a comment on the alt.religion.scientology newsgroup about sending a "Tom Cruise" missile to destroy the Scientology camp.

Update at 3:15 p.m. PST January 25: Anonymous has since posted two new videos.

A 20-year-old Russian has been convicted for organizing some of the attacks on Estonia's government sites during spring 2007, the Agence France-Presse reported on Thursday.

"Dmitri Galushkevich is the first hacker to be sentenced for organizing a massive cyberattack against an Estonian Web page," Gerrit Maesalu, spokesman for the regional prosecutor's office in northeast Estonia, told the AFP. Galushkevich was fined 17,500 krooni (about $1,600). He admitted his guilt, said Maesalu.

The distributed denial of service (DDoS) attacks, which some security experts have alternatively called a flash mob or the first-ever cyberwar, was prompted by an Estonian government plan to move a statue and grave sites honoring Russian-Estonians who died fighting the Nazis. From late April through mid-May 2007, various Internet-based services within Estonia were not accessible.

Estonians rely heavily on the Internet for basic services such as paying for food, water, and gas, said Gadi Evron, security evangelist for Beyond Security. Evron has studied the incident thoroughly. "The more technology there is within a country, the more dependent the country is on technology and therefore, the more vulnerable," he said.