Infected computers repeat attacks

Author: 
KWANG-TAE KIM | AP
Publication Date: 
Fri, 2010-07-09 01:48

The computers were programmed to attack every July 7, according to police, so this year's assault appeared to be a continuation of last year's, which began over the July 4 holiday weekend in the US but reached South Korea on July 7.
More than 460 computers infected with malicious computer codes assaulted 25 websites, including those of the White House and South Korea's presidential Blue House, on Wednesday, said Jeong Seok-hwa, a police officer handling investigations of the cyber attacks.
Although last year's attacks were initially blamed on North Korea, experts have more recently said they have no conclusive evidence that it was behind the assaults.
The malicious computer codes, called malware, triggered denial of service attacks, in which large numbers of computers try to connect to a site at the same time in an attempt to overwhelm the server.
“But the attacks were so weak that there were no problems in accessing the sites,” Jeong said.
An analysis of an infected computer in Seoul showed that it was programmed to attack every July 7 and the malware used was identical to that used last year, said Hyun Jae-sub, another police officer. In other words, the computers apparently attacked again this year because last year's malware hadn't been removed, not because another assault was launched.
Hyun said the attacks were traced to computers that participated in last year's attacks and still were infected. He said about 270,000 infected computers were involved in the original assaults.
AhnLab, a top South Korean cyber security company, said it provided free vaccine programs, which can repair infected computers and prevent denial of service attacks, to computer users following last year's attacks as part of efforts to prevent their recurrence. Police had no tally of how many were vaccinated.
Jeong said about 430 infected computers are in South Korea and others are traced to the US, Britain, China and Japan. Hyun said the Internet Protocol addresses — the Web equivalent of a street address or phone number — showed the attacks came from computers in South Korea but authorities have not yet located all the infected computers in the country.
AhnLab official Song Chang-min said owners of infected computers would not suspect they were compromised because the infection would not cause any problems or malfunctions in everyday use.

Taxonomy upgrade extras: