Cyber attacks may have come from Britain: SKorea

[aruljothi]

A Vietnamese computer security firm believes Britain was the likely origin of last week's cyber attacks that crippled major US and South Korean websites, Seoul officials said.

The Korea Communications Commission said the information came from Vietnamese firm Bach Khoa Internetwork Security. Vietnam is part of a regional grouping known as the Asia Pacific Computer Emergency Response Team.

"The (British) server appears to have controlled compromised handler servers" which spread viruses, said Park Cheol-Soon, a network protection team leader of the government-run communications commission.

"However, it needs more investigation to confirm whether this server was the final attacker server or not," he told AFP.

Seoul's National Intelligence Service earlier said North Korea was a prime suspect in the attacks, which briefly crippled major government and commercial websites in the United States and South Korea.

Park said the apparent discovery of a master server in Britain did not mean North Korea could not be held responsible. "It does not either bolster or undermine claims that someone has done the attacks," he said.

The "distributed denial of service" attacks involved sending multiple requests for website access from tens of thousands of "zombie" computers so the sites became overloaded.

The computers that were used to send the flood of requests had been infected with a virus that allowed attackers to control them anonymously.

The Korea Communications Commission said 166,000 "zombie" computers in 74 countries were believed used.

The intelligence service Monday downgraded its alert against the cyber attacks, saying they were "fizzling out" and most targeted sites had normal traffic restored.

North Korea has staged a nuclear test and numerous missile launches in recent weeks, raising regional tensions. But a cyber attack, if confirmed, would be a new tactic.

Hong Min-Pyo, president of security solution provider Shiftworks, told AFP Wednesday it was technically impossible to trace who initiated the attacks.

Shiftworks has also tracked down a server in New Jersey that was believed to have been spreading the so-called malware, he said.