Web Security News

Trojan used in DDoS attacks programmed to self-destruct

Monday, July 13, 2009

Trojan malware that was responsible for a series of cyberattacks on websites in the U.S. and South Korea last week was programmed by the attackers to erase the hard drives of the infected PCs used to launch distributed denial-of-service (DDoS) attacks, a web security researcher said.

Joe Stewart, director of malware research at SecureWorks, said the cyberattackers programmed the malware to download a program that overwrites the data on the hard drive with a message that reads "memory of the independence day," followed by as many "u" characters as it takes to write over the drive, the Washington Post's Security Fix blog reported.

The DDoS attacks, which began on July 4 and hit sensitive sites including the South Korean defense ministry and the U.S. Secret Service, disrupted government and commercial websites in at least three separate waves.

South Korean officials said Friday that the attacks used 86 IP addresses in 16 countries, including South Korea, the U.S. and Japan, but not North Korea, according to the Associated Press.

However, members of the South Korean parliament's intelligence committee told media Wednesday that the country's National Intelligence Service told them it believes North Korea or its sympathizers were responsible.