No sign of North Korean backing in bot attacks on US sites, says researcher

Evidence points to hackers who crave attention, says noted botnet expert

There's nothing in the code of the malware used since Saturday to attack a wide array of U.S. and South Korean government and high-profile Web sites that indicates the campaign is backed by the government of North Korea, a noted botnet researcher said today.

"There's nothing in there to suggest that it's state sponsored," said Joe Stewart, the director of director of SecureWorks' counter-threat unit, who has examined the attack code planted on the thousands of hijacked PCs used to conduct distributed denial-of-service (DDoS) attacks. "In fact, it looks like every other bot I see created by an intermediate programmer."

The attacks, which started Saturday when several U.S. government sites -- including those of the Federal Trade Commission (FTC) and the U.S. Department of Transportation (DOT) -- either knocked the sites offline or made it difficult for users to reach them.

DDoS attacks try to flood Web sites with so many requests that the hosting servers and bandwidth are overwhelmed, making them unavailable to legitimate users.

The number of sites targeted each day has increased, said Stewart, another indication that it's unlikely that a government is behind the attacks. "This looks like an attack designed to draw attention to itself, rather than to actually try to take these sites offline," he said, explaining how the attacks have been spread too thin to be effective.

"If it was state-sponsored, you'd think that the attacks would focus on just a few sites," he added.

Among the other clues that Stewart said he'd found in the code was that the attacker or attackers didn't bother to include any security software evasion components, something that most botnet builders use to try to hide the malware from antivirus scanners. "A state would try to be sneakier than this," Stewart argued.

While Stewart found no evidence of government backing of the DDoS attacks, reports from South Korea have claimed sources within the country's intelligence service implicated North Korea or North Korean sympathizers in South Korea.

Most of the machines in the 50,000-to-60,000-PC botnet used to attack sites in the U.S. and South Korea were physically located in the latter, noted Stewart. But that means little. "If you did want to launch a DDoS, South Korea would be a an obvious choice," he said, adding that the country is one of the most highly-networked in the world.

According to AhnLab, a Korean computer security company, the malware used to build the botnet responsible for the attacks was a modified version of MyDoom, a worm that first surfaced in early 2004.

The pattern of the attacks also led Stewart to downplay the likelihood that North Korea, or any national government for that matter, is behind the site attacks. The daily update that's fed to the bots, as the hijacked PCs are called, contains a target list, and that list points, again, to hackers rather than a state.

The first update, delivered July 5, included just five sites, all U.S. government sites, said Stewart, while July 6's update bumped up the number to 21, but still limited the targets to U.S.-based sites. Only on Monday, July 7, were South Korean sites added. The most recent update, pushed to the bots yesterday, included 26 different sites.

"That tells me the attacks were designed to draw attention, nothing more," said Stewart. "It was as if they launched the first [DDoS] attacks, but when those didn't get the attention they wanted, they expanded the list. They kept playing with the attack targets."

The attackers' motive is unclear, acknowledged Stewart, and without that, it may be impossible to determine who is actually behind them. "DDoS attacks for profit are usually extortion attempts, but obviously, they're not going to extort the U.S. or South Korean governments.

"We still see attacks from people who are clearly angry, like attacks against anti-malware sites," he continued. "But to do it against so many sites, they're trying to get attention. Why, we don't know. Maybe it's just someone who says 'I'm mad at capitalism.'"

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securitybotnetscyber attacksnorth korea

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?