A tough road in cracking cyber attacks
WASHINGTON - U.S. authorities trying to unravel the widespread cyber attacks against government Web sites in the United States and South Korea this week are facing a lengthy, complex investigation that might never identify a culprit, at least not one they would be willing to reveal.
WASHINGTON - U.S. authorities trying to unravel the widespread cyber attacks against government Web sites in the United States and South Korea this week are facing a lengthy, complex investigation that might never identify a culprit, at least not one they would be willing to reveal.
Cyber experts familiar with the probe are divided on the extent of North Korean involvement, split between those who believe hackers may have simply used zombie computers in the region and those who think the communist nation has moved to the digital battlefield.
Involvement by North Korea would signal an advancement by the nuclear-ambitioned nation. If Pyongyang is behind the attacks, "it probably establishes a new pattern of behavior," said Rod Beckstrom, former head of the U.S. cybersecurity center.
Effects of the outage lingered yesterday, as State Department spokesman Ian Kelly said that cyber attacks on the department's computers continued, though not at the high volume seen in the first wave of the assault. A new wave of computer attacks also battered government sites in South Korea but did not knock them offline.
Investigators in both the United States and South Korea face a steep task in trying to trace the attack to its source. The assault involved more than 100,000 zombie computers linked together in a network known as a "botnet." Most of those computers were in South Korea, but others were in the United States, Japan, and China.
Analysts and former government officials said the effort to find the culprit would be a multipronged federal investigation that includes agents lurking in nefarious cyber chat rooms and analysts poring over the computer codes. They say there is just a 10 percent chance they will be successful.
The assault began July 4 and targeted dozens of government and private sites in the United States, including some federal agencies that were shut down for days as the attack continued into Tuesday. Treasury Department and Federal Trade Commission Web sites were knocked out by the blizzard of digital requests, while Pentagon and the White House were able to fend off the attacks with little disruption.
Jack Thomas Tomarchio, head of Nicor Cyber Security and a former deputy undersecretary at the Homeland Security Department, said the attacks overall showed that the federal government was still very vulnerable in terms of its cyber security and that agencies had miles to go to plug the holes. "I'm not trying to alarm the country," he said. "But we do have a serious intrusion problem."
Investigators are following three paths, said Alan Paller of SANS Institute, a computer-security organization in Bethesda, Md.
Copies of the malicious code, he said, have been shipped out to dozens of analysts and cyber-security companies, who are analyzing it, looking for errors or other hints that would point them to the author. Investigators, including many who speak foreign languages, are roaming the Internet chat rooms, hoping to find someone bragging about the attack or providing clues as to its origin. And still others are following the electronic trail, tracing the attack back to the initially infected computers.
Analysts say that the program used in the attacks has elements of a fast-spreading e-mail worm from 2004 called "MyDoom" but that it had enough new elements that some antivirus software didn't recognize it as a threat. The infection spread fast, and experts say the malware appears to contain a destructive Trojan designed to overwrite all data on the victim's hard drive at some point in the future.
