Blog Tổng hợp

<div style="text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgbgpgLAOlLe4A0aQIfhPMj9_d719HWUAuGHoSXnYGme7B-SoZXnRHsVc7XX9_BB5e2FRjG_2A5CEvedUEIvSYUSWKWaTxu3kagrEEMuYo-SQiKSJxoZOLRqGgjaZ8n7CL6v7BIa9iUf8/s1600-h/08korea-600.jpg" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5361147148834313506" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgbgpgLAOlLe4A0aQIfhPMj9_d719HWUAuGHoSXnYGme7B-SoZXnRHsVc7XX9_BB5e2FRjG_2A5CEvedUEIvSYUSWKWaTxu3kagrEEMuYo-SQiKSJxoZOLRqGgjaZ8n7CL6v7BIa9iUf8/s400/08korea-600.jpg" style="cursor: pointer; display: block; height: 304px; margin: 0px auto 10px; text-align: center; width: 553px;" /></a><span style="font-size: 85%;">Employees of the Korea Internet Security Center inside a monitoring room<br />in Seoul on Wednesday.</span> </div>
<div style="text-align: justify;">
<span style="font-size: 100%;">SEOUL, <a href="http://topics.nytimes.com/top/news/international/countriesandterritories/southkorea/index.html?inline=nyt-geo" title="More news and information about South Korea.">South Korea</a> — A wave of cyberattacks aimed at 27 American and South Korean government agencies and commercial Web sites temporarily jammed more than a third of them over the past five days, and several sites in South Korea came under renewed attack on Thursday.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">The latest bout of attacks, which affected service on one government and six commercial Web sites in South Korea, was relatively minor, and all but two of the sites were fully functional within a few hours, an official from the state-run Korea Communications Commission said.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">“An aggressive distribution of vaccine programs against the attack has helped fight back,” the official, Shin Hwa-soo, said. “But we are not keeping our guard down. We are distributing the vaccine programs as widely as possible and monitoring the situations closely because there might be a new attack.”</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">Officials and computer experts in the United States said Wednesday that the attacks, which began over the July 4 weekend, were unsophisticated and on a relatively small scale, and that their origins had not been determined. They said 50,000 to 65,000 computers had been commandeered by hackers and ordered to flood specific Web sites with access requests, causing them to slow or stall. Such robotic networks, or botnets, can involve more than a million computers. </span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">The Web sites of the Treasury Department, Secret Service, Federal Trade Commission and Transportation Department were all affected at some point over the weekend and into this week, The Associated Press reported Tuesday, citing American officials. </span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">A White House spokesman, Nick Shapiro, said in a statement on Wednesday that “all federal Web sites were back up and running” by Tuesday night and that the White House site had also been attacked. </span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">He said, “The preventative measures in place to deal with frequent attempts to disrupt <a href="http://whitehouse.gov/" target="_">whitehouse.gov</a>’s service performed as planned, keeping the site stable and available to the general public, although visitors from regions in Asia may have been affected.” </span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">The Web site of the <a href="http://topics.nytimes.com/top/reference/timestopics/organizations/n/new_york_stock_exchange/index.html?inline=nyt-org" title="More articles about the New York Stock Exchange.">New York Stock Exchange</a> also came under attack, as well as the sites of Nasdaq, <a href="http://topics.nytimes.com/top/news/business/companies/yahoo_inc/index.html?inline=nyt-org" title="More information about Yahoo Inc">Yahoo</a>’s finance section and The Washington Post. </span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">Researchers who are following the attacks said that they began July 4 and focused on the small group of United States government Web sites, but that the list later expanded to include commercial sites in the United States and then commercial and government sites in South Korea. Files stored on computers that are part of the attacking system show that 27 Web sites are now targets.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">In South Korea, at least 11 major sites have slowed or crashed since Tuesday, including those of the presidential Blue House, the Defense Ministry, the National Assembly, Shinhan Bank, the mass-circulation newspaper Chosun Ilbo and the top Internet portal Naver.com, according to the government’s Korea Information Security Agency.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">On Wednesday, some of the South Korean sites regained service, but others remained unstable or inaccessible.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">“This is not a simple attack by an individual hacker, but appears to be thoroughly planned and executed by a specific organization or on a state level,” the South Korean spy agency, the National Intelligence Service, said in a statement, adding that it was cooperating with the American authorities to investigate the attacks.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">The spy agency said the attacks appeared to have been carried out by a hostile group or government, and the news agency Yonhap reported that the agency had implicated North Korea or pro-North Korean groups.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">A spokesman at the intelligence agency said it could not confirm the Yonhap report about North Korea’s possible role. The opposition <a href="http://topics.nytimes.com/top/reference/timestopics/organizations/d/democratic_party/index.html?inline=nyt-org" title="More articles about Democratic Party">Democratic Party</a> accused the spy agency of spreading rumors to whip up support for an antiterrorism bill that would give it more power.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">Although most of the North Korean military’s hardware is decrepit, the South Korean authorities have recently expressed concern over possible cyberattacks from the North. In May, South Korean media reported that North Korea was running a cyberwarfare unit that operated through the Chinese Internet network and tried to hack into American and South Korean military networks. United States computer security researchers who have examined the attacking software and watched network traffic played down the sophistication and extent of the attacks.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">“I would call this a garden-variety attack,” said Jose Nazario, manager of security research at Arbor Networks, a network security firm that is based in Chelmsford, Mass. He said that the attackers were generating about 23 megabits of data a second, not enough to cause major disruptions of the Internet at most of the sites that were being attacked.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">“The code is really pretty elementary in many respects,” he added. “I’m doubting that the author is a computer science graduate student.”</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">As for possible origins, there were only hints. One researcher, Joe Stewart, of Secureworks’ Counter Threat Unit in Atlanta, said the attacking software contained the text string “get/China/DNS,” with DNS referring to China’s Internet routing system. He said that it appeared that the data generated by the attacking program was based on a Korean-language browser.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">Amy Kudwa, a <a href="http://topics.nytimes.com/top/reference/timestopics/organizations/h/homeland_security_department/index.html?inline=nyt-org" title="More articles about the Homeland Security Department.">Department of Homeland Security</a> spokeswoman, said that the agency was aware of the attacks and that it had issued a notice to federal departments and agencies, as well as to other partner organizations, advising them of steps to take to help mitigate attacks.</span></div>
<div style="text-align: justify;">
<span style="font-size: 100%;">Choe Sang-Hun reported from Seoul, and John Markoff from San Francisco. Sharon Otterman contributed reporting from New York.</span><br />
<span style="font-size: 100%;"><span style="font-style: italic;">Source: http://www.nytimes.com/2009/07/09/technology/09cyber.html</span></span></div>

Cyberattacks Jam Government and Commercial Web Sites in U.S. and South Korea!

Employees of the Korea Internet Security Center inside a monitoring room in Seoul on Wednesday. SEOUL, South Korea — A wave of cyberatt...

Đọc thêm/Read more

<div class="Lead">
Một máy tính ở Anh có khả năng là nguồn gây ra các cuộc DDoS tuần trước. Uỷ ban Truyền thông quốc gia Hàn Quốc (KCC) cho biết sẽ dựa vào phân tích của Bkis để xúc tiến các công việc tiếp theo với Anh. </div>
<div class="Normal">
Theo Trung tâm an ninh mạng Bách Khoa (Hà Nội), có 166.908 máy tính từ 74 nước trên thế giới được huy động trong cuộc tấn công nhằm vào website của chính phủ Mỹ, Hàn Quốc và một số quốc gia khác.</div>
<div class="Normal">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7A1RYmykpHa5tQL4WCQnu5UnauV6HKJuMd_WxM9zAVzaBggQhF_DKH8ntUJz29m3cI5VKbTPmURIpO3DjwukgalLkSjPHjUkjsCV7rn9rgz9dKyiN_R3BL2B4nW83uhzLmyYXfZmcltw/s1600-h/B2.jpg" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5358617045382178114" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7A1RYmykpHa5tQL4WCQnu5UnauV6HKJuMd_WxM9zAVzaBggQhF_DKH8ntUJz29m3cI5VKbTPmURIpO3DjwukgalLkSjPHjUkjsCV7rn9rgz9dKyiN_R3BL2B4nW83uhzLmyYXfZmcltw/s400/B2.jpg" style="cursor: pointer; display: block; height: 371px; margin: 0px auto 10px; text-align: center; width: 400px;" /></a></div>
<div style="text-align: center;">
Sơ đồ hệ thống botnet tấn công DDoS vào website chính phủ Hàn Quốc và Mỹ.</div>
<div class="Normal">
Tổ chức cứu hộ khẩn cấp sự cố máy tính của Hàn Quốc (KrCERT) đã đề nghị Bkis trợ giúp phân tích mã độc được dùng trong đợt DDos này và các chuyên gia an ninh mạng của Việt Nam xác định được 8 server điều khiển hệ thống botnet (mạng máy tính ma) cũng như địa chỉ IP của máy chủ gốc (master server) đặt tại Anh. </div>
<div class="Normal">
Ông Nguyễn Minh Đức, Giám đốc Bkis Security, khẳng định đây là lần đầu tiên có một báo cáo tìm ra sự xuất hiện của master server. Phát hiện của Bkis có vài điểm khác biệt với báo cáo của chính phủ Hàn Quốc, trong đó cho rằng mã độc tự động hoạt động mà không cần nhận lệnh từ server điều khiển.</div>
<div class="Normal" style="text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgT308XCsVZq22oDHKbGhZg7kGw36J5uvwkK7fv3fOOr_aAJOhdPpz3GBnmegp9YYvhqBxTZIkIDEBpAj1JPRtnP8jvby20-c5nq_aq63VFUhhgkDEuaCEYLpoGm8J98YQJrzE4W91moZw/s1600-h/B1.jpg" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5358616874604263618" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgT308XCsVZq22oDHKbGhZg7kGw36J5uvwkK7fv3fOOr_aAJOhdPpz3GBnmegp9YYvhqBxTZIkIDEBpAj1JPRtnP8jvby20-c5nq_aq63VFUhhgkDEuaCEYLpoGm8J98YQJrzE4W91moZw/s400/B1.jpg" style="cursor: pointer; display: block; height: 157px; margin: 0px auto 10px; text-align: center; width: 400px;" /></a></div>
<div style="text-align: center;">
Địa chỉ IP của master server phát động tấn công.</div>
<div class="Normal">
Kết quả cũng trái với nghi vấn trước đó rằng Bắc Triều Tiên đứng đằng sau vụ việc. "Chúng tôi không chắc kẻ tấn công có thực sự ở Anh hay không, hoặc có thể một máy tính của Anh đã bị hack để 'tổng chỉ huy' cuộc khai thác", một thành viên của KCC cho biết.</div>
Cuộc tấn công DDoS kéo dài một tuần từ 4/7 khiến nhiều trang web tê liệt, trong đó có website của Bộ Tài chính, Bộ Giao thông vận tải, Ủy ban thương mại liên bang (Mỹ) và trang chủ của tổng thống Hàn Quốc. Bkis cho biết cứ 3 phút một lần, các máy tính bị nhiễm virus ngẫu nhiên chọn một trong 8 server để nhận lệnh điều khiển. Họ đã kiểm soát được 2 trong số 8 máy chủ nhờ tìm ra server gốc. Master server này chạy hệ điều hành Windows Server 2003, có địa chỉ IP trong dải 195.90.118.x, được đăng ký tại nhà cung cấp Global Digital Broadcast của Anh.<br />
Nguồn: Vnepress.net (15/07/2009)

Bkis xác định nguồn tấn công các website Mỹ, Hàn Quốc

Một máy tính ở Anh có khả năng là nguồn gây ra các cuộc DDoS tuần trước. Uỷ ban Truyền thông quốc gia Hàn Quốc (KCC) cho biết sẽ dựa vào ph...

Đọc thêm/Read more