Cyber Attack Forces Wikileaks to Change Web Address



From BBC News


Friday, December 3, 2010


Whistle-blowing website Wikileaks has been forced to change its web address after the company providing its domain name cut off service. EveryDNS.net said it had terminated services because Wikileaks.org had come under massive cyber attacks. But Wikileaks has already reappeared using a Swiss web address. Wikileaks has also used micro-blogging site Twitter to urge its fans to redistribute its "raw" net address so it can be viewed at any time. This numerical internet protocol (IP) address remains live and accessible even when web domains - the normal "www" addresses used to access most sites - are unavailable.


Experts say it is likely that Wikileaks has done deals with lots of web hosting companies, although many are likely to back away from dealing with the controversial site in the light of recent web attacks. There is also a published list of mirror sites, which Wikileaks hopes will provide constant access to the site. Some of these sites have simply copied Wikileaks' content and put it on a different web server, while others are using different domain names to point at the original content. The more of these sites there are, the more difficult it will be to shut Wikileaks down, security analyst Paul Mutton told the BBC. In France, the industry minister Eric Besson has called for a ban of Wikileaks on French servers. One of the mirror sites, Wikileaks.ch, is currently hosted on servers in France. In a post on Twitter, Wikileaks acknowledged that its domain had been "killed" by EveryDNS.net. It was not clear how long disruption to the wikileaks.org site would last. In a statement on its website, EveryDNS.net said it had issued a 24-hour termination notice to Wikileaks which ended at 0300 GMT on 2 December.


The net appears to be closing in on Wikileaks as more and more companies it relies on distance themselves from it. Shutting down the main .org site will cause problems but it is by no means the end. Its Twitter feed remains defiant, urging fans to log on via its IP address with the tweet "Free speech has number: http://88.80.13.160". In some ways, any attempts to cut off Wikileaks could be a case of too little, too late. The thousands of secret US diplomatic cables at the heart of the controversy are already with media outlets. A site as controversial and savvy as Wikileaks has plenty up its sleeve, like the mysterious encrypted file labelled 'insurance', which is believed to have been posted on Bit Torrent and is rumoured to contain all the leaks. It said the domain wikileaks.org had become the target of "multiple distributed denial of service (DDOS) attacks. These attacks have, and future attacks would, threaten the stability of the EveryDNS.net infrastructure, which enables access to almost 500,000 other websites," it said. "Any downtime of the wikileaks.org website has resulted from its failure to use another hosted DNS service provider," it added. Websites use web hosting firms such as EveryDNS.net to translate their raw IP addresses to a more memorable web address such as Wikileaks.org. But the IP address of a website will also direct users to the site.


One web expert explained that Wikileaks had managed to re-establish web access via a different address. "Users visiting the www.wikileaks.ch website appear to be directed via a Swedish website on to a server in France which is now hosting their main website," explained Sebastien Lahtinen, director of web hosting firm NetConnex. In a bizarre twist, the .ch address is actually hosted by EveryDNS, the firm which suspended Wikileak's .Wikileaks' address. "It seems a strange choice given that they pulled the plug on the .org address just a few hours ago," said Paul Mutton, a security analyst at internet services firm Netcraft. "It could be that Wikileaks is quite happy to play a cat and mouse game with them," he added. Using a Swiss domain could be Wikileaks anticipating the next line of attack - having its IP address de-registered, thinks Mr Mutton. "Moving to a non-US domain makes sense. Its previous domain was registered with a US company and as such has to work within US laws, with potential for the government to lean on it and get it suspended," said Mr Mutton. The Wikileaks situation is challenging the balance between free speech, commercial and technical pressures and the laws in different jurisdictions around the world. Wikileaks says its website has been under attack since it began publishing more than 250,000 classified US diplomatic cables. The memos, which discuss US diplomatic relations and military activities, have been causing controversy across the world. It turned to the online store Amazon to host its site but the company ended the agreement on Wednesday - a move welcomed by US officials. Amazon said that it had not removed Wikileaks because of a government inquiry. Instead it said that Wikileaks had failed to adhere to its terms of service. "It's clear that Wikileaks doesn't own or otherwise control all the rights to this classified content. Further it is not credible that the extraordinary volume of 250,000 classified documents that Wikileaks is publishing could have been carefully redacted in such a way as to ensure that they weren't putting innocent people in jeopardy," it said on its website.But freedom-of-speech campaigners remain defiant. "The first serious infowar is now engaged. The field of battle is Wikileaks. You are troops," tweeted John Perry Barlow, the founder of the Electronic Frontier Foundation.


[It’s certainly difficult to keep a good website down. The Net sees censorship as damage and routes around it. Information wants to be free and it looks like DOS attacks aren’t enough to stop it spreading. The genie is most definitely out of the bottle here and I seriously doubt that anything the US or other governments try will shut things down permanently. This aspect of the affair is almost as interesting as the leaks themselves and almost as revealing as to the value some countries place on free speech and democracy.]