Computerworld — There's nothing in the code of the malware used since Saturday to attack a wide array of U.S. and South Korean government and high-profile Web sites that indicates the campaign is backed by the government of North Korea, a noted botnet researcher said today.

Cyber Attack in South Korea Set to Resume, Says AhnLab

"There's nothing in there to suggest that it's state sponsored," said Joe Stewart, the director of director of SecureWorks' counter-threat unit, who has examined the attack code planted on the thousands of hijacked PCs used to conduct distributed denial-of-service (DDoS) attacks. "In fact, it looks like every other bot I see created by an intermediate programmer."

The attacks, which started Saturday when several U.S. government sites -- including those of the Federal Trade Commission (FTC) and the U.S. Department of Transportation (DOT) -- either knocked the sites offline or made it difficult for users to reach them.

DDoS attacks try to flood Web sites with so many requests that the hosting servers and bandwidth are overwhelmed, making them unavailable to legitimate users.

The number of sites targeted each day has increased, said Stewart, another indication that it's unlikely that a government is behind the attacks. "This looks like an attack designed to draw attention to itself, rather than to actually try to take these sites offline," he said, explaining how the attacks have been spread too thin to be effective.

"If it was state-sponsored, you'd think that the attacks would focus on just a few sites," he added.

Among the other clues that Stewart said he'd found in the code was that the attacker or attackers didn't bother to include any security software evasion components, something that most botnet builders use to try to hide the malware from antivirus scanners. "A state would try to be sneakier than this," Stewart argued.

While Stewart found no evidence of government backing of the DDoS attacks, reports from South Korea have claimed sources within the country's intelligence service implicated North Korea or North Korean sympathizers in South Korea.

Most of the machines in the 50,000-to-60,000-PC botnet used to attack sites in the U.S. and South Korea were physically located in the latter, noted Stewart. But that means little. "If you did want to launch a DDoS, South Korea would be a an obvious choice," he said, adding that the country is one of the most highly-networked in the world.

According to AhnLab, a Korean computer security company, the malware used to build the botnet responsible for the attacks was a modified version of MyDoom, a worm that first surfaced in early 2004.

Continue Reading