War in Ukraine: Massive failures on ministry websites, analysis shows the extent

Created: 02/25/2022, 05:41

By: Philipp David Pries

There are fewer and fewer opportunities for companies to insure themselves against cybercrime.

© Nicolas Armer/dpa

In fact, these websites should now be a reliable source of information for all Ukrainians.

But a technical analysis by IPPEN.MEDIA shows that many government websites have been paralyzed.

Russian attacks are probably behind it.

Kiev - Only a simple error message appears in the browser.

Anyone who called up the official websites of Ukrainian ministries late Thursday evening usually ended up in a dead end.

"Page not available" it said or "Access denied".

A technical analysis by IPPEN.MEDIA in the Russia-Ukraine conflict* now shows: Almost half of the ministry pages are technically unavailable or only available to an extremely limited extent.

It started on Wednesday at the latest, and now there are more and more.

This applies, for example, to the Ministry of Youth and Sports in Ukraine as well as the Ministry of the Interior.

This goes hand in hand with numerous reports of cyber attacks by state or state-backed Russian groups.

Ukrainian ministries: Websites are often paralyzed

The websites of many Ukrainian ministries therefore stumble massively on the first day of the war - regardless of which country the websites are accessed from.

We have determined the website status of all 20 Ukrainian ministries that operate a stand-alone website.

And a repeated automated technical check of their availability (for details, see the background box) shows that everything is still working perfectly for about half of them.

But several websites have had to redirect to alternative offers, and a total of eight refuse their service for hours and completely.

Our table in this article shows the technical status of all ministry websites as of late Thursday evening.

It turns out that central authorities such as the Ministry of the Interior or Defense can no longer be reached.

Some have already redirected their offers to other addresses.

The high level of unavailability is particularly critical these days in view of the current threat situation, in which people in Ukraine are dependent on reliable information that is free of possible propaganda and Russian influence in social networks.

In individual cases, however, it is conceivable that an extremely increased use of the official websites by people in Ukraine could explain the outages.

In principle, it has long been part of war strategies to cut off the population from relevant information on websites and to spread propaganda at the same time.

Not only Russia has used this several times before.

On Thursday evening, reports of outright attacks on Ukrainian websites began to pile up.

These so-called "Distributed Denial-of-Service" (DDoS) attacks are carried out in a bundle and overwhelm the web server by making mass requests.

One of the websites even affected Cloudflare - a service known for its high level of robustness.

Likewise, there are currently reports of so-called wipers that carry out massive deletions on web servers.

Attacking websites in Ukraine: part of warfare

Ukraine War: Massive failures on Ukrainian ministry websites.

© Screenshot IPPEN.MEDIA/Pries

The analysis thus shows that, in addition to the war at sea, land and air, the war in cyberspace has also long since begun.

This is initially less visible, but can indirectly cause just as much damage.

The Ukrainian side also sees Russia as the cause and as the attacker: "Another massive DDos attack on our state began," wrote Ukraine's Minister for Digital Transformation, Mykhailo Fedorov, on Telegram.

And he's probably lucky that his ministry's website was available at least on Thursday evening - unlike many others.

Our data, sources and methods

The basis for the technical analysis was the official list of all Ukrainian ministries.

We then determined those pages that have their own website.

We then automatically checked all URLs with a so-called HTTP status check - the website reports back its current status.

So "200" means smooth functioning, while "503" stands for serious problems.

For example, we classified all websites as disturbed that repeatedly returned status codes with 5xx over a long period of time or were unusable for the user.

At the same time, we have made sure that the status code queries cannot lead to impairment of the websites.