Did North Korea attack U.S. government websites?

Over the Fourth of July holiday, some 35 government web sites in the U.S. and South Korea were hit with a relatively crude weapon known as a denial of service attack -- one designed to take a website offline rather than to steal confidential information.

Stateside, a variety of sites were knocked out completely, including the web sites for the Treasury Department, the Secret Service, Federal Trade Commission, and the Transportation Department. Homeland Security and the FAA were also impacted, and some remained intermittently unavailable well into this week. Some South Korean sites, which were hit later, remain offline as I write this.

Now suspicion is being leveled at North Korean agents as the perpetrators of the attacks. South Korean investigators even believe the attacks were potentially carried out at the "organization or state" level, implying the attack may have been, for lack of a better phrase, an official act of cyberwar.

American experts aren't so sure, saying that misdirection is commonplace in attacks like this, and that it would be an obvious move for another enemy operator to attack South Korean sites alongside U.S. ones in order to trick investigators into thinking the attack had originated from South Korea's arch-enemy. "In the dozens of instances that I worked over the past decade, I cannot recall a single instance in which someone intending to attack came from the source it appeared to have come from," offered one former intelligence officer in the Washington Post story linked above.

Meanwhile, an official U.S. investigation is continuing into the source of the attacks, but so far nothing has been confirmed.

Whomever the culprit, the attack methodology used was a rather archaic one. Computerworld notes that the attack software used was a variant of the malware application MyDoom, an email worm originally spread in January 2004. (It was the fastest-spreading virus ever in its day.) The latest version now comes loaded with the malicious software needed for the infected PC to attack a target website. At some point, the command is given by the virus's creator to activate and begin the attack. The virus is also reportedly written to allow the attackers to change targets as they see fit.

Scary time to be operating a major government regime, I guess...