The worm turns, commerce churns

Some worms still snaked about Internet servers yesterday, but tranquility was mostly restored in the Korean computer world on the first working day after the nationwide crash of servers Saturday. Except for few minor glitches, the concerns were not realized that the "Slammer" virus that paralyzed Internet services in Korea, the most wired country in the world, for nine hours Saturday might cause financial mayhem. At 9:50 a.m., computer systems at the Korea Securities Computer Corp. were attacked by the virus, barring 13 securities from trading their shares online for five minutes and failing to update stock prices. The company immediately replaced the attacked lines with others. Other than that, stock markets and Internet banking services operated normally, according to the Information Ministry, financial institutions and Internet service providers. Some Internet users complained about sluggish access, but Kim Chang-gon, director of the Informatization Planning Office at the Ministry of Information and Communication, said the situation was under control. Staff at the government emergency team check the flow of each Internet service provider every 30 minutes, and other than KT Corp., Korea's largest provider, with 54 percent of the traffic, no companies reported abnormalities, Mr. Kim said. "From 1 p.m. to 2 p.m., we detected about 60,000 packets of calls per second at the domain servers at Hyehwa station, about double the average traffic at that hour of a day," Mr. Kim said. "We suspect worm viruses are included in the increased traffic." Hyehwa station, an international port where the Internet shutdown was first detected, added 10 servers to back up the 12 it normally operates. At 3 p.m., the daily peak hour of Internet flow, the data increase was well below the increased capacity. "The worst seems over," Mr. Kim said. Some experts argued that software piracy may have contributed to making Korea the biggest victim of the latest virus. "We have sold about 50,000 copies of the Microsoft SQL server software," said Seo In-seok, of Microsoft Korea. "We estimate that four to five times that number of illegal copies are circulating." The software costs 1.6 million won ($1,300). Mr. Seo encouraged illegal users of the software, mostly thought to be small-business operators, to download the curing patch from the Microsoft Web site. The service has been available for some time, but illegal users are reluctant to have any contact with Microsoft, Mr. Seo said. Internet shopping malls, online game companies and Internet cafe chains said they are preparing legal actions against Internet service providers for damages. The anti-cyber terror center at the National Police Agency said that it is investigating the alleged relation of a hacker group in China to the incident. by Kim Hyo-jin