No sign of North Korean backing in bot attacks on US sites, says researcher

Evidence points to hackers who crave attention, says noted botnet expert

There's nothing in the code of the malware used since Saturday to attack a wide array of U.S. and South Korean government and high-profile Web sites that indicates the campaign is backed by the government of North Korea, a noted botnet researcher said today.

"There's nothing in there to suggest that it's state sponsored," said Joe Stewart, the director of director of SecureWorks' counter-threat unit, who has examined the attack code planted on the thousands of hijacked PCs used to conduct distributed denial-of-service (DDoS) attacks. "In fact, it looks like every other bot I see created by an intermediate programmer."

The attacks, which started Saturday when several U.S. government sites -- including those of the Federal Trade Commission (FTC) and the U.S. Department of Transportation (DOT) -- either knocked the sites offline or made it difficult for users to reach them.

DDoS attacks try to flood Web sites with so many requests that the hosting servers and bandwidth are overwhelmed, making them unavailable to legitimate users.

The number of sites targeted each day has increased, said Stewart, another indication that it's unlikely that a government is behind the attacks. "This looks like an attack designed to draw attention to itself, rather than to actually try to take these sites offline," he said, explaining how the attacks have been spread too thin to be effective.

"If it was state-sponsored, you'd think that the attacks would focus on just a few sites," he added.

Among the other clues that Stewart said he'd found in the code was that the attacker or attackers didn't bother to include any security software evasion components, something that most botnet builders use to try to hide the malware from antivirus scanners. "A state would try to be sneakier than this," Stewart argued.

While Stewart found no evidence of government backing of the DDoS attacks, reports from South Korea have claimed sources within the country's intelligence service implicated North Korea or North Korean sympathizers in South Korea.

Most of the machines in the 50,000-to-60,000-PC botnet used to attack sites in the U.S. and South Korea were physically located in the latter, noted Stewart. But that means little. "If you did want to launch a DDoS, South Korea would be a an obvious choice," he said, adding that the country is one of the most highly-networked in the world.

According to AhnLab, a Korean computer security company, the malware used to build the botnet responsible for the attacks was a modified version of MyDoom, a worm that first surfaced in early 2004.

The pattern of the attacks also led Stewart to downplay the likelihood that North Korea, or any national government for that matter, is behind the site attacks. The daily update that's fed to the bots, as the hijacked PCs are called, contains a target list, and that list points, again, to hackers rather than a state.

The first update, delivered July 5, included just five sites, all U.S. government sites, said Stewart, while July 6's update bumped up the number to 21, but still limited the targets to U.S.-based sites. Only on Monday, July 7, were South Korean sites added. The most recent update, pushed to the bots yesterday, included 26 different sites.

"That tells me the attacks were designed to draw attention, nothing more," said Stewart. "It was as if they launched the first [DDoS] attacks, but when those didn't get the attention they wanted, they expanded the list. They kept playing with the attack targets."

The attackers' motive is unclear, acknowledged Stewart, and without that, it may be impossible to determine who is actually behind them. "DDoS attacks for profit are usually extortion attempts, but obviously, they're not going to extort the U.S. or South Korean governments.

"We still see attacks from people who are clearly angry, like attacks against anti-malware sites," he continued. "But to do it against so many sites, they're trying to get attention. Why, we don't know. Maybe it's just someone who says 'I'm mad at capitalism.'"

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags botnetscyber attacksnorth korea

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld (US)
Show Comments

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers


This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang


It really doesn’t get more “gaming laptop” than this.

Jack Jeffries


As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr


The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?