Korean cyber attacks traced back to UK
By Nicole Kobie
Posted on 15 Jul 2009 at 16:34
A malware attack against South Korean and US government websites earlier this month may have come from a server in the UK, researchers claim.
Previously, experts suspected the attacks may have been based in North Korea, but fresh evidence has come to light.
Yesterday, Nguyen Minh Duc, the security director of Bach Khoa Internetwork Security (Bkis) wrote in a blog post that his firm helped analyse the 4 July weekend denial of service attacks following a request from the Korean Computer Emergency Response Team.
His team found the botnet sending out the malware. It was controlled by eight Command and Control (C&C) servers - two of which Bkis took over. Using those, they found the master server, which was controlling the eight C&C servers - and realised it was based in the UK.
"We found a master server located in UK which controls all of the eight C&C servers to make a series of cyber-attacks last week," he writes, explaining the IP address of the server was from the UK. "So the source of the attacks has been identified to be in UK."
Bkis has forwarded the IP address to US and Korean authorities, who are investigating the attack, and also contacted the British Government.
"Having located the attacking source in UK, we believed that it is completely possible to find out the hacker," he says, noting success in tracking the attackers depends on the US and Korean governments.
The Bkis claim was backed by the Korean Communications Commission, according to Korean media reports, but one official noted the attack may not have come from the UK, but merely been delivered through a hacked IP address.
Bkis also suggests the scale of the attack was larger than first estimated. Symantec said 50,000 zombie computers were involved, while the government of South Korea estimated 20,000.
"But, by taking control of two C&C servers and analysing logs on these servers, we count the exact number of zombies that have been querying C&C servers to receive commands," he says.
"Accordingly, there have been 166,908 zombies from 74 countries around the world that have been used for the attacks."
Is your business a social business? For helpful info and tips visit our hub.
- What's on this week's PC Pro podcast?
- iPhone 6 release date, specs/features and rumours: when is the new iPhone 6 coming out in the UK
- Still on Windows XP? There's now an unofficial service pack
- It's on: Apple announces 9 September event for the iPad, iWatch and iPhone 6... maybe
- 1,500 fake apps kicked off Windows Store
- 20 years of PC Pro: our best covers
- Why we've closed the PC Pro forums
- How to turn off Google Location Tracking
- 20 years of PC Pro: our greatest review mistakes
- 20 years of PC Pro: our first A-List
- Wikipedia's "right to be forgotten" protest hits the wrong note
- 3D printing hits the high street for plastic selfies
- 20 years of PC Pro: What amazed us in our first issue
- How Google Glass ruined my lunch hour
- Smartphone battery packs: can a USB power pack beat the festival battery blues?
- How to sell more ebooks on Amazon
- 10 ways to make your business more secure
- Top five VoIP mistakes
- How to add in-app purchasing to an iPhone, Android or Windows app
- Remote-control ransomware: TeamViewer and software hardball
- Why laptops with serial ports matter to the Internet of Things
- Make your mobile battery last longer
- Small steps into handling Big Data
- Nexus 5: does it really run stock Android?
- How to get broadband to a garden office