Authorities close in on South Korea hackers

Security experts have reportedly uncovered the command server for the botnet believed to be responsible for recent attacks on US and South Korea government web sites.

Researchers from Vietnamese firm Bkis Security said on Monday that they had been working with the Korean Computer Emergency Response Team in an effort to track down the source of the attacks.

The company said that it now believes that the command server controlling the attacks is hosted in the UK.

Bkis Security said that the botnet controls nearly 177,000 infected PCs programmed to randomly dial one of eight attack servers which then relay targets. The servers each receive their instructions from a central attack server located in the UK.

While the news does not necessarily mean that the individuals behind the attacks are physically located in the UK, researchers say that finding the attack server will make it easier to uncover the criminals behind the attacks. The company also claims to have gained control of two of the servers.

"Having located the attacking source in the UK, we believe that it is completely possible to find the hacker," the company said in a report. "This, of course, depends on the US and South Korean governments."

The news could put investigators closer to shutting down the denial-of-service attacks, which have preyed primarily on sites run by the US and South Korean governments.

While the motive for the attacks is not known, the hackers behind the operation are believed to be supporters of North Korea.

Perhaps of more concern, however, is the apparent ease with which the attacks were launched.

Amichai Shulman, chief technology officer at data security firm Imperva, noted that the attacks show how cyber warfare can be executed on a much smaller budget than many would like to believe.

"This attack is relatively inexpensive to execute, no more than $50,000 [£30,000], making it doable not just by any government, but by any Tony Soprano, " he said.