July 2009 cyber attacks

The July 2009 cyber attacks were a series of coordinated cyber attacks against major government, news media, and financial websites in South Korea and the United States.[1] The attacks involved the activation of a botnet—a large number of hijacked computers—that maliciously accessed targeted websites with the intention of causing their servers to overload due to the influx of traffic, known as a DDoS attack.[1] Most of the hijacked computers were located in South Korea.[2] The estimated number of the hijacked computers varies widely; around 20,000 according to the South Korean National Intelligence Service, around 50,000 according to Symantec's Security Technology Response group,[3] and more than 166,000 according to a Vietnamese computer security researcher who analyzed the log files of the two servers the attackers controlled.[4]

The timing and targeting of the attacks have led to suggestions that they may be from North Korea, although these suggestions have not been substantiated.[5][6][7]

Timeline of attacks

First wave

The first wave of attacks occurred on July 4, 2009 (Independence Day holiday in the United States), targeting both the United States and South Korea. Among the websites affected were those of the White House and The Pentagon.[1][8] An investigation revealed that 27 websites were targets in the attack based on files stored on compromised systems.[9]

Second wave

The second wave of attacks occurred on July 7, 2009, affecting South Korea. Among the websites targeted were the presidential Blue House, the Ministry of Defense, the Ministry of Public Administration and Security, the National Intelligence Service and the National Assembly.[5][10]

Third wave

A third wave of attacks began on July 9, 2009, targeting several websites in South Korea, including the country's National Intelligence Service as well as one of its largest banks and a major news agency.[1][11] The U.S. State Department said on July 9 that its website also came under attack.[12] State Department spokesman Ian Kelly said: "I'm just going to speak about our website, the state.gov website. There's not a high volume of attacks. But we're still concerned about it. They are continuing."[12] U.S. Department of Homeland Security spokesperson Amy Kudwa said that the department was aware of the attacks and that it had issued a notice to U.S. federal departments and agencies to take steps to mitigate attacks.[9]

Effects

Despite the fact that the attacks have targeted major public and private sector websites, the South Korean Presidential office has suggested that the attacks are targeted towards causing disruption, rather than stealing data.[13] However, Jose Nazario, manager of a U.S. network security firm, claimed that the attack is estimated to have produced only 23 megabits of data per second, not enough to cause major disruptions.[9] Joe Stewart, researcher at SecureWorks' Counter Threat Unit, said that the data generated by the attacking program appeared to be based on a Korean-language browser.[9]

It was expected that the economic costs associated with websites being down would be large, as the disruption had prevented people from carrying out transactions, purchasing items or conducting business.[14]

Perpetrators

It is not known who is behind the attacks. Reports indicate that the type of attacks being used, commonly known as distributed denial-of-service attacks, were unsophisticated.[7][9][15] Given the prolonged nature of the attacks, they are being recognized as a more coordinated and organized series of attacks.[6] According to the South Korean National Intelligence Service, the source of the attacks was tracked down and the government activated an emergency cyber-terror response team who blocked access to five host sites containing the malicious code and 86 websites that downloaded the code, located in 16 countries, including the United States, Guatemala, Japan and the People's Republic of China, but North Korea was not among them.[16] Later, it has been discovered that the malicious code responsible for causing the attack, identified as W32.Dozer, is programmed to destroy data on infected computers and to prevent the computers from being rebooted.[2] South Korean police are analyzing a sample of the thousands of computers used to crash websites, stating that there is "various evidence" of North Korean involvement, but said they may not find the culprit.[17] Security experts said that the attack re-used code from the Mydoom worm.[18] One analyst thinks that the attacks likely came from the United Kingdom.[4]

On October 30, 2009, South Korea's spy agency, the National Intelligence Service, stated the origin of the attacks were from North Korea's telecommunications ministry.[19]

See also

References

  1. 1 2 3 4 "New 'cyber attacks' hit S Korea". BBC News. 2009-07-09. Retrieved 2009-07-09.
  2. 1 2 Claburn, Thomas (2009-07-10). "Cyber Attack Code Starts Killing Infected PCs". InformationWeek. Retrieved 2009-07-10.
  3. ↑ Mills, Elinor (2009-07-10). "Botnet worm in DOS attacks could wipe data out on infected PCs". CNET News. Retrieved 2009-07-12.
  4. 1 2 Williams, Martyn (2009-07-14). "UK, not North Korea, source of DDOS attacks, researcher says". IDG News Service.
  5. 1 2 "Pyongyang blamed as cyber attack hits S Korea". Financial Times. 2009-07-09. Retrieved 2009-07-09.
  6. 1 2 Kim, Hyung-Jin (2009-07-08). "Korean, US Web sites hit by suspected cyber attack". Associated Press. Retrieved 2009-07-09.
  7. 1 2 McDevitt, Caitlin (2009-07-09). "Cyberattack Aftermath". Reuters. Archived from the original on July 12, 2009. Retrieved 2009-07-09.
  8. ↑ "Governments hit by cyber attack". BBC News. 2009-07-08. Retrieved 2009-07-09.
  9. 1 2 3 4 5 Markoff, John (2009-07-09). "Cyberattacks Jam Government and Commercial Web Sites in U.S. and South Korea". The New York Times. Retrieved 2009-07-09.
  10. ↑ "Cyber Attacks Hit Government and Commercial Websites". Foxreno.com. 2009-07-08. Retrieved 2009-07-09.
  11. ↑ "Official: S. Korea web sites under renewed attack". Associated Press. 2009-07-09. Retrieved 2009-07-09.
  12. 1 2 "US State Department under cyberattack for fourth day". AFP. 2009-07-10.
  13. ↑ "S Korea's presidential office says no damage done from hacker attacks". Xinhua. 2009-07-08. Retrieved 2009-07-09.
  14. ↑ Han, Jane (2009-07-09). "Cyber Attack Hits Korea for Third Day". Korea Times. Retrieved 2009-07-09.
  15. ↑ Arnoldy, Ben (2009-07-09). "Cyberattacks against US, S. Korea signal anger – not danger". Christian Science Monitor.
  16. ↑ Jiyeon, Lee (2009-07-11). "Cyberattack rocks South Korea". GlobalPost. Retrieved 2009-07-11.
  17. ↑ Kim, Kwang-Tae (2009-07-12). "S. Korea analyzes computers used in cyberattacks". Associated Press. Archived from the original on July 16, 2009. Retrieved 2009-07-12.
  18. ↑ Zetter, Kim (2009-07-08). "Lazy Hacker and Little Worm Set Off Cyberwar Frenzy". Wired News. Retrieved 2009-07-09.
  19. ↑ "N. Korean ministry behind July cyber attacks: spy chief". Yonhap. October 30, 2009.
This article is issued from Wikipedia - version of the Thursday, January 28, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.