A massive distributed denial of service attack by a botnet of infected computers launched over the Fourth of July weekend, taking down many U.S. government civil sites.  Among those put offline were the U.S. Departments of Transportation and Treasury, the U.S. Federal Trade Commission, and the secret service website.

South Korea was the second biggest victim of the attacks, which continued this week.  Based on that the attacks targeted the U.S. and South Korea, security researchers put two and two together and hypothesized that the attacks were masterminded by North Korea, headed by dictator and self-proclaimed "internet expert" Kim Jong-Il.

However, sites in Japan, Canada, Australia, the Philippines, New Zealand, the U.K. and Vietnam were also attacked.  And now a security researcher from claims he has data which contradicts U.S. and South Korean intelligence and points the blame for the attacks on malicious parties in Britain.

According to Nguyen Minh Duc, senior security director at Bach Khoa Internetwork Security (Bkis), the infected computers broadcasted requests every three minutes to one of eight servers.  Bkis claims to have gained control of two of the eight servers and used it to discover the master server, which has an IP in the range 195.90.118.x.  This IP is apparently registered to Global Digital Broadcast in the U.K.

States Mr. Duc, "Having located the attacking source in UK, we believed that it is completely possible to find out the hacker."

His data indicates that the attack affected 166,908 PCs in 74 countries, more than the "several tens of thousands" figure that U.S. intelligence and security firms previously released.  The most infected computers were in South Korea, by his estimates, with U.S., China, Japan, Canada, Australia, the Philippines, New Zealand, the U.K. and Vietnam following.

If Mr. Duc's conclusions hold true, it would be a major victory for his security firm.  Security researchers, though, remain skeptical of his claims.