No sign of N. Korean backing in bot attacks on U.S. sites, says researcher

Computerworld - There's nothing in the code of the malware used since Saturday to attack a wide array of U.S. and South Korean government and high-profile Web sites that indicates the campaign is backed by the government of North Korea, a noted botnet researcher said today.

"There's nothing in there to suggest that it's state sponsored," said Joe Stewart, the director of director of SecureWorks' counter-threat unit, who has examined the attack code planted on the thousands of hijacked PCs used to conduct distributed denial-of-service (DDoS) attacks. "In fact, it looks like every other bot I see created by an intermediate programmer."

The attacks, which started Saturday when several U.S. government sites -- including those of the Federal Trade Commission (FTC) and the U.S. Department of Transportation (DOT) -- either knocked the sites offline or made it difficult for users to reach them.

DDoS attacks try to flood Web sites with so many requests that the hosting servers and bandwidth are overwhelmed, making them unavailable to legitimate users.

The number of sites targeted each day has increased, said Stewart, another indication that it's unlikely that a government is behind the attacks. "This looks like an attack designed to draw attention to itself, rather than to actually try to take these sites offline," he said, explaining how the attacks have been spread too thin to be effective.

"If it was state-sponsored, you'd think that the attacks would focus on just a few sites," he added.

Among the other clues that Stewart said he'd found in the code was that the attacker or attackers didn't bother to include any security software evasion components, something that most botnet builders use to try to hide the malware from antivirus scanners. "A state would try to be sneakier than this," Stewart argued.

While Stewart found no evidence of government backing of the DDoS attacks, reports from South Korea have claimed sources within the country's intelligence service implicated North Korea or North Korean sympathizers in South Korea.

Most of the machines in the 50,000-to-60,000-PC botnet used to attack sites in the U.S. and South Korea were physically located in the latter, noted Stewart. But that means little. "If you did want to launch a DDoS, South Korea would be a an obvious choice," he said, adding that the country is one of the most highly-networked in the world.

According to AhnLab, a Korean computer security company, the malware used to build the botnet responsible for the attacks was a modified version of MyDoom, a worm that first surfaced in early 2004.

The pattern of the attacks also led Stewart to downplay the likelihood that North Korea, or any national government for that matter, is behind the site attacks. The daily update that's fed to the bots, as the hijacked PCs are called, contains a target list, and that list points, again, to hackers rather than a state.

The first update, delivered July 5, included just five sites, all U.S. government sites, said Stewart, while July 6's update bumped up the number to 21, but still limited the targets to U.S.-based sites. Only on Monday, July 7, were South Korean sites added. The most recent update, pushed to the bots yesterday, included 26 different sites.

"That tells me the attacks were designed to draw attention, nothing more," said Stewart. "It was as if they launched the first [DDoS] attacks, but when those didn't get the attention they wanted, they expanded the list. They kept playing with the attack targets."

The attackers' motive is unclear, acknowledged Stewart, and without that, it may be impossible to determine who is actually behind them. "DDoS attacks for profit are usually extortion attempts, but obviously, they're not going to extort the U.S. or South Korean governments.

"We still see attacks from people who are clearly angry, like attacks against anti-malware sites," he continued. "But to do it against so many sites, they're trying to get attention. Why, we don't know. Maybe it's just someone who says 'I'm mad at capitalism.'"

Read more about Security in Computerworld's Security Topic Center.