Cyberattacks Hit U.S. and South Korean Web Sites

[David Baxter PhD]

Cyberattacks Hit U.S. and South Korean Web Sites
By CHOE SANG-HUN, New York Times
July 8, 2009

SEOUL, South Korea ? Cyberattacks that have crippled the Web sites of several major American and South Korean government agencies since the July 4th holiday weekend appear to have been launched by a hostile group or government, South Korea?s main government spy agency said on Wednesday.

Although the National Intelligence Service did not identify whom they believed responsible, the South Korean news agency Yonhap reported that the spy agency had implicated North Korea or pro-North Korea groups.

A spokesman at the intelligence agency said it could not confirm the Yonhap report, which said that the spy agency briefed lawmakers about their suspicions on Wednesday. The opposition Democratic Party accused the spy agency of spreading unsubstantiated rumors to whip up support for a new anti-terrorism bill that would give it more power.

Access to at least 11 major Web sites in South Korea ? including those of the presidential Blue House, the Defense Ministry, the National Assembly, Shinhan Bank, the mass-circulation daily newspaper Chosun Ilbo and the top Internet portal Naver.com ? have crashed or slowed down to a crawl since Tuesday evening, according to the government?s Korea Information Security Agency.

On Wednesday, some of the sites regained service, but others remained unstable or inaccessible.

In an attack linked with the one in South Korea, 14 major Web sites in the United States ? including those of the White House, the State Department and the New York Stock Exchange ? came under similar attacks, according to anti-cyberterrorism police officers in Seoul.

?This is not a simple attack by an individual hacker, but appears to be thoroughly planned and executed by a specific organization or on a state level,? the National Intelligence Service said in a statement, adding that it is cooperating with the American investigative authorities to investigate the attacks.

The Associated Press reported Tuesday night that a widespread and unusually resilient computer attack that began July 4 knocked out the Web sites of several American government agencies, including some that are responsible for fighting cybercrime.

The Treasury Department, Secret Service, Federal Trade Commission and Transportation Department Web sites were all down at varying points over the holiday weekend and into this week, The A.P. reported, citing officials inside and outside the American government. The fact that the government Web sites were still being affected after three days signaled an unusually lengthy and sophisticated attack, the news agency reported, citing anonymous American officials.

The Washington Post, which also came under attack, reported on its Web site Wednesday that a total of 26 Web sites were targeted. In addition to sites run by government agencies, several commercial Web sites were also attacked, including those operated by Nasdaq, it reported, citing researchers involved in the investigation.

Amy Kudwa, a Department of Homeland Security spokeswoman, said that the agency was aware of the attacks on ?federal and private sector public-facing Web sites.? The department, she said, has issued a notice to federal departments and agencies, as well as other partner organizations, on the activity and advised them of steps to take to help mitigate against such attacks.

?We see attacks on federal networks every day, and measures in place have minimized the impact to federal websites,? she said.

In the attack, an army of thousands of ?zombie computers? infected by the hackers? program were ordered to request access to these Web sites simultaneously, causing an overload that caused the sites? servers to crash, South Korean officials said.

Although most of the North Korean military?s hardware is decrepit, the South Korean authorities have recently voiced their concern over possible cyberattacks from the North. In May, South Korean media reported that North Korea was running a cyberwarfare unit that operates through the Chinese Internet network and tries to hack into American and South Korean military networks.

In South Korea, the Blue House reported no data loss or other damage except disrupted access. The Defense Ministry and banks attacked also reported no immediate loss of security data or financial damage.

?The traffic to our site surged nine times of the normal level,? the Blue House said in a statement. ?Computer users in some regions still suffer slow or no access at all to our site.?

Hwang Cheol-jeung, a senior official at the government?s Korea Communications Commission, said the attacks were launched by computers infected by a well-known ?distributed denial of service,? or DDoS, hackers? program.

The spy agency said 12,000 computers in South Korea and 8,000 overseas appeared to have been mobilized in the attacks. The Korea Communications Commission reported 22,000 infected computers.

?The infected computers are still attacking, and their number is not decreasing,? Mr. Hwang told reporters in a briefing. The government was urging users to upgrade their computers? antivirus software.

Denial of service attacks against Web sites are not uncommon, but they can be made far more serious if hackers infect and use thousands of computers. Hackers frequently take aim at the American government: According to the Homeland Security Department, there were 5,499 known breaches of American government computers in 2008, up from 3,928 the previous year, and just 2,172 in 2006, The A.P. said.

The South Korean news agency Yonhap said the police have traced a possible starting point for the attack back to members of a small cable TV Web site in Seoul. But officials said that does not mean it originated there.

Mr. Hwang said South Korean authorities suspected that the hackers used a new variant of the denial of service program to attack the Web sites.

 

[David Baxter PhD]

DDoS Attacks Likely Work of Unsophisticated Attackers

MyDoom DDoS Attacks Likely Work of Unsophisticated Attackers
By Dennis Fisher
July 9, 2009

The ongoing DDoS attacks that have been targeting a series of U.S. government sites as well as some commercial sites is likely not the work of any government organization and is being executed by an old piece of malware that is designed to ruin files on infected PCs rather than steal data, experts say.

The attacks, which appear to have started late last week, have targeted several government sites, including FTC.gov and others, and involve a five-year-old family of malware known as MyDoom. There has been widespread speculation that the attacks are the work of a foreign government, but experts say that the somewhat amateurish nature of the campaign makes that unlikely. Roel Schouwenberg, a senior antivirus researcher at Kaspersky Lab, said that the attacks are more likely the work of a less-sophisticated attacker.

The MyDoom file that is downloaded to infected machines exhibits some odd behavior, including destroying the master boot record on the machine. The file also doesn't update itself automatically and instead of emailing a copy of itself to other users, it sends out an RAR file, Schouwenberg said.

"It appears that these attacks are coordinated, however there is no proof that any government is involved. The interesting part of the attacks is that it appears that the intention of the file that is being downloaded by the malware is to destroy the machine rather than to harvest sensitive data," he said. "This points to a hooligan rather than a sophisticated cybercriminal group."

The DDoS component of the malware seems to be working just fine, however. The malware contains a list of target sites, which is being updated on the fly. The attacks have brought a number of sites down, or severely crippled their response times over the last several days.

 

[David Baxter PhD]

South Korea blocks IP addresses spreading computer virus
CBC News
Friday, July 10, 2009

Five IP addresses used to distribute computer viruses that caused a wave of website outages in the United States and South Korea were identified and blocked, South Korea said Friday.

South Korean and American officials, who believe North Korea was behind the attacks, said none of the blocked internet protocol addresses ? the web equivalent of a street address or phone number ? were for computers in North Korea.

They were in Austria, Georgia, Germany, South Korea and the U.S., an official from the state-run Korea Communications Commission said. He spoke on condition of anonymity because he is not authorized to speak to the media on the record.

The addresses point to the computers that distributed the virus that triggered so-called denial-of-service attacks in which large numbers of computers try to connect to a single site at the same time, overwhelming the server.

The latest evidence does not clear North Korea of involvement.

The hackers are thought likely to have used the identified IP addresses to disguise themselves ? for instance, by accessing the computers from a remote location ? though blocking the IP addresses helps prevent those computers from being used again to distribute viruses.

South Korean officials have said the attacks could have been carried out by sympathizers who worked outside of North Korea. IP addresses can also be faked or masked, hiding their true location.

Other IP addresses also blocked
The official added that South Korea also blocked another 86 IP addresses in 16 countries that were used to spread different viruses that damaged hard disks or files in computers they contaminated.

Earlier in the day, ruling party lawmaker Chung Chin-sup said he was told by the country's main spy agency, the National Intelligence Service, that the 86 IP addresses were used to cause the web outages. None of them were in North Korea, according to another lawmaker.

But the commission official later corrected that those IP addresses were not used in the denial-of-service attacks. The damage from the new viruses appears to be small, with only 96 cases being reported in South Korea so far, the commission said in a statement.

U.S. sites hit over weekend
South Korean and U.S. websites experienced two waves of cyber-attacks earlier this week. A number of South Korean sites went down or have had access problems beginning late Tuesday.

Some South Korean sites hit in the past few days remained inaccessible or unstable on Thursday, including the National Cyber Security Centre, affiliated with the main spy agency. No major disruptions, however, were reported.

"The damage from the latest attack appears to be limited because those sites took necessary measures to fend off the attack," said Ku Kyo-young of the KCC.

A number of U.S. sites ? including those belonging to the Treasury Department, Secret Service, Federal Trade Commission and the Transportation Department ? were down last weekend.

Keynote Systems Inc., a California-based company that monitors website performance, told CBCNews.ca in an email Thursday that the sites for the U.S. Federal Trade Commission and the Department of Transportation have been hit particularly hard.

FTC.gov, which was shut down completely from Sunday morning to Monday night, is still running slowly, Keynote said. The Department of Transportation, meanwhile, was down from Saturday afternoon until Monday evening.

After the initial U.S. attacks, the White House, Pentagon and the Nasdaq stock exchange were also hit.

North Korea link
Legislative aides who requested anonymity because of the sensitivity of the matter claimed that South Korean intelligence officials believe North Korea or its sympathizers were behind the attack.

There has been little concrete evidence to back that assertion, although South Korean media reported in May that North Korea was running a cyber-warfare unit that tries to hack into U.S. and South Korean military networks to gather confidential information and disrupt service.

Hong Hyun-ik, an analyst at the Sejong Institute think-tank, said the attack could have been done by either North Korea or China, adding that he "heard North Korea has been working hard to hack into" South Korean networks.

On Friday, South Korea's spy agency briefed lawmakers on circumstantial and technical reasons for believing that North Korea could be behind the attacks, Chung said without elaborating.

But it also cautioned it was too early to conclude that North Korea was responsible as the investigations were still underway, according to Park Young-sun, another member of the intelligence committee.

U.S. authorities also eyed North Korea as the origin of the trouble, though they warned it would be difficult to identify the attackers quickly.

Three U.S. officials said this week while some IP addresses have been traced to North Korea, that does not necessarily mean the attack involved Kim Jong Il's government in Pyongyang. They spoke on condition of anonymity because they were not authorized to speak publicly on the matter.