Slashdot Mirror
UK, Not North Korea, Is Source of DDoS Attacks
angry tapir writes "The UK was the likely source of a series of attacks last week that took down popular Web sites in the US and South Korea, according to an analysis performed by a Vietnamese computer security researcher. The results contradict assertions made by some in the US and South Korean governments that North Korea was behind the attack. Security analysts had been skeptical of the claims, which were reportedly made in off-the-record briefings and for which proof was never delivered." The Vietnamese security site's blog is linked from the article, but it is very slow even before Slashdotting. The researchers observed 166,908 zombies participating in the attacks — a number far larger than most earlier estimates.
Update: 07/14 21:24 GMT by KD : Wired is reporting that the UK owner of the IP address in question is pointing a finger at a server in Florida, which it says opened a VPN to the UK machine for the attacks. Once again, the attacker could be anywhere.
Update: 07/14 21:24 GMT by KD : Wired is reporting that the UK owner of the IP address in question is pointing a finger at a server in Florida, which it says opened a VPN to the UK machine for the attacks. Once again, the attacker could be anywhere.
North Koreans are still told that the mighty leader Kim-Jong Il brought down the evil western internet.
"The Y chromosome is genetic. The odds are very good that if you are male then your father was too." -Internet Commenter
The article has no real indication that anything was the source, just that the last hop the analyst was able to track was in the UK...which means?
For the love of Heaven! The war has been over for 226 years! Get over it, already!
Similar to the upcoming US election results
Just because most of the IP's involved were from the UK does not mean that N.Korea wasn't responsible.
I have to wonder how one 'creates' such a geography specific botnet. Do they have UK spam with words like bollocks? Or in the USA is it 'gun porn'? I bet they use 'Tim Hortons' to catch the Canadians. =)
"The price good men pay for indifference to public affairs is to be ruled by evil men." ~Plato (427-347 BC)
If true, this is kind of like the time the US accused North Korea of creating really authentic-looking counterfeit 100 dollar bills, and then it turned out that they are probably coming from within the US - possibly from the CIA to fund covert operations.
I hate to say it, but maybe Kim Jong Il isn't crazy when he claims the Western governments are part of a big conspiracy to falsely ruin his image (hah!)
Even if they attacks were proven to come from the UK... even if they came from North Korea, Nigeria, or Witchita KS..
Does that really tell us about the culprit? It just tells us from where the attacks were launched. This could be because the attacker is from that area, or because the attacker wants to appear to be from that area.
It's a clue. Nothing more.
Even if it was an attack ordered by North Korea, there's no chance the actual payloads originated there. You could likely fit all of NK's network on a Class C without NAT and have room to spare.
Fortunately, we can count on the British government to respond with reasoned caution, and with the utmost respect for citizens' future privacy and freedom.
In April of this year, the NYPD accused hackers in China, and some in the government and media even accused the Chinese government of being involved, in the hacking and disruption of the NYPD computer system. However many posters in the /. comment sections of the posted story theorized that the hacking was not originating from China but rather from a hacking group operating out of New York but fooling the NYPD using 'bot herding'.
I'm not familiar with how to operate and disguise a botnet to look like your hacking from IPs from another country, I would guess that you just infect a group of computer abroad, and run a botnet from there. Here's the original post on /. with comments modified to 4. Just scroll down and you can find posters discussing how the NYPD and U.S. government had misidentified who the hackers probably were.
http://slashdot.org/comments.pl?threshold=4&mode=flat&commentsort=0&op=Change&sid=1209793
Here's the comment that I remembered the most where the user specifically wrote that the hackers were operating most likely within the U.S. and not in China.
http://slashdot.org/comments.pl?sid=1209793&cid=27694281
I guess until governments learn how to trace hackers properly we are going to be seeing more and more of these stories.
And now we want our Empire back...
I just can't believe that they've blown our cover so soon, I thought that dragging America into end-less wars in Iraq and Afghanistan was a brilliant move (did you seriously think that BUSH came up with the idea?) and the latest shift towards economic desolation via cyber attacks was extremely well thought out.
And why can we do this.... Because WE HAVE A FLAG!
Okay back to plan B of being crap at sports we invent but quite polite about losing.
An Eye for an Eye will make the whole world blind - Gandhi
I would think once it was determined that this was not a State sponsored attack, they would stop making such a stink over what country the attacks originated from. Hacking has been going on for 20 + years now, and it has never been a real concern before on the country of origin because State sponsored hacking was such a negligable issue that it was commonly overlooked. I do understand that Russia may have sponsored attacks on Georgia, and maybe China has hacked Taiwan and vice versa, but I mean, short of a concerted Government led effort, I would take this as just another case of Bot Net owner playing with his toys. Not as a sign of intra Governmental hacking as a precursor to some sort of overt warlike effort beginning.
"This is the value of a summer spent and a winter earned"
Just secure your shit against DDoS attacks? Its not like they forgot to apply the "anti-ddos patch". Dealing with an attack from 100k+ hosts isn't something to be taken lightly. Its expensive (get a really fat pipe) and time consuming (identify and block attack traffic).
Slashdot mentality always seems to be that any contradicting reports beat the initial report.
No it doesn't.
(waits for the +5 insightful mod)
Cue UK government announcing multi billion plan to make the internet 'safe' with new content filtering, anti-filesharing and communication logging schemes in 5... 4... 3...
uhh, they already did that.
(well except for the '£billions' part, which they passed-on to the ISPs so it wouldn't appear in the budget defecit)
Well this isn't an argument!
Yes it is...
Memo to "some" in the US and South Korean governments: so please be careful in future of making loose claims about North Korea doing bad stuff, unless you're sure. We don't need any Gulf of Tonkins and mobile bacteriological weapons labs. Wars have been started over less; indeed, two have. North Korea is scary enough; let's not start seeing it behind every tree.
"How to Do Nothing," kids activities, back in print!
North Korea didn't, but we are meant to think they did. These packets are side by side. Koreans always ping single file to hide their numbers. And these SYN attacks, too accurate for North Koreans. Only British hackers are so precise.
No it isn't. Just yank the ethernet cable and problem solved. Couldn't be quicker or less expensive than that!
"But this one goes to 11!"
Evidence is only as good as the people obtaining it.
No, it is only as good as the number of people who will believe it.