Korea DDoS surge mired in hype and confusion
Rows rumble on over sources and targets of botnet attacks.
Last week's gush of denial-of-service attacks has sparked considerable excitement and argument, with rumours of possible
links to North Korean aggression leading to frenzied hype and ill-founded suggestions of the outbreak of cyberwar.
The attacks targeted a range of servers, notably government and news websites in the US and South Korea, and originated
from a botnet of systems thought to be infected with a modified variant of the venerable W32/MyDoom worm. Like the
targeted sites, an unusually large proportion of the botnet appears to have been located in South Korea, a factor many
have taken as a sign that the attack originated from their neighbours to the north, whose nuclear testing activities
have brought the ongoing problems of the divided nation to the world's attention in recent weeks.
During a week of conflicting reports and studies of the attack, with the botnet described as 'massive' by some and
'average' by others, US Republican politician Peter Hoesktre heightened the hype by calling for a strong response to what
he considered an act of cyberwar by North Korea. However, other sources have speculated that the local focus of the
infections, and the attacks, could simply be down to an infection source on a popular Korean website, while other
researchers have found the control servers for the botnet may be located in Florida, USA. With the deactivation of the
botnet accompanied by apparently self-destructive activity on infected systems, investigations look likely to continue,
and with them no doubt further speculation.
Early reports on the outbreak last week were issued by Associated Press
here. More details
were recorded by Brian Krebs, whose Washington Post host site was targeted in the attacks - see
here, with a
follow-up on the self-destruct
here and further
reporting in The Register here.
Wired reported on the outspoken congressman here
, with more in The Register here. More sober
comments can be found in blog entries at Sunbelt
here and
here, ESET
here and Trend Micro
here.
An in-depth study of the botnet, including a list of targeted domains, is provided by the Shadowserver Foundation
here, while the latest report on the possible
sources of the attacks is in PCWorld
here.
15 July 2009
Tags:
botnet, cyberwar, ddos, government, korea, mydoom.
del.icio.us 
digg this
0 comments
