Our daily survey of all of the IP’s geolocated in Ukraine for those responding on port 80 is now available on a special page that is updated daily. While we still create chloropleth sector maps manually following sigacts, the summary data including the latest server count, difference, an updated graph in SVG format, and some additional statistical analysis is now available at this URL:
Incident Report On 2021-11-21 Erbil & Koya Drone Attack
On the night of 2022-11-21, shortly after midnight, two synchronized attacks on reported PJAK (PDKI) facilities in Jazhnikan/Jejnikan (جەژنیکان) (near Erbil, verified PoI 36.342596° N, 44.006713° E) and Koya (کۆیە) (reported PoI 36.064012° N, 44.604222° E) were reported by the media and on twitter.
Reports indicate the target of the Jazhnikan attack was the village transformer which was stored inside a building and not visible from the air or the street. Accepting these reports as representative of mission intent, the necessary targeting accuracy (1–2 m CEP) is meaningfully higher than civilian GPS-based targeting is reliably capable of.
Attacks with suicide drones are a growing threat globally and represent a significant escalation of asymmetry through technology. Novel threats such as drone attacks can be significantly re-symmetrized though integrated deployment of novel countermeasures like ESR radar optimized for drone detection, such as the Echodyne Echoguard products.
Ongoing attacks on UKR Infrastructure, update 11-27
Our observations have shown ongoing impact on UKR digital infrastructure. While most events are quickly resolved, there continues to be a strong correlation between attacks and downtime. The last week has shown some significant and sustained losses of server availability in the UKR, consistent with reports of sustained assaults on UKR critical infrastructure.
Over the monitoring period (2022-03-05 to present), the median number of servers online is 121,317 with a standard deviation of 14,201 or 11.7% of that standard deviation. In the first few months of the conflict, significant deviations from the median were fairly rare and recovery tended to be rapid. In the recent round of attacks, connectivity losses have been more frequent and sustained.
(The up spike on 2022-05-06 and downspike on 2022-05-08 are due to date collection timing anomalies)
A summary of significant activity shows the nadir of server response to date was 2022-08-22 when two days of significant losses left only 72,071 servers responding. Despite an increased tempo of infrastructure attacks, server response recovery remains strong.
The below table shows dates of significant losses as the percentage of servers live and the day-over-day loss relative to median.
| Date | Live | Change |
|---|---|---|
| 2022-04-13 | 73.5% | -24.1% |
| 2022-06-03 | 73.8% | -26.1% |
| 2022-06-15 | 77.3% | -22.0% |
| 2022-08-21 | 67.7% | -36.0% |
| 2022-08-22 | 59.4% | -8.3% |
| 2022-09-28 | 62.8% | -44.1% |
| 2022-10-04 | 73.0% | -23.1% |
| 2022-10-22 | 89.2% | -23.2% |
| 2022-11-04 | 69.3% | -38.6% |
| 2022-11-16 | 61.8% | -51.8% |
| 2022-11-24 | 75.6% | -29.4% |
UKR Server Connectivity Significant Activity
The most significant single day change to date was detected on 2022-11-16 following the 2022-11-15 missile campaign, which knocked out almost half of all servers (and more than half relative to median).
Losses have generally exceeded recovery such that total server responses are trending below median, 2022-11-24 also representing a one-day loss of almost 3⨉ the standard deviation.
A video (3840×1980 resolution, expand on a 4k screen for maximum readability) shows the reported data over the sampling period to 2022-11-27.
Summary data is updated daily at https://brt.llc/ukrainian-server-survey-updated-daily/
Impact of Nov 15 Missile Strikes
It has been widely reported that on November 15, Russia launched about 100 missiles into Ukraine, in a fourth wave in this series of attacks, striking critical infrastructure in many major cities (“Kyiv as well as in Rivne, Zhytomyr, Lviv, Khmelnytskyi, Dnipropetrovsk, Poltava, Vinnytsia, Odesa, Kirovohrad, Cherkasy, Volyn, and Kharkiv oblasts”).
Our network server sensor system detected the largest loss of servers we’ve seen yet: 62,798 servers going offline, or 45.6% of the country’s total detected server infrastructure.
The third wave of this series of missile attacks (31 October) had a moderate impact by typical daily norms, though a small fraction of the impact of the Oct 22ⁿᵈ & especially Nov 15ᵗʰ attacks with 6,007 servers going offline. Reporting indicates this wave mostly targeted Kiev, and while the Kiev region hosts most of the country’s detected servers, the limited scope of the attack seems to be reflected in the measured data.
The second wave (21–22 October) of attacks caused significant outages as measured by our monitoring with 28,175 servers going offline, substantially higher than expected indicating a major event. The measured results appear to be consistent with reporting on the impact to the energy infrastructure.
The first wave, (10–12 October}, did not seem to cause a statistically significant impact on the Ukrainian server infrastructure with only 1,739 servers going offline, despite being reported as wide-spread. The temporal distribution of the attack likely enabled ongoing service restoration, reducing the detectable impact. The cumulative toll on the infrastructure may also contribute to later waves yield more significant impacts on the national digital infrastructure.
Monitoring is ongoing and daily updates are at https://brt.llc/ukrainian-server-survey-updated-daily/
Monitoring Ukrainian Servers
We started a project to monitor the entire Ukranian IP space, some 11,295,373 IP addresses every night checking port 80 at each IP using zmap, which generally returns about 130,000 hits.
Summary data is updated daily at https://brt.llc/ukrainian-server-survey-updated-daily/
Each of these are then processed using a local instance of the Maxmind GeoIP database and a modified version of Brady Shea’s script to build a CSV file that includes the latitude, longitude, city, and ASN of each IP.
These files are too large to process without rather a lot of RAM and the zmap data is rather noisy, so additional, internally developed code, aggregates the data into 0.1 degree square blocks and reformats into a daily database of about 612 data rows consisting of Lat, Lon, Count, dominant city and count in that city, dominant ASN and count in that ASN.
The daily data is further processed to compute the day-over-day differences which are then mapped in QGIS over time using temporal mapping.
The size of the symbols range from 0.025 degrees square to 0.1 degrees square driven by the total number of servers responding in the geographic block, scaled exponentially to emphasize numerical variation in the small end of the scale. One might interpret larger squares as having more statistically significant data regarding the state of the digital infrastructure in the geographic region represented.
The color of each block is determined by the percentage change in the server count day-over-day from red, representing -100% meaning all servers in the block were lost to green, representing +100% meaning a the block went from 0 servers responding to some number larger than 0 in one day. This color coding is expected to illuminate localized changes in the state of the Ukrainian digital infrastructure.
The premise is that the server responses act as proxy sensors for the combination of power availability (such that the servers are on) and network availability (such that the servers are remotely accessible). If either fails, the server can’t respond, which is a proxy for the state of the regional digital infrastructure.
We find both national-scale and regional scale events, but overall the total number of servers responding has remained fairly constant, even from regions understood to be under Russian control. It is likely that ISPs were rerouted, thus to some extent confounding GeoIP lookup and to some degree degrading the validity of the data as a geographic reference. In future conflicts we will explicitly track such mitigations by trace-routing the path from the “sensor” to the first hop out of country to look for ASN-scale rerouting effects.
Pending further analysis, HTML-interactive maps of specific dates will be published as well as updates of the animated sequence of all data days.
Note that glitches in monitoring system connectivity resulted in some artifacts, such as the atypically high counts on 2022-05-06 and -07, which were collected during the daytime rather than overnight; it seems 20-30% of servers are turned off at night.
Additionally, from 2022-09-09 to -16, no data was collected so the last good data is repeated. It is very unlikely that this period had no variation in response at all, but skipping the days would create a discontinuity in the temporal mapping functions.
The below video shows data collected from 2022-03-05 to 2022-11-11. The video resolution is 3840×1920 so optimal readability requires a 4k+ monitor. The expand button will generally result in full-screen playback.
Data collection is ongoing.
Incident Report on 2021-04-14 Erbil Drone Attack
On 14 April, the US base at the Erbil Airport was hit by an attack widely reported as a drone attack. The explosion was substantial, meaningfully louder than the 15 February 107mm rocket attacks. While circumstantial, the evidence suggests a far heavier payload than modified consumer drones can carry and almost certainly implies the use of military drone technology of Iranian origin.
Attacks with suicide drones are new to the KRG region and represent a significant escalation of asymmetry through technology. Novel threats such as drone attacks can be significantly mitigated though integrated deployment of novel countermeasures, such as ESR radar optimized for drone detection, such as the Echodyne Echoguard products.
Incident report on the 2021-02-15 Erbil Attack
On 15 February, an attack was perpetrated against the US base at located on the military side of the Erbil Airport using 107mm rockes. One US contractor was killed in the attack. We undertook an analysis of the event.
New Thermal Solution for Real-Time Detection of Targets Over 38°C
BRT offers a new thermal screening solution configured for real time detection of individuals showing temperatures over 38°C based on the calibrated Mobotix M16 EST Thermal Radiometry camera. When the camera detects a target over 38°C there is a an immediate alert, no operator skill is required. The camera takes 9 measurements per second and is capable of screening multiple individuals simultaneously for accurate, high volume screening.
This solution is approved for distribution in accordance with the U.S. FDA’s COVID-19 Emergency policy for telethermographic systems.
We have a data sheet for three basic application-specific configurations:
and a white paper describing the key technical details of system:
The technology behind these systems is in high demand world-wide. Please contact us for details and availability.
New web site
Black Rose Technology, LLC has updated our web presence. The new website highlights our company focus on robust technical security measures and is based on wordpress. The previous version, live since July, 2004, is now available at https://www.blackrosetech.com/brt.html