Korea DDoS surge mired in hype and confusion

Posted by   Virus Bulletin on   Jul 15, 2009

Rows rumble on over sources and targets of botnet attacks.

Last week's gush of denial-of-service attacks has sparked considerable excitement and argument, with rumours of possible links to North Korean aggression leading to frenzied hype and ill-founded suggestions of the outbreak of cyberwar.

The attacks targeted a range of servers, notably government and news websites in the US and South Korea, and originated from a botnet of systems thought to be infected with a modified variant of the venerable W32/MyDoom worm. Like the targeted sites, an unusually large proportion of the botnet appears to have been located in South Korea, a factor many have taken as a sign that the attack originated from their neighbours to the north, whose nuclear testing activities have brought the ongoing problems of the divided nation to the world's attention in recent weeks.

During a week of conflicting reports and studies of the attack, with the botnet described as 'massive' by some and 'average' by others, US Republican politician Peter Hoesktre heightened the hype by calling for a strong response to what he considered an act of cyberwar by North Korea. However, other sources have speculated that the local focus of the infections, and the attacks, could simply be down to an infection source on a popular Korean website, while other researchers have found the control servers for the botnet may be located in Florida, USA. With the deactivation of the botnet accompanied by apparently self-destructive activity on infected systems, investigations look likely to continue, and with them no doubt further speculation.

Early reports on the outbreak last week were issued by Associated Press here. More details were recorded by Brian Krebs, whose Washington Post host site was targeted in the attacks - see here, with a follow-up on the self-destruct here and further reporting in The Register here. Wired reported on the outspoken congressman here , with more in The Register here. More sober comments can be found in blog entries at Sunbelt here and here, ESET here and Trend Micro here.

An in-depth study of the botnet, including a list of targeted domains, is provided by the Shadowserver Foundation here, while the latest report on the possible sources of the attacks is in PCWorld here.

Posted on 15 July 2009 by Virus Bulletin



Latest posts:

Nominations opened for sixth Péter Szőr Award

Virus Bulletin is seeking nominations for the sixth annual Péter Szőr Award.

Haroon Meer and Adrian Sanabria to deliver VB2019 closing keynote

New additions to the VB2019 conference programme include a closing keynote address from Thinkst duo Haroon Meer and Adrian Sanabria and a talk on attacks against payment systems.

Free VB2019 tickets for students

Virus Bulletin is excited to announce that, thanks to generous sponsorship from Google Android, we are able to offer 20 free tickets to students who want to attend VB2019.

VB2018 paper: Lazarus Group: a mahjong game played with different sets of tiles

The Lazarus Group, generally linked to the North Korean government, is one of the most notorious threat groups seen in recent years. At VB2018 ESET researchers Peter Kálnai and Michal Poslušný presented a paper looking at the group's various…

Book your VB2019 ticket now for a chance to win a ticket for BSides London

Virus Bulletin is proud to sponsor this year's BSides London conference, which will take place next week, and we have a number of tickets to give away.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.