Forgot your password?
typodupeerror

How Microsoft Fights Off 100,000 Attacks A Month 169

Posted by Zonk
from the more-power-to-em dept.
El Lobo writes to mention a ComputerWorld article about Microsoft's battles with the Hackers of the world. The software giant fights off more than 100,000 attacks every month, protecting their data-heavy internal network from the paws of your average script kiddie. The article discusses Microsoft's 'defense in depth' strategy, and discusses just some of the layers in that barrier. From the article: "The first layer of protection for the Microsoft VPN is two-factor authentication. After an infamous incident in the fall of 2000, Microsoft installed a certificate-based Public Key Infrastructure and rolled out smart cards to all employees and contractors with remote access to the network and individuals with elevated access accounts such as domain administrators. Two-factor authentication requires that you have something physical, in this case the smart card, and also know something, in this case a password."
This discussion has been archived. No new comments can be posted.

How Microsoft Fights Off 100,000 Attacks A Month

Comments Filter:
  • by bhunachchicken (834243) on Friday December 08, 2006 @01:07PM (#17163768) Homepage

    So, who's doing the other 99,999 then...? :)

  • Thanks! (Score:5, Funny)

    by moore.dustin (942289) on Friday December 08, 2006 @01:09PM (#17163788) Homepage
    Thanks for passing all those protection and security measures you develop to your customers! Wait a tic...
    • by suso (153703) * on Friday December 08, 2006 @01:32PM (#17164104) Homepage Journal
      Tommorow we're going to hear from the ping department at Yahoo.

      I always wondered what they do with all those echo requests.
      • by binarybum (468664) on Friday December 08, 2006 @01:58PM (#17164440) Homepage
        huh, I almost always use ping www.yahoo.com when I'm testing a DNS.
            does everyone default to this for some reason that I'm not aware of? Is that what you're referring to?
        • Re: (Score:3, Insightful)

          by MrP-(at work) (839979)
          I think its very common.

          I know everyone here always does ping yahoo.com to test DNS/network connections.

          We also ping google.com somtimes too

          I feel bad for them
        • If I'm testing a DNS server, I try pinging it before doing anything else, and then graduate to using "dig" to see whether the DNS server can look up other hostnames...
      • by Da_Weasel (458921) on Friday December 08, 2006 @02:00PM (#17164470) Homepage
        They are building up a stock pile of pings. It's all part of a diabolical plan to rule the universe through their pingopoly. Soon we shall all bow before their pingy-ness-ish-ness. Those who obey their pingy commands will recieve their daily ration of echo packets, everyone else will be left wanting... MMWhhaAHahHAhahahAHahahHAh!!!!
      • by moore.dustin (942289) on Friday December 08, 2006 @02:35PM (#17164998) Homepage
        This is hilarious! I always ping yahoo.com when DNS testing too! I choose it because they have a reliable service and consistent response times.... and I never Yahoo! and I would not want to do this to a service/site I like/use :)
      • Guilty here as well... because Yahoo! seems to always be up and ping'able. I guess if they were really annoyed, they'd firewall off ping responses.

  • by OverlordQ (264228) on Friday December 08, 2006 @01:09PM (#17163794) Journal
    Keeping your vital data physically disconnected from the outside Internet. I know it'll cut off people who work remotely, but if it's that important, it's worth it.
    • by bugnuts (94678) on Friday December 08, 2006 @01:27PM (#17164030) Journal
      MS is big, and vital data are distributed in not-so-vital chunks throughout the organization and in different ways.

      Combined, it's all vital. But imho, saying "just cut the plug on the network" is not feasible and horribly short-sighted. MS has several web applications, update servers, search engines... what are you saying again? You propose they cut all that off, too? The damage is just as bad (if not worse) if their update servers get hacked instead of their personnel database.

      Network security covers a little more than just "vital data".
      • Re: (Score:3, Interesting)

        by Oddscurity (1035974) *
        I've wondered about this update server before... does WinXP actually validate the stuff it downloads before installing it? Even if the update server is hard to compromise, some malware writer could have their malware auto-update by editing the hosts file.
        • Re: (Score:3, Interesting)

          by jacksonj04 (800021)
          I don't believe so, as anyone can run a WUS server which keeps a local copy of updates for other machines on the domain to install. I've not read anything on the auth mechanisms used, but that doesn't mean there isn't something out there.
    • Re: (Score:2, Informative)

      by Anonymous Coward
      "Keeping your vital data physically disconnected from the outside Internet."

      Beyond that, Microsoft needs to control what executable code its employees can grab off the Internet. Apparently, even non-IT workers there can download and install almost anything. I know a contractor in technical support that just translates the phone conversations and really isn't a technical person at all. He just speaks multiple languages. And from what he tells me, he has no restrictions on his computer from installing softw
    • by danpsmith (922127)

      Keeping your vital data physically disconnected from the outside Internet. I know it'll cut off people who work remotely, but if it's that important, it's worth it.

      Not only that, but if you think about it, providing remote access allows another point of entry for attack. All employees that use the remote access, even if trustworthy, can't be trusted to follow all security precautions when they aren't even at the office to begin with. If you are allowed full control over files remotely, you are basically

    • Re: (Score:2, Interesting)

      by diersing (679767)
      Thats great, as long as the people that use the vital data (executives, accounting, legal, sales, tech support, etc) don't need to get to the internet. Or do you have a kiosk set up that everyone queues up at?

      I've worked for two large (150,000+) Fortune 100 companies. One was a bank and the other... the other employeed scientest and lets just say their IP, is the lifeblood of the business. And in my experience, no one is interested is disconnecting the data, it just isn't feasible (simple, yes). With tw

  • by LatexBendyMan (989778) on Friday December 08, 2006 @01:10PM (#17163802)
    They probably just run linux...
    • Re: (Score:3, Interesting)

      Actually, they do...to a point:

      http://news.netcraft.com/archives/2003/08/17/wwwmi crosoftcom_runs_linux_up_to_a_point_.html [netcraft.com]
      (old article and I wasn't able to duplicate their test so it may have changed)
      • by Jerry (6400) on Friday December 08, 2006 @04:32PM (#17166472)
        A few days ago I used Netcraft to take a look at what Microsoft was using for its severs.
        There were 355 servers listed. A few are "unknow", a few more are "Solaris" and some I don't recognize, but at least 1/3rd of them are Linux.
        • Re: (Score:2, Interesting)

          by Anonymous Coward
          I believe this is because Akamai does load balancing for them. I was at one of their 'gatherings' and the search guys claimed they ran the whole system on windows boxes which was apparently quite the challenge as windows boxes have not been traditionally used in that manner.
    • Re: (Score:3, Funny)

      by Savage-Rabbit (308260)
      They probably just run linux...

      Gee.. that's a surprise! I always thought Microsoft fended off attackers by throwing chairs at them...

      There... now your cliché isn't lonely any more...
      • Re: (Score:2, Funny)

        They throw Beowulf clusters of naked and petrified statues of Natalie Portman as hot grits run down their pants expect in Russia where they throw you when you're not welcoming your new overlords or when old people aren't using the Internet in Korea.
        • by Savage-Rabbit (308260) on Friday December 08, 2006 @03:16PM (#17165578)
          They throw Beowulf clusters of naked and petrified statues of Natalie Portman as hot grits run down their pants expect in Russia where they throw you when you're not welcoming your new overlords or when old people aren't using the Internet in Korea.


          Dude.... I wanted a quiet gathering of a few friendly clichés not a whole cliché convention!
        • When is slashdot going to start making t-shirts with all these great memes on it??? I know I'd buy one :)

          I mean come on... In soviet russia, T-shirt wears you! or I, for one, welcome our /. t-shirt wearing overlords.

          instant classics!!!
          • Re: (Score:2, Funny)

            by markmier (306777)
            I *AM* an overlord, you insensitive clod!
          • Re: (Score:3, Insightful)

            by Firehed (942385)
            Now someone mod this post up to +5, Insightful and put the whole thing on a shirt, with the caption of "The Slashdot Moderation System at Work".
        • by geekoid (135745)
          You set us up the bomb!
  • by stag_beetle (1036182) on Friday December 08, 2006 @01:10PM (#17163808)
    I thought the first thing you were supposed to do to protect against attacks was to ensure you aren't using Microsoft products in any part of your infrastructure...
    • Re: (Score:3, Interesting)

      by mdm-adph (1030332)
      reminds me of the story from a long while back about a site touting the greatness of Windows Server Software (might have actually have been a Microsoft site) -- well, somebody gets an error message one day, and it turns out the site was running Apache on Unix.
      • Re: (Score:3, Interesting)

        by slashwritr (1009921)
        I thought that those sites were actually Apple "enthusiast" sites, and they were running on Linux? This site [imagicweb.com] confirms it; the article was in 2004, though, and those sites might be on Apple servers now.
      • You are about as good at telling jokes as a clown fish.
  • The software giant fights off more than 100,000 attacks every month, protecting their data-heavy internal network from the paws of your average script kiddie.

    A network powered by Fedora Core 6...
  • I'm surprised... (Score:4, Insightful)

    by pdbaby (609052) on Friday December 08, 2006 @01:17PM (#17163900)
    The article seems to say they only use Microsoft solutions to provide their security.
    I'm surprised they don't even have a little something from RSA. Is their solution that good (jokes aside!), or are they just suffering from major Not Invented Here syndrome?
    • by db32 (862117) on Friday December 08, 2006 @01:45PM (#17164270) Journal
      Do you honestly believe they would admit to using anything other than MS? Do you remember the noise that was made about their website being protected by a company using linux servers to protect it from denial of service stuff? Do you remember the noise that was made when that linux based company signed up with their silly streaming media shit and was able to stream windows media more efficiently from linux boxes than what equivilent Windows boxes could do? (The worst part about this was that it could only stream windows media content to windows computers, and linux clients could't do anything with the streaming media from the linux server).

      Give MS some credit...their Marketing/PR departments aren't stupid enough to talk about everyone else products used to secure their network, but I have a hard time believing that their technical folks are stupid enough to restrict themselves to MS products. I mean I have heard people explain to me how MS Proxy is the best proxy ever, or how that other stupid MS firewall/proxy/server thing is the best for boundary protection...but I assume those people will never work in security at a decent sized company for long if at all. MS products have their uses as much as I dislike many of them...but if I ever had anyone working for me try to use an MS product for something like boundary protection I would slap them, repeatedly, in front of the whole IT department.
      • Seriously. They might have a number of Microsoft products involved in running their VPN, but I'll bet it's mixed in with offerings from Cisco or Juniper. They could still claim it was an "all MS solution" since a Cisco ASA, for instance, is a "hardware appliance" and doesn't involve the use of software at all! (Damn, I can't say that with a straight face...)

      • Re:I'm surprised... (Score:5, Informative)

        by bmajik (96670) <matt@mattevans.org> on Friday December 08, 2006 @02:39PM (#17165056) Homepage Journal
        funny you mention that - all outbound internet traffic from Microsoft's internal network goes through...

        wait for it..

        Microsoft ISA Server.

        There may be other stuff out in front of that, but I have no evidence that there is.

        I happen to dislike ISA server - because all of my traffic to the outside world goes through it, and if i notice it, its because it did something i didn't like (like forgot how to resolve hostnames - that's pretty common). I used to complain about it every day.. i'd say stuff like "ISA server makes me want to quit my job" or "maybe i could buy a 28.8 modem and get reliable fast internet access while at work). But, ISA server has gotten a lot better and the # of times a week I curse my existance has gone way down. I'll complain to co-workers that "there is no excuse for this - i've run Squid before and there are never any problems", but to be honest, i've never run a squid cluster with over 100 nodes serving over 100,000 PCs, so its not precisely apples to apples. And i've never put pre-production Squid code into a production environment -- which is exactly what we do with everything we make. My inbox has been on beta exchange for months, and over half the domain controllers here in Fargo are running Longhorn server builds.

        Same thing with wireless. We deployed WPA before most of the outside world had heard of it. Internally, it was the only way to get wireless at all. If your device didn't do WPA, you didn't get to connect.

        There are a few well-known "MS uses linux!!!!@#$!@#$ OMGZORZ!!!" stories out there, so i'll address the ones i am familiar with

        MS uses Linux to host MS.Com

        False. Microsoft.Com runs on windows servers. Microsoft has contracted with akamai to do geocaching of various web properties, and akamai uses linux to a large extent. This is why when you look at some MS.Com "machines" with tools like nmap, they'll come back as Linux boxes. they aren't MS machines, they aren't in any MS datacenter, and they aren't MS managed.

        Hotmail is all linux

        False. Hotmail was never linux. Hotmail has a distributed architecture, and at the time of acquisition, the front end machines were FreeBSD, and the back ends were Ultra enterprise 4500s. Eventually, the FE's were moved to Windows Server. My understanding is that they tried the transision using NT4 and it was miserable, and tried again with W2k and it was much much better. Eventually, all the Fe's got moved onto one of the server products (i dont remember if it was w2k or w2k3 before it was "done") and the hotmail capacity went UP.. i.e. re-writing the hotmail stuff natively for the new windows based platform has allowed hotmail to run more efficiently on less hardware, with lower management costs. The backend machines were still enormous sun boxes last time i asked about it a few years ago.. for a few reaons. 1) the investment in those was huge 2) the filesystem was completely customized for the application. I wouldn't be surprised if the back ends have also moved off of Sun machines. The back end boxes apparently did almost nothing with CPUs.. but lots and lots of disk IO. The custom filesystem is probably the biggest reason that moving back ends didn't happen earlier.

        It's important to Microsoft to run our own stuff everywhere we can, because it demonstrates to customers that the product can meet their capacity needs, and because real world use is the best test of big complex systems. There are a few things we are NOT self hosting on yet - for instance, I am in the Business Division and while we sell a variety of ERP programs (from companies we've acquired), we still use 3rd party ERP systems to run "Microsoft, the Company". Those of you with ERP experience will understnad that this is not something you transition "over nite" or "just because". It is a goal for us in the Business Division to move MS onto our ERP stuff internally - it adds additional credibility to our products when we can tell customers "it can run Microsoft, so it can probably run your stuff". And our competitors _love_ saying things like "why buy MS's version of blah, they dont even use it themselves!"

        • by db32 (862117)
          Well the hosting MS.com thing is what I was refering to, however, I deliberately avoided saying that exactly because I know that to not be the case. It is exactly as you described, the akamai thing, I just couldn't remember any of the names involved. I made no "MS uses linux!!!!@#$!@#$ OMGZORZ!!!" claim. I just mentioned the MS/linux related stories and how MS did quite a song and dance avoiding saying anything clearly about either situation.

          Beyond that I don't know how WPA has anything to do with this
          • by bmajik (96670)
            Oh - i didn't mean to put words in your mouth and accuse _you_ of the OMGZORZ stuff. I was just addressing commonly heard points of view that are related to the topic at hand.

            WPA was somewhat of a departure at the time from WEP, because it had some aspect of certificates and key management. Our WPA stuff is linked to our domain credentials and gets pushed down via group policy / certificate enrollment. _that_ certainly wasn't very common in 2001 or so.

            As far as ISA server goes - I can't say for sure or n
            • by db32 (862117)
              ISA server really has no benefit beyond it is cheaper than the dedicated devices. A BlueCoat is WAY more impressive caching/proxy/filtering proxy and has far more capabilities (BlueCoat is not software you install on a Win/Lin/Etc server, it is a device). I'm not sure what exactly you mean by HTTPS stream inspection since the whole point is that it is encrypted and can't be looked into. ANY application level proxy should be inspecting all HTTPS/HTTP/SMTP/FTP/etc protocol stuff for well formed commands (I
              • by EvilSS (557649)
                I think he is refering to SSL to SSL bridging in ISA 2004:

                [From MS Site]For Web servers that require authenticated and encrypted client access, ISA Server 2004 provides end-to-end security and application-layer filtering using SSL-to-SSL bridging. Unlike most firewalls, ISA Server 2004 inspects encrypted data before it reaches the Web server. The firewall decrypts the SSL stream, performs stateful inspection, and then re-encrypts the data and forwards it to the published Web server.
                http://www.microsoft.
                • by db32 (862117)
                  Heh, I don't know that I am impressed by that. It seems like a pretty bad idea and not much of a feature. But hey ActiveX and other such nonsense being able to do whatever it wants to the OS through the web browser is a feature too...
                • by bmajik (96670)
                  That is what i am referring to, but i am talking about it in the opposite direction.

                  We use ISA server as an outbound proxy, so when i make an https connection to whereever, ISA presents me a cert that i trust (because what i trust is controlled via my domain membership) and then makes another https connection on my behalf, and then does stateful inspection between the two connections. So it proxy's the clear-text https connection.

                  This is good if you are a company and you want to be able to figure out what
        • This is actually some details and things I'd like to know, and wouldn't have thought of.

          TFA fails the non-obvious test. Great: They VPN in to a sandbox, which is something I thought about a long time ago, only for another reason than remote attestation. It's also nice that they've figured out how to use SSL instead of a VPN 100% of the time, and to let people set up LANs. Two-factor authentication -- wow, revolutionary. NOT.

          But it's nice to hear about things like you actually eating your own dogfood -- some
      • Do you remember the guffaws resounding throughout /. and other geek websites when MS first tried to transition hotmail from freebsd to Windows NT?
    • by yo_tuco (795102)
      "The article seems to say they only use Microsoft solutions to provide their security."

      Apparently, Microsoft indirectly uses Linux [theregister.co.uk] on the front lines by partially outsourcing the management of their DNS servers. But the date on TFA is 2001. I have no idea if that is true today.
    • Those with the skills to steal it have no use for it.

    • Re: (Score:3, Interesting)

      by UnknowingFool (672806)
      I would think the article should be more appropriately titled: How Microsoft Implements VPN Security to Fend off 100,000 Attacks. I have no doubts that MS uses companys' solutions like routers and firewalls as part of their overall security. This article was all about VPN security.
  • by zappepcs (820751) on Friday December 08, 2006 @01:17PM (#17163902) Journal
    this is a story about how MS is doing security... however, 2 factor authentication has been in use for decades, even before computers became the common day things they are today. In the military, I've seen where it takes 3 people and two keys just to open a door to a secured space. The tech is new, and hopefully now that MS is telling people that is how they do things, perhaps banks and other people with my personal information stored up will start doing the same??? sigh
    • by GeckoX (259575) on Friday December 08, 2006 @01:22PM (#17163968)
      Where did it mention that MS is doing anything groundbreaking or revolutionary here?

      This is simply an article about how MS, arguably the most targeted entity out there, secures their business.

      Further, it appears to work very well for them, without sacrificing their employees ability to work.

      Really, what are you trying to say here? Should it require 3 people and 2 keys to log into your office over VPN every day to get some work done? Somehow I thing not, but that still leaves me wondering what is your point?
      • by zappepcs (820751)
        The point is that I'm glad that it works for MS, its been working for other people/groups/companies for decades, in several forms... I just hope that this example of how well it works will inspire banks to follow the example
      • Further, it appears to work very well for them, without sacrificing their employees ability to work.

        Of course should it not work well, Microsoft wouldn't tell you. Or would you really expect them to say "well, we have security problems caused by this MS product ..."? There are a lot of reasons why they won't do that. First, it would of course make bad advertising for the products. Second, it would also make bad advertising of MS itself (along the lines of "they can't even keep their own network safe"). And

      • by Da_Weasel (458921)
        Hahaha...that would be really funny! I was just thinking about my company hiring two people to follow me home each night just so they could require three people to be present for me to access the VPN...hahaha

        I really don't know why I found that so funny, but i'm still laughing...heheh

        Do more people and more keys make something more secure? O_o
    • by wtansill (576643) on Friday December 08, 2006 @01:55PM (#17164410)
      perhaps banks and other people with my personal information stored up will start doing the same??? sigh
      You really do not want to go there. Let's say you have the following (reasonably typical) scenario:
      1. You have a checking account
      2. You have a 401(k) through your company
      3. You have a Visa credit card
      4. You have a MasterCard credit card
      Each institution where you maintain an account decides to require two-factor authentication.
      • Do the security keys interoperate, or do you have to now have four seperate tokens?
      • Your spouse wishes to log in as well, can (s)he use the same tokens, or does (s)he have to have their own?
      • Spend a lot of time on the road? Want to check your account(s) from your hotel room? Take all your tokens. Which, BTW, means that the spouse cannot check while you are away unless each account issues one token per spouse or other authorized account user (which, BTW, adds cost for the institution).
      • You have an emergency of some sort and must have access to your account, but forgot/lost your token, the battery died, whatever. Is there a secondary mechanism that will allow you to access your account which does not rely on the use of the security token? If so, you've just doubled the institution's cost of doing business with no net benefit to the institution.
      Add to that the scary fact that two-factor authentication does nothing to prevent man-in-the-middle attacks -- someone can still get hold of your session and possibly access your supposedly secure accounts -- and the luster dims for the two-factor scheme.

      It works well in some limited instances, but I shudder to think of the possibilities if it's ever adopted on a wide scale.

      • by zappepcs (820751)
        While there is that problem, and related problems, most everyone in the western world (covers me and my family) have mobile devices whether that is a phone, pda, or pager. These devices can be registered with the service in question as the place to send the token for 2nd factor authentication. To eliminate man in the middle, there are other methods rather than straight https. Sure, that might require that you install some app(let) on your machine and limit you to using only machines with that app(let) insta
        • by wtansill (576643)

          While there is that problem, and related problems, most everyone in the western world (covers me and my family) have mobile devices whether that is a phone, pda, or pager. These devices can be registered with the service in question as the place to send the token for 2nd factor authentication.

          I'm referring to the physical token that you have to have in hand in order to supply the second authemtcation factor. For instance, RSA makes a physical device that creates a six digit random number at one minute int

      • Re: (Score:3, Insightful)

        by johneee (626549)
        I don't know about that, but I do have accounts in three different banks, and they do have two factor authentication - bank card and pin - for some of the access I have to them. Mostly it works pretty well...
      • Once very computer comes with a smart-card reader (very inexpensive) you could keep a smart card in your wallet! They're credit card sized. You could store your keys for multiple financial services on the same card. It wouldn't cost much at all, it would just take a little bit of cooperation between the banks.
      • by drew (2081)

        # Spend a lot of time on the road? Want to check your account(s) from your hotel room? Take all your tokens. Which, BTW, means that the spouse cannot check while you are away unless each account issues one token per spouse or other authorized account user (which, BTW, adds cost for the institution).
        # You have an emergency of some sort and must have access to your account, but forgot/lost your token, the battery died, whatever. Is there a secondary mechanism that will allow you to access your account which

      • Do the security keys interoperate, or do you have to now have four seperate tokens?

        Ideally, I now have one token: A private key. Each institution now has my public key and my social security number. If I ever have to generate a new public key, I can use the social security number and whatever other means they now use if I walk into the bank. Short of that, they trust anyone who has a matching private key.

        Your spouse wishes to log in as well, can (s)he use the same tokens, or does (s)he have to have their

      • By law all banks must move to two-factor authentication. Both of my banks have already implemented it.
    • by Basje (26968)
      No, it needs two keys, period.

      The three people are part of the prescribed protocol, but the problem is people not following the protocol but using a shortcut instead.
  • by jbeaupre (752124) on Friday December 08, 2006 @01:19PM (#17163934)
    They whip out the OEM image CD and reinstall. The down side is they have to get rid of all those AOL icons and replace Norton AV each time.
    • Not to mention changing the wallpaper, setting default apps to Firefox, Thunderbird and WinAMP and editing the global policy to disallow MSN Messanger to run at all.
  • by coleopterana (932651) on Friday December 08, 2006 @01:25PM (#17164010) Journal
    I've noticed that the best way to find problems with your own product is to have your employees (forced to) use it on a daily basis. I'm no Microsoft fan nor a software engineer but it seems to me to be the quickest way to find holes that testing didn't uncover. Now that in itself presents an interesting question: does that make it harder to find SECURITY problems if you're testing your product behind all those corporate protections (assuming they work)? It's no real-world experience to do that.
  • by Doctor Crumb (737936) on Friday December 08, 2006 @01:26PM (#17164018) Homepage
    Honestly, my own computers fight off thousands of "attacks" a month, if you lower the bar enough. Are there worms knocking on port 137? Or are these actual hackers with stolen passwords/passcards?
    • My company servers are also under constant attack. On top of that, I've had two users succumb to spyware keyloggers and had two separate accounts compromised. Email is under constant attack, web servers, ssh and ftp servers, the firewall, the routers..... Dictionary attacks abound, script kiddies run amok...
    • by joe 155 (937621)
      My own home computer since Nov. 30th has "fought off" over 760 attacks. All it took me to do this is just run firestarter. Does this mean that I'm having an all out war with some hackers?... or does this mean that one person who is on the same network as me (stupid appartment blocks with their crazy internet set ups) is too stupid to have updated to SP2?

      Come to think of it maybe this is whats going on here...

      God I wish it was a crime to not properly maintain your computer.
  • Balance? (Score:5, Insightful)

    by Rob T Firefly (844560) on Friday December 08, 2006 @01:28PM (#17164042) Homepage Journal
    The software giant fights off more than 100,000 attacks every month
    I wonder how the number of attacks on other sites enabled by botnets of compromised Windows machines compares to this. Are they taking more or less than their software dishes out to the rest of the world?
    • Re: (Score:3, Interesting)

      by cswiger2005 (905744)
      If you've run a honeynet, you'll find that you tend to see between ~300 and ~1500 or so "attacks" per IP address per day-- about 80% TCP-based, about 15% UDP-based, and about 5% ICMP-based. I'm not sure a simple ICMP ECHO_REQUEST qualifies as an "attack" (although there are plenty of security vendors who will claim it is, simply to inflate their numbers), but ICMP redirects which try to tell a host to send local traffic to a remote IP surely does qualify as a hostile attack.

      Assuming that there's about 1000
  • by HairyCanary (688865) on Friday December 08, 2006 @01:29PM (#17164064)
    The article reads like an advertisement for Microsoft products. The article has a nice catchy subject line and the proceeds to explain how Microsoft leverages such neat toys as Exchange proxies, Microsoft Office Communicator, etc. The article is so heavy on naming each little piece of software that it reads like a big advertisement. How much do you want to bet it is a press release from Microsoft reprinted by Computerworld?
    • by jjohnson (62583)
      No kidding. It's not enough to wade through interstitial ads to get to a page that's 60% ads sprinkled randomly throughout the text of the article; the article itself has to be a marketing blowjob for MS.

      We've reached the advertising singularity!
    • The article reads like an advertisement for Microsoft products.

      Perhaps ComputerWorld is partial to Microsoft. The more I become familiar with tech industry news, the more apparent it becomes that various news outlets have a tendency to be very credulous with the companies they are most familiar with. Other companies tend to have their PR very much sliced and diced and taken with a grain of salt.

      Though I may be confusing the "news" with the blogs since the bloggers seem to be absolved of all attempts

  • Marketting Material (Score:5, Informative)

    by dave562 (969951) on Friday December 08, 2006 @01:34PM (#17164138) Journal
    That article wasn't very informative. It only talks about the security functionality offered by Microsoft products (specifically VPN/ISA and Exchange). It doesn't even address what kind of attacks are being launched against the company beyond the typical "Virus emails." In other words, it's just thinly disguised marketting material put out under a header that seems interesting.

    I wonder how they got to the 100,000 number. If you count port scans and IP spoofs then my home network sees thousands of attacks every month.

  • by djupedal (584558) on Friday December 08, 2006 @01:55PM (#17164408)
    The software giant fights off more than 100,000 attacks every month, protecting their data-heavy internal network from the paws of your average script kiddie.

    If MS is using the routine fuzzy-math they tend to throw out when attempting to make the company seem more powerful and dominating than is backed up by reality, the '100,000 attacks' could be 99,999 pieces of spam email and one ping-flood.

    See, this is how MS routinely tries to brainwash Joe and Jane consumer. Toss out a statistic that is impossible to verify, along with just enough verbal imagery to impress non-tech savvy spenders and you're on your way to profitsville!

    'data-heavy internal network...' That is some pretty shiny bull-shit, by the way...data-heavy! As opposed to what? I can see those steel grey towering industrial strength routers, embedded into solid concrete bunkers, laced with 50 cm MIL spec reinforcing bar that is tied deep in bedrock, far below the cavernous data centers the brave MS engineers toil without end to feed, with miles and miles of 1 meter thick ethernet cables, snaking like giant blood veins, throbbing quietly as the beast that is MS R&D works around the clock for the good of mankind.

    Makes me proud to be an American, I 'tell ya!
    • From your tone, it's pretty obvious that believe that 100,000 is an unreasonable number. Why would you believe that the company who has the largest OS marketshare by an order of magnitude, has the largest OS name recognition would not have at least that number. 100,000 would seem on the very low-end of attacks, the thought of being able to infect the largest OS maker in the entire world has got to make a number of people salivate. Do you really think there are only a handful of people in the world intere
      • by djupedal (584558)
        A UNIX, sorry, I mean 'unix' admin.

        Hey, everybody! Look!! A 'unix admin'!

        Lucky day! And you used factorials and everything. I am NOT worthy, honestly. Sorry, but this is a bit overwhelming - I have to take a moment..pinch myself & make sure I'm not dreaming.

        Wait until I tell the guys on the loading dock! Those drop-outs are going to be green with envy all thru the night shift. Am I good or what!!?? I hooked one for the books this time :)

        The data-heavy stuff was not in the article, it's from
        • So you weren't going for the brilliantly sneaky and were instead going for the moron one then. Nice to know
  • 100,000 is very low, on a typical home machine if you're getting hundreds or thousands of attempts by bots, then surely the biggest software maker is getting millions. However, if they mean 100,000 attacks by individuals per month, meaning someone directly trying to "hack into microsoft", that seems impressively high. Wouldn't at least several of those get in through social engineering alone (i.e. pretend to be hot girl, get password, etc.)?
    • by Phleg (523632)

      Not saying anything about the number they get, then assuming there was a high number of direct attempts (i.e., 100,000) the attacks would likely have an even worse chance of working than if it were low. One of the primary reasons users are vulnerable to social engineering attacks is that they're rare (per individual). If this was something that happened routinely to every employee once every month or two, they'd probably be easy to spot. Of course, the additional volume might outweigh the drop in successes-

  • ...someone might steal the Windows code and come out with a competing operating system. :P
  • Do you think Microsoft has their own version of Linux now? That would be the only answer, I would think.

    Either that, or my buddy Josh (and many others) is doing his job properly!
  • "Steve, send the phone spiders."
  • 100k seems low (Score:3, Interesting)

    by xPsi (851544) on Friday December 08, 2006 @02:54PM (#17165262)
    100k attacks per month for Microsoft seems low to me. That is about 1 attack every 30 seconds. I'm not saying that this is a low number on an absolute scale, but it seems low for MS. I might have just assumed they were continuously under multiple attacks.
  • TRON.... (Score:3, Funny)

    by rubberbando (784342) on Friday December 08, 2006 @03:31PM (#17165750)
    And all this time, I thought they just used that laser from Tron [wikipedia.org] attached to a satellite that they would aim at unsuspecting hackers to digitize them into the gaming grid where they must dodge flying chairs thrown by a virtual Steve Balmer (Donkey Kong Style).
  • My company forces me to use a similar VPN system. While I don't have a smartcard, my computer is scanned every time I connect. (Actually, I can only connect company-controlled computers through the VPN.)

    It's such a pain to use the VPN due to all of the security measures. I'd rather have typical remote access software restricted to a VNC-like program that I can run on any computer.

  • TFA says:

    The network servers remember what has been scanned at each log-in, and grant a grace period before requiring a rescan. Frequent users of the VPN can often log into the network in under a minute.

    Wow. I can log into our VPN in about 15 seconds, and that includes the time it takes me to enter my password into the smart card. I'd keep the VPN open all the time too if it took that long to log in.

If money can't buy happiness, I guess you'll just have to rent it.

Working...