We have developed a small python application for internal use to enable desktop notifications of camera events using Mobotix’ “IP Notify” action capability as a sender and our python script as a receiver so that the camera can push notifications to the OS desktop notification system. The script is extremely resource light and can be run at startup in the background without measurable impact on the OS.
For details on the application and download, please see visit this link. The script is available for download as python code with installation instructions that has been tested on Linux and Windows and should run without issue on MacOS, but has not been tested in that environment. There is also an installable Windows binary (.exe) available with all necessary dependencies integrated for those unfamiliar with command line operations.
The software is provided “as is”, without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the copyright holders or anyone distributing the software be liable for any damages or other liability, whether in contract, tort or otherwise, arising from, out of or in connection with the software or the use of the software.
Our daily survey of all of the IP’s geolocated in Ukraine for those responding on port 80 is now available on a special page that is updated daily. While we still create chloropleth sector maps manually following sigacts, the summary data including the latest server count, difference, an updated graph in SVG format, and some additional statistical analysis is now available at this URL:
On the night of 2022-11-21, shortly after midnight, two synchronized attacks on reported PJAK (PDKI) facilities in Jazhnikan/Jejnikan (جەژنیکان) (near Erbil, verified PoI 36.342596° N, 44.006713° E) and Koya (کۆیە) (reported PoI 36.064012° N, 44.604222° E) were reported by the media and on twitter.
Reports indicate the target of the Jazhnikan attack was the village transformer which was stored inside a building and not visible from the air or the street. Accepting these reports as representative of mission intent, the necessary targeting accuracy (1–2 m CEP) is meaningfully higher than civilian GPS-based targeting is reliably capable of.
Attacks with suicide drones are a growing threat globally and represent a significant escalation of asymmetry through technology. Novel threats such as drone attacks can be significantly re-symmetrized though integrated deployment of novel countermeasures like ESR radar optimized for drone detection, such as the Echodyne Echoguard products.
Our observations have shown ongoing impact on UKR digital infrastructure. While most events are quickly resolved, there continues to be a strong correlation between attacks and downtime. The last week has shown some significant and sustained losses of server availability in the UKR, consistent with reports of sustained assaults on UKR critical infrastructure.
Over the monitoring period (2022-03-05 to present), the median number of servers online is 121,317 with a standard deviation of 14,201 or 11.7% of that standard deviation. In the first few months of the conflict, significant deviations from the median were fairly rare and recovery tended to be rapid. In the recent round of attacks, connectivity losses have been more frequent and sustained.
UKR nationwide responding servers and day-over-day changes.
(The up spike on 2022-05-06 and downspike on 2022-05-08 are due to date collection timing anomalies)
A summary of significant activity shows the nadir of server response to date was 2022-08-22 when two days of significant losses left only 72,071 servers responding. Despite an increased tempo of infrastructure attacks, server response recovery remains strong.
The below table shows dates of significant losses as the percentage of servers live and the day-over-day loss relative to median.
Date
Live
Change
2022-04-13
73.5%
-24.1%
2022-06-03
73.8%
-26.1%
2022-06-15
77.3%
-22.0%
2022-08-21
67.7%
-36.0%
2022-08-22
59.4%
-8.3%
2022-09-28
62.8%
-44.1%
2022-10-04
73.0%
-23.1%
2022-10-22
89.2%
-23.2%
2022-11-04
69.3%
-38.6%
2022-11-16
61.8%
-51.8%
2022-11-24
75.6%
-29.4%
UKR Server Connectivity Significant Activity
The most significant single day change to date was detected on 2022-11-16 following the 2022-11-15 missile campaign, which knocked out almost half of all servers (and more than half relative to median).
Losses have generally exceeded recovery such that total server responses are trending below median, 2022-11-24 also representing a one-day loss of almost 3⨉ the standard deviation.
UKR Server Response Map 2022-11-24
A video (3840×1980 resolution, expand on a 4k screen for maximum readability) shows the reported data over the sampling period to 2022-11-27.
Our network server sensor system detected the largest loss of servers we’ve seen yet: 62,798 servers going offline, or 45.6% of the country’s total detected server infrastructure.
Russian fourth wave: 45.6% of Ukrainian servers offline.
The third wave of this series of missile attacks (31 October) had a moderate impact by typical daily norms, though a small fraction of the impact of the Oct 22ⁿᵈ & especially Nov 15ᵗʰ attacks with 6,007 servers going offline. Reporting indicates this wave mostly targeted Kiev, and while the Kiev region hosts most of the country’s detected servers, the limited scope of the attack seems to be reflected in the measured data.
Russian third wave: 4.3% of Ukrainian servers offline.
The second wave (21–22 October) of attacks caused significant outages as measured by our monitoring with 28,175 servers going offline, substantially higher than expected indicating a major event. The measured results appear to be consistent with reporting on the impact to the energy infrastructure.
Russian second wave: 20.6% of Ukrainian servers offline.
The first wave, (10–12 October}, did not seem to cause a statistically significant impact on the Ukrainian server infrastructure with only 1,739 servers going offline, despite being reported as wide-spread. The temporal distribution of the attack likely enabled ongoing service restoration, reducing the detectable impact. The cumulative toll on the infrastructure may also contribute to later waves yield more significant impacts on the national digital infrastructure.
Russian first wave: 1.4% of Ukrainian servers offline.
We started a project to monitor the entire Ukranian IP space, some 11,295,373 IP addresses every night checking port 80 at each IP using zmap, which generally returns about 130,000 hits.
Servers Responding on Port 80 in Ukraine on 2022-11-11
Each of these are then processed using a local instance of the Maxmind GeoIP database and a modified version of Brady Shea’s script to build a CSV file that includes the latitude, longitude, city, and ASN of each IP.
These files are too large to process without rather a lot of RAM and the zmap data is rather noisy, so additional, internally developed code, aggregates the data into 0.1 degree square blocks and reformats into a daily database of about 612 data rows consisting of Lat, Lon, Count, dominant city and count in that city, dominant ASN and count in that ASN.
The daily data is further processed to compute the day-over-day differences which are then mapped in QGIS over time using temporal mapping.
The size of the symbols range from 0.025 degrees square to 0.1 degrees square driven by the total number of servers responding in the geographic block, scaled exponentially to emphasize numerical variation in the small end of the scale. One might interpret larger squares as having more statistically significant data regarding the state of the digital infrastructure in the geographic region represented.
The color of each block is determined by the percentage change in the server count day-over-day from red, representing -100% meaning all servers in the block were lost to green, representing +100% meaning a the block went from 0 servers responding to some number larger than 0 in one day. This color coding is expected to illuminate localized changes in the state of the Ukrainian digital infrastructure.
Map symbol details
The premise is that the server responses act as proxy sensors for the combination of power availability (such that the servers are on) and network availability (such that the servers are remotely accessible). If either fails, the server can’t respond, which is a proxy for the state of the regional digital infrastructure.
We find both national-scale and regional scale events, but overall the total number of servers responding has remained fairly constant, even from regions understood to be under Russian control. It is likely that ISPs were rerouted, thus to some extent confounding GeoIP lookup and to some degree degrading the validity of the data as a geographic reference. In future conflicts we will explicitly track such mitigations by trace-routing the path from the “sensor” to the first hop out of country to look for ASN-scale rerouting effects.
Pending further analysis, HTML-interactive maps of specific dates will be published as well as updates of the animated sequence of all data days.
Note that glitches in monitoring system connectivity resulted in some artifacts, such as the atypically high counts on 2022-05-06 and -07, which were collected during the daytime rather than overnight; it seems 20-30% of servers are turned off at night.
Additionally, from 2022-09-09 to -16, no data was collected so the last good data is repeated. It is very unlikely that this period had no variation in response at all, but skipping the days would create a discontinuity in the temporal mapping functions.
The below video shows data collected from 2022-03-05 to 2022-11-11. The video resolution is 3840×1920 so optimal readability requires a 4k+ monitor. The expand button will generally result in full-screen playback.
On 14 April, the US base at the Erbil Airport was hit by an attack widely reported as a drone attack. The explosion was substantial, meaningfully louder than the 15 February 107mm rocket attacks. While circumstantial, the evidence suggests a far heavier payload than modified consumer drones can carry and almost certainly implies the use of military drone technology of Iranian origin.
Attacks with suicide drones are new to the KRG region and represent a significant escalation of asymmetry through technology. Novel threats such as drone attacks can be significantly mitigated though integrated deployment of novel countermeasures, such as ESR radar optimized for drone detection, such as the Echodyne Echoguard products.
On 15 February, an attack was perpetrated against the US base at located on the military side of the Erbil Airport using 107mm rockes. One US contractor was killed in the attack. We undertook an analysis of the event.
BRT offers a new thermal screening solution configured for real time detection of individuals showing temperatures over 38°C based on the calibrated Mobotix M16 EST Thermal Radiometry camera. When the camera detects a target over 38°C there is a an immediate alert, no operator skill is required. The camera takes 9 measurements per second and is capable of screening multiple individuals simultaneously for accurate, high volume screening.
Black Rose Technology, LLC has updated our web presence. The new website highlights our company focus on robust technical security measures and is based on wordpress. The previous version, live since July, 2004, is now available at https://www.blackrosetech.com/brt.html
