6 ms·

DDoS attacks slow down Citizens' Initiative signing in Finland

213 points by ptaipale 5y ago

The recent dramatic policy shift in Russia has brought out two Citizens' Initiatives in the Finnish government's net portal. Both are about NATO membership in the country which is traditionally militarily non-aligned. First initiative (open Feb 21) proposes a NATO membership referendum, the other (open Feb 28) proposes that parliament should go ahead to membership procedures without referendum, because of expected Russian harrasment and influence on the referendum procedures. The government portal for initiatives has been very slow today. The authentication to sign any of the initiatives is done either by a person ID smartcard, or bank-based identification. Most people use the bank authentication (in most cases 2FA using mobile phone) because they don't bother with smart card readers. The first of the initiatives has already passed the threshold (50 000) which automatically brings it to the table in Parliament. The other initiative has collected 35 000 signatures in 30 hours, meaning it will also pass the threshold tomorrow, despite many people not being able to sign it due to bank connections failing under DDoS. YLE (state broadcaster) news about the attack: https://yle.fi/uutiset/3-12338542 https://yle.fi/uutiset/3-12338542 Initiative 1 (referendum): https://www.kansalaisaloite.fi/fi/aloite/9866 https://www.kansalaisaloite.fi/fi/aloite/9866 Initiative 2 (parliament direct decision): https://www.kansalaisaloite.fi/fi/aloite/9997 https://www.kansalaisaloite.fi/fi/aloite/9997

hutrdvnj 5y ago
I mean it's kinda obvious that the DDoS is ordered by russians, but can we prove it?
- wongarsu 5y ago
  Even if it's from within Russia it doesn't tell you if it's ordered by the government. Not every Anonymous hack is orchestrated by the US government, the same can happen inside Russia. Unless someone screws up we will probably never know for certain.
  - robotnikman 5y ago
    The Russian government pretty much turns a blind eye to their hackers as long as they don't target Russia
    - SXX 5y ago
      Nah it's was always fairly-tale. Russian FSB always cooperated with Visa / Mastercard and international banks when it's had something to do with financial fraud. They only turn a blind eye on those who work specifically for them.
  - mmsbdjjkvjj 5y ago
kichik 5y ago
Any indication to suggest it's DDoS and not just too many legitimate visitors for the site to handle?
- zeruch 5y ago
  This is a very valid question. While Russia likely cares, I'm not sure this is "top of mind" for them to dedicate resources against.
  - tablespoon 5y ago
    > While Russia likely cares, I'm not sure this is "top of mind" for them to dedicate resources against. I'm not so sure. It seems Putin really doesn't like NATO, and especially doesn't want Russia's neighbors belonging to it.
    - zeruch 5y ago
      I agree on that point, and it's history with Finland is quite...terse. It's been a duchy inside Czarist Russia, a buffer zone between it and Sweden (when both were kingdoms), it's had civil unrest fomented by the USSR, etc. It's a relationship fraught with bad blood, but strategically it's second tier compared with CIS states, the Middle East, or the Baltic states. At this stage I'm more curious as to whether (if Russia was actually DDoSing instead of just a poorly configured webhead with extra traffic due to 'timeliness' of the initiative) it makes sense to draw more negative attention to oneself, as Putin has, by doubling down on taking jabs at everyone he shares a border with...and if he's starting to see that himself, or if he's only observing through a very paranoid, myopic lens that he simply can't get out of his own policy rut long enough to not totally collapse the Russian state, and him with it.
  - paxys 5y ago
    > I'm not sure this is "top of mind" for them to dedicate resources against This entire war is about Ukraine joining NATO, and the expanding NATO influence in general. How would another bordering country having a NATO referendum not be top of mind for Russia?
container 5y ago
In case anyone is wondering, the (only) article linked in this post only talks about the bank Nordea (which some users might use to verify their identity on the initiative site)
zokier 5y ago
Just to be absolutely clear, that YLE news article that OP linked does not mention the Citizens Initiatives platform at all. It reports only an attack against one bank (banks are popular authentication providers in Finland). There are total of 10 different banks providing authentication for the Citizens Initiatives platform, and additionally two non-banking based authentication options.
- usr1106 5y ago
  Agree. The submission sounds more like a conspiracy theory. Why does the submitter needs to write a news article? Because there is no source to cite (the given link is absolutely not a source for what the submitter claims, probably everyone can understand that even if over 999/1000 readers need machine translation to do so). It's was already in today's printed newspaper that the parliament will put NATO membership on the session agenda. Nordea is the biggest bank in Finland so there could be all kind of reasons to DDoS them. But not having more people sign the petition seems a far-fetched one. Polls show that support to join raised from 30% in January to 53% in the last poll. The last poll started already before Putin's attack and especially the news that this time Europe does not only watch and make some symbolic declarations, so one can easily assume that support has gone up since then. Should it become mainline news that this attack was directed against signing the petition, support will go up further. My feeling is bringing down the petition site would be much easier than the bank that many but far from all potential sginers need for authentication. The petition site is little used after all and has not gained much attention before, certainly not internationally. 50,000 signers needed. Over 90% of the petitions get just a small fraction of that during the 6 months a petition can be supported. Nordea bank handles that many customers in just a couple of hours every day and they have been target of DDoS before.
mmsbdjjkvjj 5y ago
So, time to cut off Russia from internet.
swayvil 5y ago
- coastflow 5y ago
  This wouldn't be the case, as it is normal website behaviour. Users can't downvote posts (only comments) [0], and self posts on Hacker News are light grey by default [1]. [0] https://news.ycombinator.com/item?id=17735526 https://news.ycombinator.com/item?id=17735526 [1] https://news.ycombinator.com/item?id=468180 https://news.ycombinator.com/item?id=468180
  - swayvil 5y ago
    Hn's tacks are reliably the sharpest.
- deleted 5y ago
  [deleted]
aaron695 5y ago
exact_string 5y ago
Just tried using the portal both with the mobile phone authentication and non-Nordea bank authentication. Everything works smoothly. I'm also not sure how important these two initiatives are in practice since it's clear that the politicians are already very much aware of the increased support for NATO membership.
wolverine876 5y ago
Is it HN policy to accept self-written posts? I don't remember it until maybe a few months ago. I thought you need to either post a link or Ask HN.
- anfogoat 5y ago
  Tell HN has been a thing for years: https://hn.algolia.com/?query=%22tell%20hn%22 https://hn.algolia.com/?query=%22tell%20hn%22
thnujmikkkk 5y ago
Americans should know they are responsible for what is happening in Ukraine now because their government has continuously interfered with Ukraine and Russian for a long time. This aggression coming out of America seems accounted for by the American culture that they worship money and strength and don't care much about weak people that they exploit. Even though I was born in a western country under the influence of western media, I have an impression that American irresponsibility is appalling as I consider the following facts: 1. The current Ukraine contains historically Russian territories that were moved to Ukraine in the era of USSR. Russian government cannot ignore originally Russian people living there. And Ukrainian nationalists are quite dangerous people. They are repressing proRussian people in the east. This is not something that Putin made up. My Russian acquaintances who work in the west directly know acquaintances and relatives living in the east Ukraine who witnessed such repression, namely, torture and murder. They joined the overturning of the government in 2014 holding the same flag as that they used when they cooperated with Nazis in 1940's. American government seems to often fund and arm such group of (almost terrorist) people, as they did to Mujahidn in Afghanistan (closely related to Taliban and AlQuaida) when it fought against Soviet. 2. The US have actually interfered with Ukraine and was likely involved in overturning the democratically elected Ukrainian government in 2014, establishing a puppet. Most notably, there was evidence, leaked conversation between American officials about who they want as the next Ukrainian leader. They had this conversation before the overturn actually happened, which even those US officials themselves admitted, although they denied American support of the overturn. Joe Biden was at the top of the then US administration, and his son earned millions of dollars in Ukraine afterwards. Anyone would suspect his deep involvement from this. 3. Russia has always been threatened by the economic aggression by the US. Putin was at first friendly to orgarches and the US when he took the position of president, but he started fighting them when they tried to sell off the shares of the companies that possess Russian natural resources to American capitals in 2004. If this had happened, the Russian oil money would have directly flowed into the US capitals, and therefore wouldn't have been accessible to Russian people. Notably, I was impressed by how IMF forced a country to privatise their state-owned companies and then American capitals tried to absorb them. Fortunately, this aggression was stopped by Putin, and a half of the shares of Russian oil companies are now owned by the state. This appears to be the key to the reason why the American government regard Putin as enemy. 4. Western media are highly suspected to intentionally broadcast distorted images of Putin. A typical example is Navalny's assassination. He claimed that he rang FSB agents and recorded their confession of the attempted assassination, by pretending to be their boss on the phone. What is this stupid story? He barely escaped from the assassination by FSB, and the notorious Russian spy agents confessed their attempt of assassination on the phone? Well, I personally believe that Putin is killing his opponents when they threaten his power. But, after hearing many such crappy stories from the western media, I started to believe Putin's opponents are sponsored by westerners that try to economically exploit Russia. 5. The current Ukrainian president who was from the south but elected by people in the pro-EU part, Zelensky, provoked Russia to an unthinkable extent. He showed the will to get back crimea, to crush the rebels in the east, to join NATO, and to increase their armament to cope with Russia (even nuclear armament). The first three plainly violates the Minsk agreement, and undermines Germany and France who joined it. Based on this fact, any sensible people would think that he risked own people's lives. From the fact that he could boldly do this, I suspect that he was backed by the US. No other countries would have been able to give him confidence to do so. All these stories and others that I hear consistently indicate American aggression. Thus, despite pro-western media in my country, I started to believe that, even though Putin is a dictator and killing his opponents, he tells more genuine things. Europeans should reconsider their relationship with the US that destabilise Europe.

213 points by ptaipale 5y ago

hutrdvnj 5y ago

I mean it's kinda obvious that the DDoS is ordered by russians, but can we prove it?

wongarsu 5y ago
Even if it's from within Russia it doesn't tell you if it's ordered by the government. Not every Anonymous hack is orchestrated by the US government, the same can happen inside Russia. Unless someone screws up we will probably never know for certain.
- robotnikman 5y ago
  The Russian government pretty much turns a blind eye to their hackers as long as they don't target Russia
  - SXX 5y ago
    Nah it's was always fairly-tale. Russian FSB always cooperated with Visa / Mastercard and international banks when it's had something to do with financial fraud. They only turn a blind eye on those who work specifically for them.
- mmsbdjjkvjj 5y ago

kichik 5y ago

Any indication to suggest it's DDoS and not just too many legitimate visitors for the site to handle?

zeruch 5y ago
This is a very valid question. While Russia likely cares, I'm not sure this is "top of mind" for them to dedicate resources against.
- tablespoon 5y ago
  > While Russia likely cares, I'm not sure this is "top of mind" for them to dedicate resources against. I'm not so sure. It seems Putin really doesn't like NATO, and especially doesn't want Russia's neighbors belonging to it.
  - zeruch 5y ago
    I agree on that point, and it's history with Finland is quite...terse. It's been a duchy inside Czarist Russia, a buffer zone between it and Sweden (when both were kingdoms), it's had civil unrest fomented by the USSR, etc. It's a relationship fraught with bad blood, but strategically it's second tier compared with CIS states, the Middle East, or the Baltic states. At this stage I'm more curious as to whether (if Russia was actually DDoSing instead of just a poorly configured webhead with extra traffic due to 'timeliness' of the initiative) it makes sense to draw more negative attention to oneself, as Putin has, by doubling down on taking jabs at everyone he shares a border with...and if he's starting to see that himself, or if he's only observing through a very paranoid, myopic lens that he simply can't get out of his own policy rut long enough to not totally collapse the Russian state, and him with it.
- paxys 5y ago
  > I'm not sure this is "top of mind" for them to dedicate resources against This entire war is about Ukraine joining NATO, and the expanding NATO influence in general. How would another bordering country having a NATO referendum not be top of mind for Russia?

container 5y ago

In case anyone is wondering, the (only) article linked in this post only talks about the bank Nordea (which some users might use to verify their identity on the initiative site)

zokier 5y ago

Just to be absolutely clear, that YLE news article that OP linked does not mention the Citizens Initiatives platform at all. It reports only an attack against one bank (banks are popular authentication providers in Finland). There are total of 10 different banks providing authentication for the Citizens Initiatives platform, and additionally two non-banking based authentication options.

usr1106 5y ago
Agree. The submission sounds more like a conspiracy theory. Why does the submitter needs to write a news article? Because there is no source to cite (the given link is absolutely not a source for what the submitter claims, probably everyone can understand that even if over 999/1000 readers need machine translation to do so). It's was already in today's printed newspaper that the parliament will put NATO membership on the session agenda. Nordea is the biggest bank in Finland so there could be all kind of reasons to DDoS them. But not having more people sign the petition seems a far-fetched one. Polls show that support to join raised from 30% in January to 53% in the last poll. The last poll started already before Putin's attack and especially the news that this time Europe does not only watch and make some symbolic declarations, so one can easily assume that support has gone up since then. Should it become mainline news that this attack was directed against signing the petition, support will go up further. My feeling is bringing down the petition site would be much easier than the bank that many but far from all potential sginers need for authentication. The petition site is little used after all and has not gained much attention before, certainly not internationally. 50,000 signers needed. Over 90% of the petitions get just a small fraction of that during the 6 months a petition can be supported. Nordea bank handles that many customers in just a couple of hours every day and they have been target of DDoS before.

mmsbdjjkvjj 5y ago

So, time to cut off Russia from internet.

swayvil 5y ago

coastflow 5y ago
This wouldn't be the case, as it is normal website behaviour. Users can't downvote posts (only comments) [0], and self posts on Hacker News are light grey by default [1]. [0] https://news.ycombinator.com/item?id=17735526 https://news.ycombinator.com/item?id=17735526 [1] https://news.ycombinator.com/item?id=468180 https://news.ycombinator.com/item?id=468180
- swayvil 5y ago
  Hn's tacks are reliably the sharpest.
deleted 5y ago
[deleted]

aaron695 5y ago

exact_string 5y ago

Just tried using the portal both with the mobile phone authentication and non-Nordea bank authentication. Everything works smoothly. I'm also not sure how important these two initiatives are in practice since it's clear that the politicians are already very much aware of the increased support for NATO membership.

wolverine876 5y ago

Is it HN policy to accept self-written posts? I don't remember it until maybe a few months ago. I thought you need to either post a link or Ask HN.

anfogoat 5y ago
Tell HN has been a thing for years: https://hn.algolia.com/?query=%22tell%20hn%22 https://hn.algolia.com/?query=%22tell%20hn%22

thnujmikkkk 5y ago

Americans should know they are responsible for what is happening in Ukraine now because their government has continuously interfered with Ukraine and Russian for a long time. This aggression coming out of America seems accounted for by the American culture that they worship money and strength and don't care much about weak people that they exploit. Even though I was born in a western country under the influence of western media, I have an impression that American irresponsibility is appalling as I consider the following facts: 1. The current Ukraine contains historically Russian territories that were moved to Ukraine in the era of USSR. Russian government cannot ignore originally Russian people living there. And Ukrainian nationalists are quite dangerous people. They are repressing proRussian people in the east. This is not something that Putin made up. My Russian acquaintances who work in the west directly know acquaintances and relatives living in the east Ukraine who witnessed such repression, namely, torture and murder. They joined the overturning of the government in 2014 holding the same flag as that they used when they cooperated with Nazis in 1940's. American government seems to often fund and arm such group of (almost terrorist) people, as they did to Mujahidn in Afghanistan (closely related to Taliban and AlQuaida) when it fought against Soviet. 2. The US have actually interfered with Ukraine and was likely involved in overturning the democratically elected Ukrainian government in 2014, establishing a puppet. Most notably, there was evidence, leaked conversation between American officials about who they want as the next Ukrainian leader. They had this conversation before the overturn actually happened, which even those US officials themselves admitted, although they denied American support of the overturn. Joe Biden was at the top of the then US administration, and his son earned millions of dollars in Ukraine afterwards. Anyone would suspect his deep involvement from this. 3. Russia has always been threatened by the economic aggression by the US. Putin was at first friendly to orgarches and the US when he took the position of president, but he started fighting them when they tried to sell off the shares of the companies that possess Russian natural resources to American capitals in 2004. If this had happened, the Russian oil money would have directly flowed into the US capitals, and therefore wouldn't have been accessible to Russian people. Notably, I was impressed by how IMF forced a country to privatise their state-owned companies and then American capitals tried to absorb them. Fortunately, this aggression was stopped by Putin, and a half of the shares of Russian oil companies are now owned by the state. This appears to be the key to the reason why the American government regard Putin as enemy. 4. Western media are highly suspected to intentionally broadcast distorted images of Putin. A typical example is Navalny's assassination. He claimed that he rang FSB agents and recorded their confession of the attempted assassination, by pretending to be their boss on the phone. What is this stupid story? He barely escaped from the assassination by FSB, and the notorious Russian spy agents confessed their attempt of assassination on the phone? Well, I personally believe that Putin is killing his opponents when they threaten his power. But, after hearing many such crappy stories from the western media, I started to believe Putin's opponents are sponsored by westerners that try to economically exploit Russia. 5. The current Ukrainian president who was from the south but elected by people in the pro-EU part, Zelensky, provoked Russia to an unthinkable extent. He showed the will to get back crimea, to crush the rebels in the east, to join NATO, and to increase their armament to cope with Russia (even nuclear armament). The first three plainly violates the Minsk agreement, and undermines Germany and France who joined it. Based on this fact, any sensible people would think that he risked own people's lives. From the fact that he could boldly do this, I suspect that he was backed by the US. No other countries would have been able to give him confidence to do so. All these stories and others that I hear consistently indicate American aggression. Thus, despite pro-western media in my country, I started to believe that, even though Putin is a dictator and killing his opponents, he tells more genuine things. Europeans should reconsider their relationship with the US that destabilise Europe.