Viruses/Worms News

South Korean websites source of malware in July 4 DDoS

Monday, July 27, 2009

The malware used to infect thousands of PCs for a series of distributed denial-of-service (DDoS) cyberattacks beginning the weekend of July 4 originated from two online storage websites based in South Korea, according to a report from state police, the Korea Times reported.

A wave of DDoS cyberattacks from more than 160,000 infected PCs brought down government and banking websites in the U.S., South Korea and China, setting off speculation that North Korea was behind the attacks.

But South Korea's National Police Agency said the malicious software was distributed to PCs through two storage websites based in the South, in Seoul and Busan, which host commercial peer-to-peer file distribution, the Korea Times reported Monday.

"Users of these online storage sites unknowingly downloaded the malicious programs, thinking they were updating the programs for the peer-to-peer transactions," a police source told the newspaper. "We found four foreign servers that we believed were used to issue the attack orders."

The command-and-control servers used to direct the attacks were based in the UK and Germany, according to the report.

In the U.S., the attacks overwhelmed the websites of the Treasury department, the Secret Service, the Federal Trade Commission and the Department of Transportation, along with banking websites including the site of the New York Stock Exchange.