How Microsoft Fights Off 100,000 Attacks A Month 169
El Lobo writes to mention a ComputerWorld article about Microsoft's battles with the Hackers of the world. The software giant fights off more than 100,000 attacks every month, protecting their data-heavy internal network from the paws of your average script kiddie. The article discusses Microsoft's 'defense in depth' strategy, and discusses just some of the layers in that barrier. From the article: "The first layer of protection for the Microsoft VPN is two-factor authentication. After an infamous incident in the fall of 2000, Microsoft installed a certificate-based Public Key Infrastructure and rolled out smart cards to all employees and contractors with remote access to the network and individuals with elevated access accounts such as domain administrators. Two-factor authentication requires that you have something physical, in this case the smart card, and also know something, in this case a password."
100,000 a month...? (Score:5, Funny)
So, who's doing the other 99,999 then...? :)
Re:100,000 a month...? (Score:5, Funny)
They use bees (Score:5, Funny)
Re: (Score:2)
Re:They use bees (Score:5, Funny)
Thanks! (Score:5, Funny)
Yahoo Ping Department (Score:5, Funny)
I always wondered what they do with all those echo requests.
Re:Yahoo Ping Department (Score:4, Interesting)
does everyone default to this for some reason that I'm not aware of? Is that what you're referring to?
Re: (Score:3, Insightful)
I know everyone here always does ping yahoo.com to test DNS/network connections.
We also ping google.com somtimes too
I feel bad for them
Re: (Score:2)
Re:Yahoo Ping Department (Score:5, Funny)
re - sig (Score:2)
Re:Yahoo Ping Department (Score:4, Interesting)
Re: (Score:2)
How about the best step . . . (Score:4, Insightful)
Re:How about the best step . . . (Score:5, Insightful)
Combined, it's all vital. But imho, saying "just cut the plug on the network" is not feasible and horribly short-sighted. MS has several web applications, update servers, search engines... what are you saying again? You propose they cut all that off, too? The damage is just as bad (if not worse) if their update servers get hacked instead of their personnel database.
Network security covers a little more than just "vital data".
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
Re: (Score:2, Informative)
Beyond that, Microsoft needs to control what executable code its employees can grab off the Internet. Apparently, even non-IT workers there can download and install almost anything. I know a contractor in technical support that just translates the phone conversations and really isn't a technical person at all. He just speaks multiple languages. And from what he tells me, he has no restrictions on his computer from installing softw
Re: (Score:2)
Not only that, but if you think about it, providing remote access allows another point of entry for attack. All employees that use the remote access, even if trustworthy, can't be trusted to follow all security precautions when they aren't even at the office to begin with. If you are allowed full control over files remotely, you are basically
Re: (Score:2, Interesting)
I've worked for two large (150,000+) Fortune 100 companies. One was a bank and the other... the other employeed scientest and lets just say their IP, is the lifeblood of the business. And in my experience, no one is interested is disconnecting the data, it just isn't feasible (simple, yes). With tw
How to fend of 100,000 attacks a month (Score:5, Funny)
Re: (Score:3, Interesting)
http://news.netcraft.com/archives/2003/08/17/wwwm
(old article and I wasn't able to duplicate their test so it may have changed)
Re:How to fend of 100,000 attacks a month (Score:5, Interesting)
There were 355 servers listed. A few are "unknow", a few more are "Solaris" and some I don't recognize, but at least 1/3rd of them are Linux.
Re: (Score:2, Interesting)
Re: (Score:3, Funny)
Gee.. that's a surprise! I always thought Microsoft fended off attackers by throwing chairs at them...
There... now your cliché isn't lonely any more...
Re: (Score:2, Funny)
Re:How to fend of 100,000 attacks a month (Score:5, Funny)
Dude.... I wanted a quiet gathering of a few friendly clichés not a whole cliché convention!
Re: (Score:2)
I mean come on... In soviet russia, T-shirt wears you! or I, for one, welcome our
instant classics!!!
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
Re: (Score:2)
That's funny... (Score:5, Funny)
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
Re: (Score:2)
Over 100,000 every month (Score:2, Funny)
A network powered by Fedora Core 6...
Re: (Score:2)
Re:Over 100,000 every month (Score:5, Interesting)
On my LAN gateway I have had a continuous stream of background SSH and misc Windows services attacks for years plus the occasional attempt at something more creative. Taking each of these into account I could probably arrive at thousands, if not tens of thousands per month.
I don't know how many machines MS has online but since the article doesn't really say what counts as an attack, the number seems to be ridiculously small.
I'm surprised... (Score:4, Insightful)
I'm surprised they don't even have a little something from RSA. Is their solution that good (jokes aside!), or are they just suffering from major Not Invented Here syndrome?
Re:I'm surprised... (Score:5, Insightful)
Give MS some credit...their Marketing/PR departments aren't stupid enough to talk about everyone else products used to secure their network, but I have a hard time believing that their technical folks are stupid enough to restrict themselves to MS products. I mean I have heard people explain to me how MS Proxy is the best proxy ever, or how that other stupid MS firewall/proxy/server thing is the best for boundary protection...but I assume those people will never work in security at a decent sized company for long if at all. MS products have their uses as much as I dislike many of them...but if I ever had anyone working for me try to use an MS product for something like boundary protection I would slap them, repeatedly, in front of the whole IT department.
Re: (Score:3)
Re:I'm surprised... (Score:5, Informative)
wait for it..
Microsoft ISA Server.
There may be other stuff out in front of that, but I have no evidence that there is.
I happen to dislike ISA server - because all of my traffic to the outside world goes through it, and if i notice it, its because it did something i didn't like (like forgot how to resolve hostnames - that's pretty common). I used to complain about it every day.. i'd say stuff like "ISA server makes me want to quit my job" or "maybe i could buy a 28.8 modem and get reliable fast internet access while at work). But, ISA server has gotten a lot better and the # of times a week I curse my existance has gone way down. I'll complain to co-workers that "there is no excuse for this - i've run Squid before and there are never any problems", but to be honest, i've never run a squid cluster with over 100 nodes serving over 100,000 PCs, so its not precisely apples to apples. And i've never put pre-production Squid code into a production environment -- which is exactly what we do with everything we make. My inbox has been on beta exchange for months, and over half the domain controllers here in Fargo are running Longhorn server builds.
Same thing with wireless. We deployed WPA before most of the outside world had heard of it. Internally, it was the only way to get wireless at all. If your device didn't do WPA, you didn't get to connect.
There are a few well-known "MS uses linux!!!!@#$!@#$ OMGZORZ!!!" stories out there, so i'll address the ones i am familiar with
MS uses Linux to host MS.Com
False. Microsoft.Com runs on windows servers. Microsoft has contracted with akamai to do geocaching of various web properties, and akamai uses linux to a large extent. This is why when you look at some MS.Com "machines" with tools like nmap, they'll come back as Linux boxes. they aren't MS machines, they aren't in any MS datacenter, and they aren't MS managed.
Hotmail is all linux
False. Hotmail was never linux. Hotmail has a distributed architecture, and at the time of acquisition, the front end machines were FreeBSD, and the back ends were Ultra enterprise 4500s. Eventually, the FE's were moved to Windows Server. My understanding is that they tried the transision using NT4 and it was miserable, and tried again with W2k and it was much much better. Eventually, all the Fe's got moved onto one of the server products (i dont remember if it was w2k or w2k3 before it was "done") and the hotmail capacity went UP.. i.e. re-writing the hotmail stuff natively for the new windows based platform has allowed hotmail to run more efficiently on less hardware, with lower management costs. The backend machines were still enormous sun boxes last time i asked about it a few years ago.. for a few reaons. 1) the investment in those was huge 2) the filesystem was completely customized for the application. I wouldn't be surprised if the back ends have also moved off of Sun machines. The back end boxes apparently did almost nothing with CPUs.. but lots and lots of disk IO. The custom filesystem is probably the biggest reason that moving back ends didn't happen earlier.
It's important to Microsoft to run our own stuff everywhere we can, because it demonstrates to customers that the product can meet their capacity needs, and because real world use is the best test of big complex systems. There are a few things we are NOT self hosting on yet - for instance, I am in the Business Division and while we sell a variety of ERP programs (from companies we've acquired), we still use 3rd party ERP systems to run "Microsoft, the Company". Those of you with ERP experience will understnad that this is not something you transition "over nite" or "just because". It is a goal for us in the Business Division to move MS onto our ERP stuff internally - it adds additional credibility to our products when we can tell customers "it can run Microsoft, so it can probably run your stuff". And our competitors _love_ saying things like "why buy MS's version of blah, they dont even use it themselves!"
Re: (Score:2)
Beyond that I don't know how WPA has anything to do with this
Re: (Score:2)
WPA was somewhat of a departure at the time from WEP, because it had some aspect of certificates and key management. Our WPA stuff is linked to our domain credentials and gets pushed down via group policy / certificate enrollment. _that_ certainly wasn't very common in 2001 or so.
As far as ISA server goes - I can't say for sure or n
Re: (Score:2)
Re: (Score:2)
[From MS Site]For Web servers that require authenticated and encrypted client access, ISA Server 2004 provides end-to-end security and application-layer filtering using SSL-to-SSL bridging. Unlike most firewalls, ISA Server 2004 inspects encrypted data before it reaches the Web server. The firewall decrypts the SSL stream, performs stateful inspection, and then re-encrypts the data and forwards it to the published Web server.
http://www.microsoft.
Re: (Score:2)
Re: (Score:2)
We use ISA server as an outbound proxy, so when i make an https connection to whereever, ISA presents me a cert that i trust (because what i trust is controlled via my domain membership) and then makes another https connection on my behalf, and then does stateful inspection between the two connections. So it proxy's the clear-text https connection.
This is good if you are a company and you want to be able to figure out what
Thanks for this. (Score:2)
TFA fails the non-obvious test. Great: They VPN in to a sandbox, which is something I thought about a long time ago, only for another reason than remote attestation. It's also nice that they've figured out how to use SSL instead of a VPN 100% of the time, and to let people set up LANs. Two-factor authentication -- wow, revolutionary. NOT.
But it's nice to hear about things like you actually eating your own dogfood -- some
Re: (Score:2)
When I disliked ISA server is when it ruined my browsing experience with a much higher frequency than it does today. My involvement with it has always been the same - i forget all about it until it tells me that it can no longer find the hostname of the site i was _just_ looking at 30 seconds ago.
I used to call the helpdesk (god what a PITA) once or twice a month "isa server 24 is f@#$ked up and not resolving host names, please kick it" and they'd never have an
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Apparently, Microsoft indirectly uses Linux [theregister.co.uk] on the front lines by partially outsourcing the management of their DNS servers. But the date on TFA is 2001. I have no idea if that is true today.
Re:I'm surprised... (Score:5, Informative)
"The original builders of the application created a two-tier architecture built around various UNIX systems. FreeBSD, a UNIX-like system similar to the Linux operating system, was used to run the front-end Web servers that handled login, Microsoft Outlook Express, and Web-based content delivery tasks."
"During June and July of 2000, the Hotmail site was converted from FreeBSD running Apache Web services to Windows 2000 Server running Microsoft Internet Information Services 5.0."
You can read the case study here: http://www.microsoft.com/technet/interopmigration
Re: (Score:2, Informative)
Re: (Score:2)
There were 355 servers listed. A few are "unknown", a few more are "Solaris" and some I don't recognize, but at least 1/3rd of them are Linux.
Their ultimate solution is all Microsoft ... (Score:2)
Those with the skills to steal it have no use for it.
Re: (Score:3, Interesting)
ok, sure .. .this is somehow news because (Score:4, Insightful)
Re:ok, sure .. .this is somehow news because (Score:5, Insightful)
This is simply an article about how MS, arguably the most targeted entity out there, secures their business.
Further, it appears to work very well for them, without sacrificing their employees ability to work.
Really, what are you trying to say here? Should it require 3 people and 2 keys to log into your office over VPN every day to get some work done? Somehow I thing not, but that still leaves me wondering what is your point?
Re: (Score:2)
Re: (Score:2)
Of course should it not work well, Microsoft wouldn't tell you. Or would you really expect them to say "well, we have security problems caused by this MS product ..."? There are a lot of reasons why they won't do that. First, it would of course make bad advertising for the products. Second, it would also make bad advertising of MS itself (along the lines of "they can't even keep their own network safe"). And
Re: (Score:2)
I really don't know why I found that so funny, but i'm still laughing...heheh
Do more people and more keys make something more secure? O_o
Re:ok, sure .. .this is somehow news because (Score:4, Insightful)
- You have a checking account
- You have a 401(k) through your company
- You have a Visa credit card
- You have a MasterCard credit card
Each institution where you maintain an account decides to require two-factor authentication.- Do the security keys interoperate, or do you have to now have four seperate tokens?
- Your spouse wishes to log in as well, can (s)he use the same tokens, or does (s)he have to have their own?
- Spend a lot of time on the road? Want to check your account(s) from your hotel room? Take all your tokens. Which, BTW, means that the spouse cannot check while you are away unless each account issues one token per spouse or other authorized account user (which, BTW, adds cost for the institution).
- You have an emergency of some sort and must have access to your account, but forgot/lost your token, the battery died, whatever. Is there a secondary mechanism that will allow you to access your account which does not rely on the use of the security token? If so, you've just doubled the institution's cost of doing business with no net benefit to the institution.
Add to that the scary fact that two-factor authentication does nothing to prevent man-in-the-middle attacks -- someone can still get hold of your session and possibly access your supposedly secure accounts -- and the luster dims for the two-factor scheme.It works well in some limited instances, but I shudder to think of the possibilities if it's ever adopted on a wide scale.
Re: (Score:2)
Re: (Score:2)
I'm referring to the physical token that you have to have in hand in order to supply the second authemtcation factor. For instance, RSA makes a physical device that creates a six digit random number at one minute int
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Ideally, I now have one token: A private key. Each institution now has my public key and my social security number. If I ever have to generate a new public key, I can use the social security number and whatever other means they now use if I walk into the bank. Short of that, they trust anyone who has a matching private key.
Re: (Score:2)
Re: (Score:2)
The three people are part of the prescribed protocol, but the problem is people not following the protocol but using a shortcut instead.
If all else fails... (Score:4, Funny)
Re: (Score:2)
Seems unlikely that they'd run Linux (Score:3, Insightful)
what counts as an "attack"? (Score:5, Interesting)
Re: (Score:2)
Re: (Score:2)
Come to think of it maybe this is whats going on here...
God I wish it was a crime to not properly maintain your computer.
Balance? (Score:5, Insightful)
Re: (Score:3, Interesting)
Assuming that there's about 1000
Slashvertisement (Score:3)
Re: (Score:2)
We've reached the advertising singularity!
Re: (Score:2)
Perhaps ComputerWorld is partial to Microsoft. The more I become familiar with tech industry news, the more apparent it becomes that various news outlets have a tendency to be very credulous with the companies they are most familiar with. Other companies tend to have their PR very much sliced and diced and taken with a grain of salt.
Though I may be confusing the "news" with the blogs since the bloggers seem to be absolved of all attempts
Marketting Material (Score:5, Informative)
I wonder how they got to the 100,000 number. If you count port scans and IP spoofs then my home network sees thousands of attacks every month.
Statistics...gotta 'luv em (Score:5, Funny)
If MS is using the routine fuzzy-math they tend to throw out when attempting to make the company seem more powerful and dominating than is backed up by reality, the '100,000 attacks' could be 99,999 pieces of spam email and one ping-flood.
See, this is how MS routinely tries to brainwash Joe and Jane consumer. Toss out a statistic that is impossible to verify, along with just enough verbal imagery to impress non-tech savvy spenders and you're on your way to profitsville!
'data-heavy internal network...' That is some pretty shiny bull-shit, by the way...data-heavy! As opposed to what? I can see those steel grey towering industrial strength routers, embedded into solid concrete bunkers, laced with 50 cm MIL spec reinforcing bar that is tied deep in bedrock, far below the cavernous data centers the brave MS engineers toil without end to feed, with miles and miles of 1 meter thick ethernet cables, snaking like giant blood veins, throbbing quietly as the beast that is MS R&D works around the clock for the good of mankind.
Makes me proud to be an American, I 'tell ya!
Re: (Score:2)
Re: (Score:2)
Hey, everybody! Look!! A 'unix admin'!
Lucky day! And you used factorials and everything. I am NOT worthy, honestly. Sorry, but this is a bit overwhelming - I have to take a moment..pinch myself & make sure I'm not dreaming.
Wait until I tell the guys on the loading dock! Those drop-outs are going to be green with envy all thru the night shift. Am I good or what!!?? I hooked one for the books this time
The data-heavy stuff was not in the article, it's from
Re: (Score:2)
Re: (Score:2)
100,000 is very low for automated attacks (Score:4, Insightful)
Re: (Score:2)
Not saying anything about the number they get, then assuming there was a high number of direct attempts (i.e., 100,000) the attacks would likely have an even worse chance of working than if it were low. One of the primary reasons users are vulnerable to social engineering attacks is that they're rare (per individual). If this was something that happened routinely to every employee once every month or two, they'd probably be easy to spot. Of course, the additional volume might outweigh the drop in successes-
Good thing they're so secure. Otherwise... (Score:2)
Microsoft Linux (Score:2)
Either that, or my buddy Josh (and many others) is doing his job properly!
end to end protection (Score:2)
100k seems low (Score:3, Interesting)
TRON.... (Score:3, Funny)
My experience (Score:2)
My company forces me to use a similar VPN system. While I don't have a smartcard, my computer is scanned every time I connect. (Actually, I can only connect company-controlled computers through the VPN.)
It's such a pain to use the VPN due to all of the security measures. I'd rather have typical remote access software restricted to a VNC-like program that I can run on any computer.
One minute is a long time (Score:2)
The network servers remember what has been scanned at each log-in, and grant a grace period before requiring a rescan. Frequent users of the VPN can often log into the network in under a minute.
Wow. I can log into our VPN in about 15 seconds, and that includes the time it takes me to enter my password into the smart card. I'd keep the VPN open all the time too if it took that long to log in.
Re: (Score:2)