Incidents

With incidents we understand all kind of misuse of Internet resources and violation of acceptable use policies, including sending SPAM or viruses, phishing, port scanning, unauthorized access, system compromises, etc.

Anybody can report a cyber security incident. It can be done by e-mail or by phone. All incoming information regarding incidents is handled confidentially by CERT.LV. If incident information is exchanged using public networks, information is encrypted using PGP, GPG or other method, that is preferred by involved parties.

Information about the incident is automatically sent to the involved institution or to the corresponding internet service provider who then informs the end user.

Incident Classification

Since January 1, 2017 CERT.LV uses international eCSIRT.net incident classification.

Intrusion Attempts - An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.). Multiple login attempts (Guessing / cracking of passwords, brute force). An attempt using an unknown exploit.

Information Content Security - Besides a local abuse of data and systems the information security can be endangered by a successful account or application compromise. Furthermore attacks are possible that intercept and access information during transmission (wiretapping, spoofing or hijacking). Human/configuration/software error can also be the cause.

Information Gathering - Attacks that send requests to a system to discover weak points. This includes also some kind of testing processes to gather information about hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, ...), port scanning.

Abusive Content - Spam or "Unsolicited Bulk Email", this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content. Child Pornography and other illegal content defined by the Law on Pornography Restrictions and Kriminal law. Hate speach.

Vulnerable - Open for abuse: open resolvers, world readable printers, vulnerability apparent from Nessus etc scans, virus signatures not up-to-­date, etc

Intrusions - A successful compromise of a system or application (service). This can have been caused remotely by a known or new vulnerability, but also by an unauthorized local access. Also includes being part of a botnet.

Fraud - Using resources for unauthorized purposes including profit‐making ventures (E.g. the use of e‐mail to participate in illegal profit chain letters or pyramid schemes). Type of attacks in which one entity illegitimately assumes the identity of another in order to benefit from it or persuade the user to reveal a private credential.

Malicious Code - Software that is intentionally included or inserted in a system for a harmful purpose. A user interaction is normally necessary to activate the code.

Availability - By this kind of an attack a system is bombarded with so many packets that the operations are delayed or the system crashes. DoS examples are ICMP and SYN floods, Teardrop attacks and mail‐bombing. DDoS often is based on DoS attacks originating from botnets, but also other scenarios exist like DNS Amplification attacks. However, the availability also can be affected by local actions (destruction, disruption of power supply, etc.) - or by Act of God, spontaneous failures or human error, without malice or gross neglect being involved.

Other - Consultations and all incidents which don't fit in one of the given categories.