0:03I think it's going to be a really interesting conversation. So I'm Jacob Crisp, Claude Flair. We've got a great lineup today, but I wanted to kind of give a little bit of context to set the scene since we've got, you know, 30 or 40 minutes to talk about it. The scope of today's conversation is around the Estonian SIRT team and their work to defend against Russian nation-state actors and a bunch of other things. What's interesting to remember with, you know, historical context with Estonia is they've spent a decade-plus really digitizing their entire economy. making system health care services, it's a digital native country. So you can imagine a lot of these topics are absolutely existential for them, both from a citizen perspective and a societal perspective, to maintain resilience in the face of a cyber adversary that's quite strong. Right? So the scope of today is sort of walking through some of those issues, exploring kind of the details of what they're seeing and then talking more about it a bit. So over to Brian.

0:49Yeah. Hi, I'm Brian Carter. I'm the director of cybercrime research at Cloud Force One and had the pleasure to visit Estonia. earlier this year and attend the CERT's conference where I learned a lot about the unique issues that are relevant to Estonia. And I'm happy to have them here with us today to talk about all of their important work on the front line of protecting Estonia's infrastructure. Yeah, hi, I'm Jan Tome. My name's Jirgaard. And we work at CERT-E, Estonia's National Cyber Incident Response Team, which is part... of the information system authority ria for short together we run the web application firewall team which protects most of estonia's public sector online and in the presentation we'll explain why the defense comes first in digital country and we'll show how we put that public sector behind one shield uh i'll start off with a little bit about estonia since 2024 every state service is in estonia can be done online you can get married or divorced online divorce was the last one to go online so uh when i say the state runs online i literally mean it

2:20your id card can sign documents taxes take a few minutes even if even that your doctor writes a prescription you can pick it up at any pharmacy you can vote online of course you can register a company before your coffee gets cold behind all of it is the government agencies exchange data over our x road

2:50that changes what an outage means in most countries government website going down is annoying in Estonia it means people can't sign can't file can't get their medicine or can't get it their banking systems so the state literally stops working if something goes down so for us defense isn't just an add-on to a digital state it's crucial part of it. RIA has a really nice slogan for this and I'll say it in a stoian first.

3:35On a good day we're invisible, every day we're irreplaceable. So a good day for us is a day when people can see that we have blocked an attack and they can just use their services.

3:51But this isn't new for Estonia. CertiE was founded in 2006. A year later, 2007, Estonia became the first target of cyber attack on a national scale. Government agencies, banks, media sites were knocked offline. Some were knocked online for a whole week. The attack changed how Estonia thinks about security.

4:28Me and Jürgen were kids back then, so I won't kid you that we know the details, but we know the system that grew out of it. The lesson from it was that simple being digital and being defended are the same job since then the attackers have changed but the reasons they attack haven't so who attacks us since 2022 since the war in ukraine we have been mostly the target targeted mostly by pro russian groups The best known being NoName 065-067, sorry.

5:14Their model is actually quite clever. They run a Telegram channel and they hand over a tool called TASIA. So when a volunteer downloads the script, their home computer becomes part of a botnet. And when the C2 server... gives them the list, the whole botnet starts attacking and Estonian sites are usually one of the

5:49attackies, targets, sorry. Since 2025 pro -Palestinian groups have started to join in too, but they have been mostly helping the pro -Russians. in the attacks that the pro-Russians have started. But why us? Why Estonia? Where we get hit whenever we take a public stand. In 2007, it was moving a controversial Soviet -era monument from a central location in the city to somewhere else. Since 2022, it was our adamant support for Ukraine. And a country that runs... is a very visible target but what do these activist groups need they primarily need visibility a screenshot of a site that's taken down posted on telegram the screenshot itself itself is the propaganda and it's also how volunteers prove how good they are at the attacking because the most active ones the most active attackers get paid in crypto and climb leaderboards no screenshot no story no payout keep that in

7:19mind that this comes back later so these are the official figures uh ria has published In 2021, we recorded just 75 DDoS attacks. Last year, it was 756, a tenfold increase in five years. The orange part in the graph shows the attacks that actually had any impact. So service disrupted somewhat, taken down whole...

7:57in 2021 over a half of the attacks had had some impact last year it was around 12 percent the blue marker on the graph shows when we adopted cloud prayers was so uh at the beginning of the war we didn't have it where we start we deployed it a couple months into the war But after the start of the war, we have been targets of the attacks and the attacks have been just rising in volume. But thankfully, thanks to Cloudfair's WAF, the impact has just kept on falling.

8:42But I'd like to caveat the graph with the fact that these numbers are DDoS attacks against Estonian entities. So this includes network layer attacks, like attacks against DNS servers and attacks against websites that are not under our umbrella.

9:11To understand why we had to change our tactic protecting Estonia, let's look at how things were before. implemented this shield. Before every ministry, agency, municipalities, everyone had to protect themselves. So all the like big IT houses, ministries, they all did the DDoS protection and hosting themselves. The smaller ones like municipalities they had to just rely on whatever details protection the host could provide them.

9:58When an attack came, Certi collected the indicators which were mostly just IP addresses and shared them to our agency's IT houses and then each host had to apply their plugs by hand. whenever they had the chance to do it. By the time a list arrived to these guys, the botnet had already moved on to new IPs. So we were always reacting. Every organization was fighting the same battle, but separately.

10:39So in May 2022, three months into the war, we changed models. We built a WAF as a service on Cloudflare, run by SERTE for the public sector, free of charge for the public sector.

10:58Agencies didn't have to move anything. Their servers stayed where they were. They just had to point their hosts toward us. Today, that means over 800 hosts.

11:15most not most all of the main IT houses agencies and most important services all are are all behind the cloud first wolf the key number on this slide is the number one one rule change protects everyone now when we learn about something new from an edsac on one ministry the tab export, lease, and every other client gets protected when we implement that rule.

11:49So how do we run it with such a small team to do with us? We keep central control. Certi owns the security rules for every client, which keeps it consistent and fast. but the central control only works when people trust it so every agency can see what can see their own traffic what we blocked for them we show it through our own client portal where they can see what has happened so they know they can trust the service the next step for us is cloud fair organizations so the idea is every agency or a bigger client gets their own Cloudflare account and self-service views.

12:45So that's in progress for us, but that's the ideal. So they could change anything if they wanted themselves. And now I'll hand it off to Jürgen.

12:59Good morning. Yeah, let's talk a little bit about the adversaries. themselves. The funny thing is about activists that for them to conclude an attack successful, they really want to see the web page go down. So they want to take a picture actually and post it on Telegram. And what they do is to use publicly online tools to check whether a host is up or down. And this gives... is a pretty good indicator we already have seen multiple times what tools they use so we log them we see them before the attacks and during the attacks so this gives us a little heads up some numbers here in autumn 10 out of the 14 attacks that were considered bigger for us these are not all of the attacks some of the attacks that we actually analyzed 10 of the 14 had this check before the attack so this gives us a pretty good percentage wise indication and what we can do with that is we can warn the agencies we can tighten up our WAF rules we can tighten up our rate limits but obviously

14:30every agency not everyone but some of them use the tools themselves so context matters and fortunately we have pretty well figured out which tools they use and when they use them so we have a pretty good advantage when it comes to ddos attacks so let's see when what happens when they actually get a screenshot this was one of the bigger ones The three billion requests were actually in a couple of hours, not a day, this is a mistake. A pro -Kremlin hacktivist group targeted dozens of public websites.

15:14So yeah, over three billion malicious requests in a little time span. The heaviest wave came in the afternoon. It was for the police. Border Guard, Attacks and Customs and Ministry of Justice and the three those attacks had had an impact but the impact was that the three of these sites mostly slowed down and had a brief disruption and then it was mitigated and that's what our shield is actually for the attacks try to cover multiple dozen of websites and three bigger ones that actually were hit the most were the only ones that had a brief disruption and one change from our team protected all of them so they don't have to do this themselves or everyone doesn't need to figure out what is hitting them only a central theme can help them all at once and volume is one way to attack recently they tried something else on the left we have the state login service this is called Tara in Estonia when someone tries to log into a governmental e -service with their ID card or mobile ID or smart ID whichever one they it goes through that website

16:48and if you take this down You take down a whole bunch of services so users can get authenticated to it, whether it be a medical document or whatever you're trying to file customs. There's many, many different websites. So this is a good place to aim an attack. This happened on the 11th of September. And 13 minutes within the attack... there was the first post in the telegram on the right which stated there's a picture of an error page of the state login site and the the adversary said the attack duration is going to be at three

17:39hours the attack itself was almost one hour long it had 18 80 million requests during that time at peak it was nearly 5 million in a minute from all the kinds of different countries we have on this earth and for about 45 minutes was the actual disruption so which we saw from the error rates and logins the error rate was went down almost from almost nothing to under 3 % So, most requests still went through and within the hour it was over and they claimed three hours. So, it was actually a 45 -minute partial disruption and that's their best screenshot of the year.

18:28And it's mostly fiction.

18:33So, how do we deal with these attacks? 82,000 addresses are quite a lot to block by hand. But fortunately, we have signatures and every connection has a handshake.

18:52And the handshake shows what software is making it. So a J4 fingerprint, for this example, is that handshake. And these addresses that attack us can change constantly, but the software that they use rarely changes well not not really but it's mostly the same as we've seen so yeah these 82 000 addresses only had 13 fingerprints which is actually quite a lot in our experience usually there's only a couple of them so this was a pretty good attack in that sense you can't block the 82 000 ips but you can the 13 handshakes and as we've witnessed from that attack from the September six out of the seven attacks six times the same fingerprint came back so every wave was in some sense easier for us before the J4 was even available to us we had asked Lothfair for it They had it internally and within days we had it too.

20:11So that's a good partnership moment, I guess. I'm not even sure whether it came out for everybody or that was like a special request. I don't think so.

20:21So yeah, a fingerprint identifies software another person.

20:28And the normal browser can also share this fingerprint. So usually we take some other indicators. like detection IDs of cloud for themselves or some user agents and we blocked a combination of those not to disrupt the normal traffic and yeah let's see what happens when the attacks mostly just don't work for us mainly hacktivists do want a disruption they want a screenshot if there's no screenshot there's no attack for them pretty much. And the best defense against the attacks is to be as boring as possible. So we really try to be invisible not to give them any reaction and in autumn we look closely to 14 attacks, attack waves on the public.

21:19Most were over about six minutes. Only one the login attack you saw caused anything. actually noticeable for us and even that was partial so they mainly move on or at least we've seen in recent times that their channels have victories of others countries state portals or whatever websites Estonian ones rarely show up here and I said the best against them is to be as boring as possible obviously we're not perfect Estonia as a whole this service we provide is voluntary so people don't have to come under us we have already 800 websites currently so that's a pretty good statistic for us especially as we're a small country and the websites that aren't behind our protection the attackers do find them and

22:40we usually see that the people who were hit only come to us after they've been hit so it's a good indicator that we actually provide something of value for them. Obviously they are attackers themselves they adapt it's an ongoing process all the time j4 fingerprints they become obsolete sometimes they do scraping instead of flooding as our websites maybe don't expect that much traffic so scraping can slow them down too we have to watch out for that

23:19today a lot of our shield lives in the dashboard plan on moving and using Terraform so each agency gets its own possible way to push their own configuration, stay up to date, have more hands -on experience currently this is only up to us mainly and some requests from the clients that we also do for them. The clients push their configuration up, we review it and it gets applied and we obviously keep the main central baseline WAF rules, so one move can be applied to every one of them.

24:02So if you're another country or a larger organization, what can you copy from us?

24:11Mainly it's good to centralize the protection, gather the indicators, keep them up to date, update them. Check out what tooling the attacker is using, update those, log them. Cloudflare has a good feature of logging all kinds of different traffic, which can give you an indication of when maybe next attack. Also, it helps to give your clients visibility. Also, it needs to be a partnership. If you're providing such a service that you don't really know the intricate of each application you're protecting. You need their insights, of which endpoints it's important to protect, which can be hit the hardest, whether it's a login page or a file sharing system that could be hit the most.

25:08So yeah, it's a partnership between us. And yes, watch the attacker's dueling. Ask your vendor, whether it's Cloud4 or anyone else. Maybe one day when J4 becomes obsolete, we have the next best thing. Yeah. That's it.