New Cyber Attacks May Target Your PC

By Kevin Parrish, published on July 10, 2009 at 8:40 PM
Source: Tom's Guide US | Keywords: , , , , | Themes: The Internet
Syndication: Add to your Google homepage Add to My Yahoo!

The new wave of cyber attacks may actually encrypt your data or reformat your hard drive.

The Korea Communications Commission (KCC), a South Korean government agency, said that the next wave of cyber attacks believed to occur today could strike consumer PCs and wipe out hard drives. The attacks, originally kicking off on July 4th and using the "distributed denial of service" approach, have targeted South Korean and U.S. government and financial institutions throughout the week without causing severe damage or security breaches. However, South Korean web security firm Ahnlab said that the new phase--shifting from attack to destroy--could affect "tens of thousands" of personal computers.

"The affected computers will not be able to boot and their storage files will be disabled," said Lee Byung-cheol of Ahnlab.

Originally North Korea was the prime suspect behind the online assault, and while experts still say that the secluded country could still be the culprit, the source of the cyber attacks now traces back to five separate IP addresses stemming from Germany, Austria, Georgia, South Korea, and the United States. While the actual identity of the party responsible behind the attacks still remains unknown, it's theorized that those IP addresses were used to mask the culprits by accessing infected PCs from remote locations.

Over the course of the week, more details have surfaced on how the three waves of attacks have taken place. The perpetrators used a virus that infected many PCs worldwide, thus creating a nasty botnet. This past weekend, the botnet was activated and began to flood the targeted websites with massive amounts of requests, overloading the servers and knocking many websites offline. Now it's believed that many of those infected PCs will "self-terminate" by wiping out the hard drives sector by sector, or encrypting user data.

Currently the KCC has blocked all five IP addresses that were used to distribute the viruses, cutting off any future attempt to distribute additional viruses or to carry out DDoS attacks. South Korea also blocked an additional 86 IP addresses in 16 countries used to distribute viruses that damaged files or hard disks of infected PCs. By late Friday, South Korea reported 356 cases resulting from the damaging viruses.

South Korea's National Intelligence Service, the country's spy agency, provided lawmakers today with technical and circumstantial reasons why North Korea could be responsible for the assaults, however because probes are still underway, it was too early to place the blame entirely on the North.

Comments | Print | Send to a friend
Slideshows related to this news

Sponsored links

Comments

rdawise 07/11/2009 3:43 AM
Hide
-2+

Well guess I'm the first to post on this one (unless someone hit's submit before me). Before anyone posts that this is another scare tactic by the US to tighten internet security, please read where it says this came from South Korea. This quote interests me:

Quote :Over the course of the week, more details have surfaced on how the three waves of attacks have taken place. The perpetrators used a virus that infected many PCs worldwide, thus creating a nasty botnet. This past weekend, the botnet was activated and began to flood the targeted websites with massive amounts of requests, overloading the servers and knocking many websites offline. Now it's believed that many of those infected PCs will "self-terminate" by wiping out the hard drives sector by sector, or encrypting user data.


Are you referring to Conficker? So that's what it does. I guess if you wake up and your PC's harddrive was wiped, you know they got you. Man, they could at least call the next morning after screwing you like that...

Ramar 07/11/2009 3:46 AM
Show
brendano257 07/11/2009 4:03 AM
Hide
-4+

Some of us have nothing to worry about at all :)

Running AVG Free, Avast, and Spy bot S&D simultaneously. Have not had a single problem with either performance/annoying bothersome side effects or viruses. No funky hardware wipes either :D

Unfortunately these sorts of attacks are only dangerous to the unaware...which happens to be the vast majority when it comes to computers.

lifelesspoet 07/11/2009 5:16 AM
Hide
--2+

I'm not a fanboy nor am I advocating a particular system, but I would very much prefer if you didn't use PC as being the same as windows. Mac os X and linux have viruses and security holes as well and they are as well personal computers. With their growing market share it is increasingly common for a none windows pc's to not run windows.
I know what you meant, but would appreciate it very much.

keither5150 07/11/2009 6:40 AM
Hide
-1+

Terminating the infected PC's would destroy their valuable Botnet.
Not a smart move by whoever is controlling them. .

These infected PC's will not self-terminate. They will continue to operate and will most likely be updated to be more destructive. Thinking that they will self-terminate is naive

Hopefully all Government and essential service companies have secure servers. Add on an IT staff that monitors traffic and knows what IDS means.

Of course this all happened without warning..... wait a minute... does anyone remember Mafia boy? A 15 year kid from Canada that shut down Yahoo, Amazon and Dell to name a few. I believe that this was about 9 years ago.

9 years should be enough warning.

DDOS attacks are hard to defend against. Monitoring and advanced firewalls are a good start.

MDillenbeck 07/11/2009 6:47 AM
Hide
-6+

Ramar :
Any reason noone wants to blame the Iranians even though those of us who are internet savvy already know it's them?Are we still trying to pretend they're our friend?



Evidence?

No, I didn't think so. Just that logic fallacy where you say "those who agree with my unsupported argument are smart/skilled, but those who disagree obviously are imbeciles/ignorant."

P_haze420 07/11/2009 8:31 AM
Hide
-1+

I believe it is our own gov doing this cyber attack. Obama hired a cyber-security couple months ago. Gov want to control the internet because it has no censorship and they want keep the "truth" away from people. Internet is our last freedom, I hope that we'll get those motherfuckers and get our right back.

Ramar 07/11/2009 9:39 AM
Show
jhansonxi 07/11/2009 5:11 PM
Hide
-1+

[nom]lifelesspoet[/nom]I'm not a fanboy nor am I advocating a particular system, but I would very much prefer if you didn't use PC as being the same as windows.[/citation]I agree. Most "computer" viruses are "Windows" viruses.[citation]Mac os X and linux have viruses and security holes as well and they are as well personal computers. With their growing market share it is increasingly common for a none windows pc's to not run windows.I know what you meant, but would appreciate it very much.[/citation]Apple's security has been a little sloppy in the past but even adding their viruses with those of Linux are as very small fraction of the total number of viruses in circulation. A large portion of the Internet uses Linux servers including all of Google, every TiVo box, and a ridiculous number of consumer wireless routers, and I've only seen one virus ever on a Linux system several years ago. That was one that affected only phpBB, the Santy worm IIRC. There are a lot of reports about Linux security holes because they are very paranoid about security (although not as much as OpenBSD). They fret over any potential problem, even those which can only be exploited by a local user sitting at the keyboard.

jhansonxi 07/11/2009 5:14 PM
Hide
-0+

lifelesspoet :
I'm not a fanboy nor am I advocating a particular system, but I would very much prefer if you didn't use PC as being the same as windows.

I agree. Most "computer" viruses are "Windows" viruses.[citation]Mac os X and linux have viruses and security holes as well and they are as well personal computers. With their growing market share it is increasingly common for a none windows pc's to not run windows.I know what you meant, but would appreciate it very much.[/citation]Apple's security has been a little sloppy in the past but even adding their viruses with those of Linux are as very small fraction of the total number of viruses in circulation. A large portion of the Internet uses Linux servers including all of Google, every TiVo box, and a ridiculous number of consumer wireless routers, and I've only seen one virus ever on a Linux system several years ago. That was one that affected only phpBB, the Santy worm IIRC. There are a lot of reports about Linux security holes because they are very paranoid about security (although not as much as OpenBSD). They fret over any potential problem, even those which can only be exploited by a local user sitting at the keyboard.

redgarl 07/11/2009 5:40 PM
Hide
--1+

Well, virus making a computer unable to boot are extremely rare... and seriously I am surprised it even exist... And wiping out Hard drives...? WTF?

Can a virus really do that without you noticing anything? Last time I got a virus attack was when I shredded a trojan... sometime it works... sometime it doesn't... I guess it was the latter one then.

But Anyway, I won the war easily... I formated my Windows partitions. WHo's laughing now? >:P

redgarl 07/11/2009 5:45 PM
Hide
--1+

jhansonxi :
[nom]lifelesspoet[/nom]I'm not a fanboy nor am I advocating a particular system, but I would very much prefer if you didn't use PC as being the same as windows.

I agree. Most "computer" viruses are "Windows" viruses.[citation]Mac os X and linux have viruses and security holes as well and they are as well personal computers. With their growing market share it is increasingly common for a none windows pc's to not run windows.I know what you meant, but would appreciate it very much.[/citation]Apple's security has been a little sloppy in the past but even adding their viruses with those of Linux are as very small fraction of the total number of viruses in circulation. A large portion of the Internet uses Linux servers including all of Google, every TiVo box, and a ridiculous number of consumer wireless routers, and I've only seen one virus ever on a Linux system several years ago. That was one that affected only phpBB, the Santy worm IIRC. There are a lot of reports about Linux security holes because they are very paranoid about security (although not as much as OpenBSD). They fret over any potential problem, even those which can only be exploited by a local user sitting at the keyboard.[/citation]

Iran attaked twitter for...blocking iranians from making a new revolution... DOH! Political knowledge not found in this one...

TEH SOMALIAN PIRATES ARE ATTACKING TEH WEB!!!! HEY MATEY!!!!

rambo117 07/11/2009 6:51 PM
Hide
--1+

brendano257 :
Unfortunately these sorts of attacks are only dangerous to the unaware...which happens to be the vast majority when it comes to computers.


where do i getz meh free pr0nzz?

rdawise 07/11/2009 8:16 PM
Hide
-0+

p_haze420 :
I believe it is our own gov doing this cyber attack. Obama hired a cyber-security couple months ago. Gov want to control the internet because it has no censorship and they want keep the "truth" away from people. Internet is our last freedom, I hope that we'll get those motherfuckers and get our right back.



So if your theory was correct, why would Obama target S. Korean PCs? If he wanted to tighten US censorship wouldn't it be more prudent to only affect US computers? Gotta love the Obama fear tactics folks though...

MDillenbeck 07/11/2009 10:18 PM
Hide
-1+

Ramar :
iran.whyweprotest.netThey've already been proven to be attacking Twitter, a legitimate business that I believe we can trust when they say "Yes, Iran is behind it."

There's plenty of logic behind it being Iran, and plenty of IP logs on my server's TOR to prove it. Why don't you help us fight rather than assume that because 4chan has something to do with it, it MUST be a hoax?



I'll agree they would have a reason to attack Twitter. However, lets look at the current targets - US and South Korean governmental (military) systems. By use of Occam's Razor, I find it hard to believe that Iran would choose these types of targets over social networking sites and news/information sites. In fact, if they wanted to cut the flow of information, I would think they would look for ways to slow/stop internet and sms traffic from their country to the outside world (or from outside world to their country).

Note that this does not mean I do not believe that Iran did or would use DoS attacks to mete out its own end - however, do not enter another fallacy where I am given a false dichotomy to choose from (either I agree with you or I do not believe Iran has/will use DoS attacks against informational sites).

MDillenbeck 07/11/2009 10:24 PM
Hide
-1+

rdawise :
So if your theory was correct, why would Obama target S. Korean PCs? If he wanted to tighten US censorship wouldn't it be more prudent to only affect US computers? Gotta love the Obama fear tactics folks though...



Actually, there quite a lot of believers in False Flag operations. Thin 9/11 and the London bombings. (Note: I am not saying I agree with these hypotheses, only that there are many who do.)

So why target a larger spectrum? The False Flag believers would say to lend credence to the argument and to make this an international issue - so that all nations of the world would embrace tighter restrictions on internet use. (Again, I am not saying I believe this scenario is what is happening...)

Honestly, the only reason the original poster mentioned Obama is because he hired some "tech savvy" people into the government - and they probably believe that most government operatives are not there to help the security of the USA while preserving the ideals of life, liberty, and the pursuit of happiness for all. In other words, they can't waste such talent shoring up security - they must be working to use exploits to conduct a complex hoax.

ravenware 07/12/2009 10:58 AM
Hide
-0+

rdawise :
So if your theory was correct, why would Obama target S. Korean PCs? If he wanted to tighten US censorship wouldn't it be more prudent to only affect US computers? Gotta love the Obama fear tactics folks though...


Right, and what makes more since is to raise critical alarm through the media about attacks that have most likely been going on for decades. It makes even more sense to publicly broadcast to the world that your infrastructure is under attack and is vulnerable; essentially ringing a dinner bell or putting a drop of blood into shark infested waters.

Anonymous 07/12/2009 3:21 PM
Hide
-0+

If these companies who are under attack would either hire proper security specialists -- people who can prevent this from happening -- or pay the ones they have an appropriate wage, I am pretty sure this would be prevented no matter who is doing the attacking.

acecombat 07/13/2009 1:22 AM
Hide
-0+

keither5150 :
DDOS attacks are hard to defend against. Monitoring and advanced firewalls are a good start.


Too bad a firewall is useless to defend against DDOS attacks on an site that serves internet content as the firewall can block the connection to the server, but the connection up to the firewall is still flooded and causes downtime regardless.

rdawise 07/13/2009 5:13 AM
Hide
-0+

MDillenbeck :
Honestly, the only reason the original poster mentioned Obama is because he hired some "tech savvy" people into the government - and they probably believe that most government operatives are not there to help the security of the USA while preserving the ideals of life, liberty, and the pursuit of happiness for all. In other words, they can't waste such talent shoring up security - they must be working to use exploits to conduct a complex hoax.



I completely agree.

ravenware :
Right, and what makes more since is to raise critical alarm through the media about attacks that have most likely been going on for decades. It makes even more sense to publicly broadcast to the world that your infrastructure is under attack and is vulnerable; essentially ringing a dinner bell or putting a drop of blood into shark infested waters.



Didn't this article come from South Korea? So wouldn't they be the ones raising the "critical alarm"?

ravenware 07/13/2009 9:00 AM
Hide
-0+

rdawise :
I completely agree.Didn't this article come from South Korea? So wouldn't they be the ones raising the "critical alarm"?


"The attacks, originally kicking off on July 4th and using the "distributed denial of service" approach, have targeted South Korean and --> U.S. government

xrodney 07/13/2009 10:26 AM
Hide
-0+

acecombat :
Too bad a firewall is useless to defend against DDOS attacks on an site that serves internet content as the firewall can block the connection to the server, but the connection up to the firewall is still flooded and causes downtime regardless.


Well good network components and firewall can help reduce efect of DDOS to some extent. It could block DDOS from comming inside of your network, allowing to you working localy at least or it could reduce load on your network as with discarding DDOS packets instead of processing them could reduce load on your network hardware/software allowing some normal packets to pass thru.
Its allways matter of two things, how much bandwith your network have and how many packets it can process. If either of those is on their limits, your network will be afected.

bounty 07/13/2009 4:23 PM
Hide
-0+

"Currently the KCC has blocked all five IP addresses that were used to distribute the viruses, cutting off any future attempt to distribute additional viruses or to carry out DDoS attacks."

hahaahahahahahah really. because blocking 1 ip address in Germany, Austria, Georgia, South Korea and the US will stop any and all possible attempts to distribute the virus and to carry out DDOS.

Because releasing and renewing your ip address is probably way above these guys skill level?

pocketdrummer 07/13/2009 5:05 PM
Hide
-0+

lifelesspoet :
I'm not a fanboy nor am I advocating a particular system, but I would very much prefer if you didn't use PC as being the same as windows. Mac os X and linux have viruses and security holes as well and they are as well personal computers. With their growing market share it is increasingly common for a none windows pc's to not run windows.I know what you meant, but would appreciate it very much.




I'm going to laugh my tail off when someone finally gets fed up with all the "Macs/Linux are impenetrable" talk and releases an uber-virus in the wild targeted for those systems. There are security holes in OSX that Apple just doesn't patch... probably because they don't expect an attack.

pocketdrummer 07/13/2009 5:07 PM
Hide
-1+

Computer based attacks are so cowardly. It's only because they know the muscle of the countries they attack would squash them in probably a week.

fulle 07/13/2009 5:22 PM
Hide
-0+

Ramar :
Why don't you help us fight rather than assume that because 4chan has something to do with it, it MUST be a hoax?



Because if 4chan has something to do with it, it MUST be a hoax.

grieve 07/13/2009 5:35 PM
Hide
-1+

It's called Ghost and/or PQDI.

Format your machine... make a perfect install. Image the HDD with GHOST.

Now you never care if you get a virus because your machine is 30mins-3hrs away from a fresh, clean install.... by clicking five "next" buttons.

I am so far past the days where i cared about Virus' on my home machines.

DXRick 07/13/2009 9:20 PM
Hide
-0+

Do we get to know how these viruses and bots are being deployed onto the hapless computers??? They make it sound like the hackers are doing this with no interaction from the targeted users.

Are there still vulnerabilities in flash, shockwave, or any other scripting language? Are people downloading infected apps and running them on their computers? Or, are the hackers breaking into the machines to install their malware?

__-_-_-__ 07/14/2009 1:30 AM
Hide
-0+

come and get me.

rdawise 07/14/2009 3:57 AM
Hide
-0+

ravenware :
"The attacks, originally kicking off on July 4th and using the "distributed denial of service" approach, have targeted South Korean and --> U.S. government



Did you completely skip this line?
Quote :The Korea Communications Commission (KCC), a South Korean government agency, said that the next wave of cyber attacks believed to occur today could strike consumer PCs and wipe out hard drives.



It was just above the line you quoted. This came from South Korea, but oh well. Keep your tin foil hats....

Sponsored links