Researchers: Attacks on U.S., Korea sites came from U.K.

The denial-of-service attacks launched on Web sites in South Korea and the United States earlier this month appear to have come from a master server in the United Kingdom, according to security researchers in Vietnam.

The master server controls all of the eight command and control servers involved in the series of distributed denial-of-service attacks that started on the July 4 weekend, security firm Bkis said in a blog posting on its Web site on Monday. Bkis said it gained control of two of the servers.

The Vietnamese firm estimated the number of compromised PCs involved in the attacks to be around 167,000 in 74 countries.

Botnet expert Joe Stewart of SecureWorks told CNET News that that number sounded high. Security experts had been estimating that there were 50,000 infected PCs in the botnet.

The attacks targeted dozens of government and commercial sites in the U.S. and South Korea, causing temporary outages at many of them.

Code on the compromised PCs was set to erase or overwrite data late last week but researchers in the U.S. were not aware of any reports of that happening.

[ThreeMilesNorth]

Politics, isn't it? The US and S. Korea knew the source of the attack from day one...

[cnation]

You right about it nothings new about it

[inachu1]

It's easy to block by ip address.
they just refuse to take the issue at hand and stop it within 8 hours.
It is not hard to do.

[alegr]

The solution is to make sure the ISP's routers validate the "source IP" field in the outgoing packets, and drop those that are issued with bogus IP. Solves the problem of backtracing at once.

[testdirectly]

But it's really good, for all of us, I quite think thats.
Finding out main the servers, it's the most important ...