Report: North Korea May Be Behind DDOS Attacks On U.S., Korean Government Sites

Supporters of North Korea may be behind a series of denial-of-service attacks that have crippled U.S. and South Korean government Websites during the past five days, a news report says.

According to an Associated Press report, an unnamed South Korean lawmaker's aide stated that intelligence agencies believe North Korean sympathizers are behind the distributed denial-of-service attacks, which overwhelmed at least a dozen U.S. government sites and 11 South Korean sites, including the U.S. White House and South Korea's Blue House.

The National Intelligence Service -- South Korea's main spy agency -- told AP it couldn't immediately confirm the report.

Other news reports say the attacks also targeted nongovernment sites, including the New York Stock Exchange, the Nasdaq stock market, and The Washington Post.

Earlier Wednesday, the National Intelligence Service said in a statement that 12,000 computers in South Korea and 8,000 computers overseas had been infected and used for the cyberattack.

The agency said it believed the attack was "thoroughly" prepared and committed by hackers "at the level of a certain organization or state." It said it was cooperating with the American investigative authorities to examine the case.

South Korea's Yonhap news agency said military intelligence officers were looking at the possibility that the attack may have been committed by North Korean hackers and pro-North Korea forces in South Korea. South Korea's Defense Ministry said it could not confirm that report.

Officials at Keynote Systems, which monitors Website traffic, called the series of attacks a "massive outage" and said problems with the U.S. Transportation Department site began Saturday and continued until Monday, while the Federal Trade Commission site was down Sunday and Monday.

The DOT Web site was "100 percent down" for two days, allowing no access at all, the Keynote officials said. The FTC site, meanwhile, began to recover late Sunday, but even on Tuesday Internet users still were unable to get to the site 70 percent of the time.

Some of the South Korean sites remained unstable or inaccessible Wednesday. The site of the presidential Blue House could be accessed, but those for the Defense Ministry, the ruling Grand National Party, and the National Assembly could not.

Despite the reports of suspicions about North Korean sympathizers, most security experts say they still aren't sure where the attacks are coming from. One researcher told reporters that the attack software contained few clues about its origins, although a line of text deep within the malware carried the cryptic message "get/china/dns."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.