Korean MSN Site Hacked

An anonymous reader writes "CNN is reporting that MSN's Korean website was hacked in order to allow usernames and passwords to be stolen. Microsoft is initially blaming unpatched, outsourced servers. Just another embarrassment to Microsoft's security push."

Comments

They probably ran on linux

[mingot]

We all know microsoft doesn't trust windows to run its webservers!

Re:They probably ran on linux

[Quantum Fizz]

Strange, MSFT execs just offered me a soft drink, fortified with hints of "fresh oxytocin", and after whispering some words in my ear suddenly I just trust windows to run all my own webservers.

Re:They probably ran on linux

[Craig Ringer]

Actually, they do. You see "Linux" on some OS detection tools etc because they use the Akamai network - a third party who uses Linux - for content distribution. The underlying servers are still Windows.

To me that's just a sign they're willing to be pragmatic and use what works. It shows them in a good light when compared to the foaming zealots, actually...

Re:They probably ran on linux

[marcello_dl]

To me that's just a sign they're willing to be pragmatic and use what works.

They also have frequently spread FUD about "what works", so "pragmatic" isn't the first word that comes to my mind about them ;)

Re:They probably ran on linux

[Tripman]

There is a difference between the disinformation that marketing spreads, and the implementations that the engineers put in place.

Re:They probably ran on linux

[Master of Transhuman]

And you've never read the MS memo in which MS engineers talk about the capabilities of UNIX in comparison with their own stuff?

Google is your friend.

Personally I like the headline "Microsoft's New Search Service Protected By Penguin"!

Re:They probably ran on linux

[kc0re]

Actually does run on Windows. 2003 I believe. They switch from Unix to Windows about 2+ years ago..

Re:They probably ran on linux

[Anonymous Coward]

According to Netcraft, it certainly does:
http://toolbar.netcraft.com/site_report?url=http:/ /www.msn.co.kr

better them not me

[Anonymous Coward]

from a sincere admin

Here they come.

[MyNymWasTaken]

Untold number of "In korea, only old people..." bad jokes are on their way.

Re:Here they come.

[Anonymous Coward]

Give it up. That's an old joke.

Re:Here they come.

[Anonymous Coward]

in korea only old hot fixes gets hacked. Hmm Im bad at this help me.

In Korea

[thedogcow]

In Korea, only old people hack a worthless-piece-of-shit OS.

Re:In Korea

[HG2]

I am not old! And I did it!

Re:In Korea

[jacksonj04]

Actually I think that the MS webservers run a UNIX variant, but I could be wrong.

Let's get this out of the way now.

[Anonymous Coward]

In Korea, only old people use MSN. Only dead people use AOL.

*nix

[turtled]

I assume they weren't using *nix? =)

Mirror?

[AndreAtlan]

Anyone got a mirror of the defacement?

Re:Mirror?

[thegamerformelyknown]

It sounds to me like the idea was there was no defacement, so the people who got in could get the info. Although, I don't see the point in this - should have just defaced it.

Re:Mirror?

[numatrix]

It wasn't an overt defacement; very small iframe at the bottom of the main page that pointed to a seperate file on the same server. That file contained an tag with a src url of some other file in the same directory ending in .gif.

Of course that file wasn't actually a .gif obviously, but was a collection of IE client-side exploits to try to load a particular bit of malware.

A quick google for that malware shows the other chinese sites that I found (hey, I think that's officially the first time I've made cnn). One was discussing it, the other appeared to be (intentionally or otherwise) loading it.

Re:Mirror?

[Flendon]

The point is they stole passwords. And we all know people use the same password for everything. So know they have both their MSN username (which relates directly to their hotmail account) and password. How many websites use your email for your login name? So they have access to those accounts too.

How many websites email their password to your account? All those passwords are compromised (not that they are any different than the first one). They probably got the persons IP too. Now they can skip the brute force approach and log in directly to put the keylogger on your computer. The best thing is that they know the majority of the people who use MSN know almost as little about computers as an AOL user.

Imagine my surprise!

[plaxion]

Yet another security issue related to microsoft. Since when is that news?

Re:Imagine my surprise!

[NanoGator]

"Yet another security issue related to microsoft."

Actually, it was related to a patch not getting installed. (Pilot error.)

Re:Imagine my surprise!

[Anonymous Coward]

You must be new here. Even the most minute embarrassment involving Microsoft is sure to rate a headline here on good ol' Bashdot!

Re:Imagine my surprise!

[Anonymous Coward]

Why was a patch required? (Faulty airplane.)

Re:Imagine my surprise!

[KarmaMB84]

And yet there probably isn't a piece of complex software in existance that hasn't needed a patch to fix a problem...

Re:Imagine my surprise!

[NanoGator]

"Why was a patch required? (Faulty airplane.)"

Your talking to somebody who's had his Linux/Apache server rooted shortly after putting it on-line. I neglected to get the latest security updates. Which is it: I'm an idiot or did the developers build me a faulty airplane?

Re:Imagine my surprise!

[paranoidgeek]

The site is running IIS/6.0. (obviously) Does this mean that it hard to patch Windows/IIS ?

Re:Imagine my surprise!

[NanoGator]

"The site is running IIS/6.0. (obviously) Does this mean that it hard to patch Windows/IIS ?"

Difficulty is not necessarily a prerequisite to neglect. Ask any woman who's ever bitched about the elevation of the toilet seat.

Re:Imagine my surprise!

[shadowmas]

agreed microsoft cant be blamed much for people not applying security patches. i seem to remember that the ftp server of a popular opensource website running linux or some other *nix got hacked because of not having security patches applied to it.

BUT since this is microsoft owned site they shouldve had better security procedures or find better people to run their servers (i mean its not like they dont have money or something). specially when the site affected holds peoples personal information.

Re:Imagine my surprise!

[Anonymous Coward]

You got a faulty free airplane.

But at least it wasn't a faulty $1000 airplane built by a company with $50B available that could have funded design reviews and testing.

Re:Imagine my surprise!

[oh_the_humanity]

agreed microsoft cant be blamed much for people not applying security patches. Yes they can develop an OS that is riddled with holes, and you wouldnt have to come up with so many freakin patches. Or this one must be hard, how about an automated security update mechanism. oh i know why they dont do that . cause youd have to reboot your server once a week to apply a patch.

Re:Imagine my surprise!

[NanoGator]

"But at least it wasn't a faulty $1000 airplane built by a company with $50B available that could have funded design reviews and testing."

Funny, my 'faulty $1000 airplane' ran for nearly 2 years without an exploit or a reboot.

Re:Imagine my surprise!

[oh_the_humanity]

er i mean isnt riddled

Re:Imagine my surprise!

[Anonymous Coward]

Are you saying that you ran a Windows web server on the Internet for 2 years without patching? I call bullshit.

Maybe you are an idiot after all.

Re:Imagine my surprise!

[Anonymous Coward]

"Are you saying that you ran a Windows web server on the Internet for 2 years without patching? "

If it makes you feel better, call bullshit all you like.

Re:Imagine my surprise!

[shadowmas]

its the responsibility of the people who use the operating system to choose one that serves there need.
if they run a microsoft server they need to apply the patches no matter how frequent they might be. if they dont like it they should choose different OS. but you cant blame MS if they supply the patches and they choose not to install it.

(which is why i use a linux server).

Re:Imagine my surprise!

[Anonymous Coward]

Which is it: I'm an idiot or did the developers build me a faulty airplane?

Both.

Re:Imagine my surprise!

[penix1]

"if they run a microsoft server they need to apply the patches no matter how frequent they might be. if they dont like it they should choose different OS. but you cant blame MS if they supply the patches and they choose not to install it."

Let me try this gently to you...

It was a MICROSOFT controlled server! It was under the direct control of Microsoft even if it was a contractor. Considering it was used for Microsoft's OWN pages one would reasonably assume they would be the FIRST to patch.

What this says to people considering IIS is that Microsoft doesn't care about security (no surprise there) even when it comes to their own gear.

B.

Re:Imagine my surprise!

[Aphrika]

From the linked article, it's also important to note that "The Korean site, unlike U.S. versions, was operated by another company". So the pilot wasn't even Microsoft.

This wasn't mentioned by the story poster at all, which probably wouldn't have been accepted if it read - more truthfully - Unpatch Microsoft Web Server Compromised. We all know that an unpatched MS server is vulnerable. With that in mind, it just reads like well-crafted front page FUD.

Re:Imagine my surprise!

[shadowmas]

i know it was a Microsoft controlled server. and that the blame of not patching the server goes to microsoft. i was merely pointing out that windows cant be blamed for this because a patch already existed. the blaim still goes to microsoft but to its system admins not the OS developers (which is usually the case).

Re:Imagine my surprise!

[Thaelon]

And yet there probably isn't a piece of complex software in existance that hasn't needed a patch to fix a problem...

MIDI is still in version 1.0. Maybe you don't consider it to be complex.

Re:Imagine my surprise!

[Anonymous Coward]

Or this one must be hard, how about an automated security update mechanism.

They have that dumbass, haven't you heard about Windows Update yet? I suppose it's Microsofts fault if people don't turn it on or disable it, right? It's Microsofts fault some dumbshit admin didn't patch the machine and put it online, right? But if it had been a Linux server it would have been 100% the admins fault and no fault of the OS at all.

Who gives a shit if you have to reboot your server once a week? oooh, that 30 seconds of downtime is going to be just horrible. If you've got so little traffic that you only have one server that little blip of downtime isn't going to matter. If you have a lot of traffic you're going to have multiple servers and no one will notice one being rebooted.

Re:Imagine my surprise!

[penix1]

But in a large proportion of the cases why users (not just "admins") don't apply a patch from Microsoft boil down to 4 things:

1.) The patch will break other programs.

2.) The numbe of patches released means a large amount of "down time".

3.) Microsoft using security updates (instead of feature updates) as a platform to see if you are "ligit".

4.) Outright laziness.

3 of the 4 are controlled by Microsoft. The third reason is why things like Code Red are still loose even though it was patched years ago.

B.

(nelson) Haha (/nelson)

[Anonymous Coward]

(nelson) Haha (/nelson)

Oh No!

[Greenisus]

They might steal all the old peoples' email passwords!

Re:Oh No!

[weighn]

username: Kim123@hotmail.com password: Kim123

In Korea...

[AhaIndia]

In korea only old people use MSN.

So the server was also old (unpatched)

Re:In Korea...

[Kehvarl]

In Korea, only unpatched people grow old.

Re:In Korea...

[fbjon]

I've patched my security hole! Nobody ain't exploiting me from behind now, haha!

Re:In Korea...

[Anonymous Coward]

In korea, only old people outsource security of their sites.

All your base...

[Anonymous Coward]

... are belong to everyone else.

Importance of patching

[britneys 9th husband]

Hopefully, this incident will remind MSN of the importance of always making sure they have applied the latest patches, updates, and service packs from Microsoft's Windows Update site.

Re:Importance of patching

[Garrett Combs]

Yeah, but as the article states, the servers were outsorced. Rather than a lesson over the importance of patching, I feel this is more a lesson of if you want something done right, do it yourself.

Re:Importance of patching

[Anonymous Coward]

Or maybe this incident will remind MSN that outsourcing isn't always a good idea. Maybe if they had kept those jobs at Microsoft in Redmond this wouldn't have happened.

The blame falls on Koreans

[Dancin_Santa]

It's not really an embarrassment to Microsoft. It's an embarrassment to Koreans who have long been the leaders in wide-spread broadband and internet usage. You'd have expected that they, of all nationalities, would have their act together when it came to running servers. Unfortunately, it seems that even they are not immune to hacks.

Which is all for the better, of course. The more these systems are attacked, the harder they become. Kind of like how the SR-71's outer plating would become harder each time it took to the skies, or like how the samurai's katana becomes harder each time it is thrust into the forge. Systems become stronger by trial.

So next time there won't be this problem. That there was a problem this time is unfortunate, but like the lessons of history, this experience will make the victims Better. Stronger. Faster than before.

Re:The blame falls on Koreans

[nacturation]

It's an embarrassment to Koreans who have long been the leaders in wide-spread broadband and internet usage. You'd have expected that they, of all nationalities, would have their act together when it came to running servers.

How do you figure that? Widespread broadband penetration does not imply widespread knowledge of sound security principles. I wouldn't be surprised to find that Korean servers are hacked just as often as the servers in any other nation -- the only differing being that the hackers/scriddies use higher speed connections.

Re:The blame falls on Koreans

[weighn]

So next time there won't be this problem. That there was a problem this time is unfortunate, but like the lessons of history, this experience will make the victims Better. Stronger. Faster than before.

Dude, are you on oxytocin?

Re:The blame falls on Koreans

[Anonymous Coward]

"The more these systems are attacked, the harder they become. Kind of like how the SR-71's outer plating would become harder each time it took to the skies, or like how the samurai's katana becomes harder each time it is thrust into the forge. Systems become stronger by trial. So next time there won't be this problem. That there was a problem this time is unfortunate, but like the lessons of history, this experience will make the victims Better. Stronger. Faster than before."

If history has taught us anything it's that people don't learn from history. And get a grip on your analogies. How does a security breach (likely due to lax security policies) compare to a samurai's katana (god, get out much?) being forged? Aside from your katana fantasies, I find this analogy wholehearted irrelevant. And next time there won't be this problem??? As if one security breach means that security for all of Korea will be fixed overnight?

Everything you say is overrated, dude.

Re:The blame falls on Koreans

[DigiShaman]

Personally, I was waiting for the Bionic Man sound effect.

Cha cha cha chaaa ett ett ett ett

Re:The blame falls on Koreans

[UnanimousCoward]

Which Koreans do you want to blame? All Koreans?

Re:The blame falls on Koreans

[Elshar]

I think he just wants to blame the north and the southern ones. The rest are free of blame, I think.

Re: The blame falls on Koreans

[Black Parrot]

> Kind of like how the SR-71's outer plating would become harder each time it took to the skies, or like how the samurai's katana becomes harder each time it is thrust into the forge

...or like thinking gets harder after every hit on the hash pipe.

Re:The blame falls on Koreans

[damsa]

Oh oh, blame me.

Re:The blame falls on Koreans

[Anonymous Coward]

"The more these systems are attacked, the harder they become"

Winblows must be damn strong now.

Re:The blame falls on Koreans

[NickFortune]

Of course it is an embarassment to Microsoft! You would not absolve your bank of responsibilty for your money just because they outsourced one of their servers. Neither should we so absolve Microsoft when they fail to protect the passwords that may miscreants grant access to those same funds.

Passport is supposed to be Microsoft's single point of entry to the web. Sign on to one passport site and you're validated for all of them. That's the plan, that's what Microsoft want for passport. Potentially, passport logins protect bank accounts and other secure services. It's not just a few hotmail accounts that are on the line here.

How can we take Passport seriously in this role unless Redmond accepts responsibility for the security of its servers? Microsoft chose a substandard company to which to outsource its passport server, and then failed to exercise sufficient oversight of the company.

You can't just say "it's all the fault of the koreans". Blaming koreans in general for the careless of one korean server farm is a bit like blaming americans everywhere for Enron. Nor does it help to say "it won't be so easy next time. We have a right to expect the system to be secure in the absolute sense of the word.

Really the only way this can fail to be embarrasing to MS is if Passport has already become such a joke that no one outside Microsoft takes it seriously any more.

Re:The blame falls on Koreans

[ThePromenader]

...Harder? "More patched" maybe.

Whenever I think "Windows Server" I imagine one of those aluminum-sided WWII bombers (the B-17G namely) that have been through countless battles - with new riveted squares added after every tumultuous raid. This in itself would be fine, but then I imagine giving the same a fresh coat of paint (in whatever colour was in style last year) and a houndstooth-clad salesman sliding into the foreground with a: "ta-da! It's an all-new Machine!".

And to top all things off, ours is the age of Titanium and Kelvar. Mac's adapted (Linux) - Will Microsoft?

Re:The blame falls on Koreans

[fbjon]

You mean the south koreans and that northern guy.

Please get some journalistic integrity...

[Anonymous Coward]

Please slashdot, you're not doing any justice by harping on Microsoft. Your bias is just disgusting. Why don't you post one of the 1,000,000 Linux defacements or break-ins that happen monthly?

And I know I'm posting Anonymously. I don't have an account nor do I care to create one at your site until you stop being the Fox Network equivalent for Tech News.

Re:Please get some journalistic integrity...

[Anonymous Coward]

Well said! I'm with you.

Re:Please get some journalistic integrity...

[Anonymous Coward]

Me too! Let's all get together and fuck!

Re:Please get some journalistic integrity...

[Anonymous Coward]

What's wrong with Fox? They're the number one news channel on TV.

I think it's obvious that you have a sick fascination with Number Two.

Re:Please get some journalistic integrity...

[Anonymous Coward]

Group 53x! I wanna join.

Journalistic integrity is far and few these days.

Re:Please get some journalistic integrity...

[Goeland86]

say why don't you give me an example of a linux-based server defacement? if there's a million out there you should be able to get an example to me easily. Back up your claim or I'll consider it flame bate. Not only that, but /. lets users discuss things, unlike Fox, where nothing gets discussed in the first place. I'll gladly discuss the matter later with you, IF you post a link of a linux defacement example as a reply to this topic.

Re:Please get some journalistic integrity...

[shift.red.avni]

Here is a list of appoximately 325 Linux based web sites that were defaced today.

http://www.zone-h.org/en/defacements/filter/filter _system=Linux/filter_date_select=today/page=1/

Re:Please get some journalistic integrity...

[Anonymous Coward]

Slashdotted already.

Re:Please get some journalistic integrity...

[frikazoyd]

You don't get the major point here. It's an embarassment because it is a major, high-traffic website that requires more security than piddly local paper server number twenty seven that doesn't get a hundredth of the traffic, isn't nearly as popular, and isn't kept up to snuff on the patches.

Now, when a major linux distribution website like RedHat or Suse or Ubuntu or Debian's gets hacked, then you'll have a case for comparison.

Re:Please get some journalistic integrity...

[Anonymous Coward]

At least, learn to spell flamebait? Not like it's a complicated word...

Re:Please get some journalistic integrity...

[rungood]

if you find us as "the Fox Network equivalent for Tech News," do what I do with Fox- don't watch it. or in this case, don't read it. at least here on /. you get a forum where your voice can be heard, or your words at least read. and even though I don't mind some bias against microsoft, there are at least 2 or 3 anonymous cowards ;) that posted back to agree with you that they feel that unfair bias is placed against microsoft. while it appears that a paradox is emerging, at the same time we can see by modus ponens reasoning that slashdot isn't nearly as bad as Fox news. hey, the syllogism just proved your analogy wrong!

Re:Please get some journalistic integrity...

[superpulpsicle]

Are you implying it's okay for Windows to be hacked 20 times if Linux is also hacked 20 times?

If Linux has vulnerabilities, then Windows have even less excuse as a billion dollar corporation.

Re:Please get some journalistic integrity...

[Anonymous Coward]

Interesting. According to this site and their annual defacement report, over time BSD fares the best and Apache the worst, with IIS in the middle.

Re:Please get some journalistic integrity...

[Anonymous Coward]

if you find us as "the Fox Network equivalent for Tech News," do what I do with Fox- don't watch it. or in this case, don't read it.

That's a bullshit argument. A lot of news feeders like Findory use /. news in their feeds. Sure you can pick and choose but the word on the interwebs is that /. is supposed to be a somewhat authority on technological issues. So much so that people will come here to find technology news. If it starts having a goddamn bias, like it definitely has, then what of the people who are actually using it just to gather a bit of insight? /. needs to get its act together and that definitely comes down to the editors. Not us commentators. The editors need a kick in the ass to get this site back to its former glory.

Re:Please get some journalistic integrity...

[mjh49746]

Oh boy. This looks like flamebait to me...

I got an idea, why don't you prove your point by laying down some facts to back up your claims. Otherwise, you sound like a fucking asshole with no credibility to your name. Meanwhile, if you don't like people's opinions here, then go lurk somewhere else.

Insightful? Insightful my ass! Mod that troll shit DOWN!!

Re:Please get some journalistic integrity...

[Anonymous Coward]

Now, when a major linux distribution website like RedHat or Suse or Ubuntu or Debian's gets hacked, then you'll have a case for comparison

Debian's site WAS hacked not too long ago....open mouth, insert foot. Next time please know what you are talking about before pleasuring us all utter nonsense.

Re:Please get some journalistic integrity...

[Anonymous Coward]

"I got an idea, why don't you prove your point by laying down some facts to back up your claims. Otherwise, you sound like a fucking asshole with no credibility to your name. Meanwhile, if you don't like people's opinions here, then go lurk somewhere else."

This coming from an idiot who has rarely been modded up. Keep it up buddy. You're a moron.

Re:Please get some journalistic integrity...

[Anonymous Coward]

Why don't you post one of the 1,000,000 Linux defacements or break-ins that happen monthly?

Because so few of any value actually happen?

Unlike Windows trash, Linux can offer you REAL SECURITY.

And I know I'm posting Anonymously. I don't have an account nor do I care to create one at your site until you stop being the Fox Network equivalent for Tech News.

Good. Go away then. Goodbye.

Re:Please get some journalistic integrity...

[Nasarius]

99% of the time it's not "Linux" or Windows or even Apache/IIS at fault for web server defacement. It's crappy, exploitable CGI and other vulnerabilities.

Re:Please get some journalistic integrity...

[NilObject]

I don't have an account nor do I care to create one at your site until you stop being the Fox Network equivalent for Tech News.

But you sure don't mind reading "the Fox Network equivalent for Tech News" and taking the time to post comments, thus becoming a member of the very community you criticize. Slashdot usually reflects the biases of its members. So what? Slashdot doesn't claim to be fair and balanced. Has it ever?

Slashdot editors are not journalists, either. New York Times writers, yes, Slashdot editors, no, Associated Press writers, yes, bloggers, no. There's a difference.

Re:Please get some journalistic integrity...

[Utopia]

If you are looking for an example Debian's servers got hacked some time ago.

Re:Please get some journalistic integrity...

[binkzz]

They're not server hacks; most if not all of those are simple forum hacks or other insecure script hacks, mostly home made scripts or adjustments.

Because most of these sites are hosted by professional companies, the servers are usually more than safe; otherwise they would likely turn into spam machines.

Re:Please get some journalistic integrity...

[_KiTA_]

Waaaaah.

Fact of the matter is, Microsoft's own website being hacked, while they're in the middle of a huge (fake) "Security Push," *is* tech news. MomAndPop.com's mail server getting pwned isn't.

Re:Please get some journalistic integrity...

[grounded_roamer]

Completely agree. This is a childish behavior of /. side.

Re: Please get some journalistic integrity...

[Black Parrot]

> And I know I'm posting Anonymously. I don't have an account nor do I care to create one at your site until you stop being the Fox Network equivalent for Tech News.

Hello there, Bill!

Re:Please get some journalistic integrity...

[X.25]

Please slashdot, you're not doing any justice by harping on Microsoft. Your bias is just disgusting. Why don't you post one of the 1,000,000 Linux defacements or break-ins that happen monthly?

There are 1,000,000 Windows defacements or break-ins that happen monthly, but they don't get reported here either.

Ever heard of phrase 'high-profile'?

Re:Please get some journalistic integrity...

[Anonymous Coward]

It it STARTS to have a bias?

Oh well...

Re:Please get some journalistic integrity...

[Anonymous Coward]

>billion dollar corporation

A BIG correction: Multi billion dollar corporation

Re:Please get some journalistic integrity...

[spectecjr]

If Linux has vulnerabilities, then Windows have even less excuse as a billion dollar corporation.

No, Linux has less excuse; after all, there are billions of eyes looking at the code. That's why the bazaar is better than the cathedral.

*rolls eyes and laughs*

Re:Please get some journalistic integrity...

[X.25]

Here is a list of appoximately 325 Linux based web sites that were defaced today.

Yeah, so? This isn't about what OS is hacked, but what system. And MSN is *big* (MSN passwords can be used for many things).

If linux.com got hacked, it wouldn't matter, since it holds exactly 0 important things for a hacker. They would deface it.

But MSN KR was not defaced, they subtly placed code in order to specifically get passwords.

Quite different than placing "0wned!" message on a front page.

Re:Please get some journalistic integrity...

[Anonymous Coward]

I don't get that guy. Sometimes he can be insightful and other times a real dick.

Re:Please get some journalistic integrity...

[ozmanjusri]

Debian's site WAS hacked not too long ago....open mouth, insert foot.

And the hackage was widely reported, here and elsewhere. So why the accusations of anti-Microsoft bias?

Re:Please get some journalistic integrity...

[GeeWhiz]

Don't you realize this site is for very frustrated developers - those who are so obsessed with attempting to "take down" Microsoft - lol? Of course they are going to bash Microsoft any chance they get, just look at some of the threads that include Microsoft bashing on topics that aren't even related? It's hilarious the frustration, illogical arguments, vents, etc. I find this site to be a very amusing site. Keep it up all and thanks for the free entertainment

Re:Please get some journalistic integrity...

[Anonymous Coward]

I have to agree. I'm getting sick and tired of the Microsoft bashing all the time here at slashdot.

Re:Please get some journalistic integrity...

[Anonymous Coward]

Sure you can pick and choose but the word on the interwebs is that /. is supposed to be a somewhat authority on technological issues.

Oh come on, that hasn't been true for years. It's been common knowledge that slashdot is a haven for Linux zealotry and rabid anti MS conspiracy nuts. There are usually gems of interesting tech news but everyone knows about the huge, glaring bias here.

Re:Please get some journalistic integrity...

[Anonymous Coward]

And how many of those were defaced thanks to a misconfigured phpbb, a CMS with a default password, or other shitty php program?

To blame "Linux" for all of the attacks ignores the fact that the vast majority of the attacks are through other applications. Blaming Microsoft for these current attacks is reasonable, after all they produced the IIS servers and whatever custom code the MSN network runs on.

Re:Please get some journalistic integrity...

[mixmasterjake]

oh yea, well 325 sites, uh, i..., oh i didn't actually think you were going to post proof that linux could be hacked. uh.. world... crumbling... noooooo!

oh wait - this isn't about what os is getting hacked.... uh... yea thats it! no *important* linux servers ever get hacked. ah, yes, rationalization complete. world safe again. whew!

Re:Please get some journalistic integrity...

[Anonymous Coward]

I don't have an account nor do I care to create one at your site until you stop being the Fox Network equivalent for Tech News.

That'll show 'em!

Re:Please get some journalistic integrity...

[Anonymous Coward]

Well you are talking two different things now..all I did was tell him what he didn't know so he didn't spout as if they weren't hacked like he did. I could care less about the bias, we all know /. isn't anywhere near a real news site. Not when comments are changed, duped stories happen multiple times a day etc...

Re:Please get some journalistic integrity...

[Anonymous Coward]

So many people want to argue with the chefs in the kitchen. If the idea of rinsing your own plate and refilling your own drinks is a little to much for you, then by all means put another aqua with gas on the Amex. It is just a corporate card right?

Or said another way.

Pay $15, wait in line, deal with kids and cell phones. Total movie enjoyment score: 4.

Same movie in my living room, a little recreationals, nice snacks, the ability to start and stop, cost to watch same movie with four friends $5. Total movie enjoyment score: 8.

The only people that seem to have a problem understanding this very basic idea are those spending either daddy's or corporate's money, and sometimes that is the same person.

Re:Please get some journalistic integrity...

[Anonymous Coward]

Actually he's right. You're the moron, clearly.

But guess what - you're in luck! Scientists have rececently discovered that if you have a standard 110V outlet in your home, you can instantly improve your intelligence by sticking a fork into it - two prongs in each slatted hole. Try it and see for yourself! Make sure you hold on tight!

Re:Please get some journalistic integrity...

[Anonymous Coward]

What if a site run by a subcontractor for RedHat or SuSE or Ubuntu or Debian got hacked?

Just wondering.

Re:Please get some journalistic integrity...

[Anonymous Coward]

Slashdot postings are not journalism, they are opinions with some occasional links to journalism.

When I went to Journalism school I learned that opinion writers should feel free to let their bias show. That is their job and their duty. They are not bound by the obligation to be objective in their writing.

Journalism. It's not what you think happened. (TM)

Go figure...

[__aaclcg7560]

Microsoft is initially blaming unpatched, outsourced servers.

Looks like they didn't install SP2, enabled the firewall, and have automatic download of Windows Updates enabled. I guess Microsoft forgot to pay extra for having "secured" servers when they signed the outsource contract. It's a shame that they have to eat their own dogs... uh, food.

Re:Go figure...

[NanoGator]

"Looks like they didn't install SP2, enabled the firewall, and have automatic download of Windows Updates enabled."

Probably not since they weren't using XP as a server.

Moral of the story?

[Scorillo47]

>>> The Korean site, unlike U.S. versions, was operated by another company, which Microsoft did not identify. Microsoft's own experts and Korean police were investigating, but Microsoft believes the computers were vulnerable because operators failed to apply necessary software patches, said Sohn, an MSN director.

Don't trust other companies to apply security patches for your site.

Re:Moral of the story?

[0x461FAB0BD7D2]

I think you mean their server. Again, this is what Microsoft 'believes', according to their own statements. There is no proof yet what happened and how.

All that is known is that code was attached to the site. While it's most likely the result of an exploit, it could be that a disgruntled employee did it.

Re:Moral of the story?

[Anonymous Coward]

The Korean site, unlike U.S. versions, was operated by another company ...

Microsoft Korea.

The server they run

[putko]

From Netcraft:

Windows Server 2003
Microsoft-IIS/6.0 9-Dec-2004

http://toolbar.netcraft.com/site_report?url=http:/ /www.msn.co.kr

Re:The server they run

[suso]

So I guess the hacker who pulled it off can win an X-box in that contest?

Re:The server they run

[Anonymous Coward]

IIS was not hacked in this case.

They said an unpatched operating system was the problem which leads me to believe they were affected by something like blaster, lsass bug, wins bug etc... they got system level privlidges through that means and replaced the front page in wwwroot with whatever they wanted..

Re:The server they run

[Anonymous Coward]

From Netcraft: RIP Windows Server 2003 Microsoft-IIS/6.0 9-Dec-2004 We hardly knew ye.

Re:The server they run

[Anonymous Coward]

It's fairly likely that the servers were also running ISAPI modules written in-house to perform various features. These modules may individually be vulnerable.

To date there really hasn't been any vulnerability found in the core product that is IIS6. Secunia lists three items, two of which affect plugins not installed by default, and one affecting a management website for Windows Small Business which is also not installed by default. I don't doubt that possibly this hacker knows something that we don't, but it's more likely that they hacked something written under a little less scrutiny.

Microsoft doesn't deserve this criticism

[typical]

"CNN is reporting that MSN's Korean website was hacked in order to allow usernames and passwords to be stolen. Microsoft is initially blaming unpatched, outsourced servers. Just another embarrassment to Microsoft's security push."

Yes, Microsoft has a good deal of well-deserved bad karma. That you could consider this to be a failing of their software is ridiculous, though. If this is an embarassment to Microsoft, many Free, Open software packages of every sort, from Apache to Linux to OpenBSD to OpenSSH have been so embarassed.

I'm all for calling out Microsoft when they're (a) full of marketing bullshit, (b) way behind everyone else technically, and (c) playing dirty politics. They deserve to be criticized then. But this is simply a non-event. They had a website get cracked. Big deal. Heck, Sourceforge, the largest repository of Open Source software, has been cracked multiple times, if you want an Open Source counterpart.

Blame Microsoft when they deserve it, and your words will get more weight. If Oracle had run out and said that "Our database is hacker-proof", and the next day their website had been broken into and their database cracked, that would be a fair point to criticize someone. But simply "you had a website cracked" is no longer a big deal for most companies.

Re:Microsoft doesn't deserve this criticism

[ignorant_coward]

Sourceforge is a kludge of every insecure OSS program out there: FTP, CVS, etc. It isn't very representative of a normal website.

Re:Microsoft doesn't deserve this criticism

[typical]

I'll bet that *.microsoft.com has a lot of Web-based software that can be toyed with remotely.

As for using CVs, I can't wait until Sourceforge moves to Subversion. I've been using ClearCase recently, and despite all of the things that I dislike about ClearCase, at least the thing can version file and directory renames. It's a pain for a whole lot of open source authors to not be able to version moves.

Re:Microsoft doesn't deserve this criticism

[tres]

The news here is that it wasn't just a vulnerability published, nor a proof of concept, it was a full fledged crack attack against one of the sites that represent the corporation itself. The news here is that it's the same old Microsoft. The news here is that "Trustworthy Computing" is just another marketing buzzword.The news here is that if you can't even manage to secure your own servers, how do you expect the rest of the world to do it?

Microsoft deserves every bit of blame that they get. They want to pretend like security is something that can be applied like a coat of paint, but in the end, incidents like this prove that it's the same old crap rolling out of Redmond.

Re:Microsoft doesn't deserve this criticism

[figgypower]

Yes, Microsoft has a good deal of well-deserved bad karma. That you could consider this to be a failing of their software is ridiculous, though. If this is an embarassment to Microsoft, many Free, Open software packages of every sort, from Apache to Linux to OpenBSD to OpenSSH have been so embarassed.

Yeah... you were doing great until you mentioned OpenBSD; it's pretty damn secure.

Re:Microsoft doesn't deserve this criticism

[typical]

The news here is that it wasn't just a vulnerability published, nor a proof of concept, it was a full fledged crack attack against one of the sites that represent the corporation itself.

And how is this not equivalent?

They want to pretend like security is something that can be applied like a coat of paint, but in the end, incidents like this prove that it's the same old crap rolling out of Redmond.

I'm not arguing that Microsoft does a good job of producing secure systems (it's really unrelated to this thread, but I'd say that they have poor security practices, too-complex-to-secure systems, APIs that lend themselves to insecure programming practices, and an unfortunate tendency to twist "security" to mean "DRM"). I'm arguing that a website defacement is not a good argument against a company's software.

Re:Microsoft doesn't deserve this criticism

[Tim C]

So what? It most certainly is representative of the FOSS movement. It's built entirely using FOSS apps, it's (one of) the main repositories for FOSS projects, and as such is extremely high profile.

You don't just get to say "yeah, but that's not how you'd normally create a website!", because that's how it was *chosen* to be created.

Re:Microsoft doesn't deserve this criticism

[Anonymous Coward]

They had a website get cracked. Big deal. Heck, Sourceforge, the largest repository of Open Source software, has been cracked multiple times, if you want an Open Source counterpart.

Sourceforge don't want to store your credit card details and login details for various websites on their servers. Passport is what makes Microsoft getting cracked important.

Re:Microsoft doesn't deserve this criticism

[peachpuff]

I think you've misunderstood why this is an embarrassment to Microsoft. It's not that a server running their code got hacked. It's not that a server with their name on it got hacked. It's that they hired someone to run their code for them, but they didn't even perform trivial checks that it was being done properly.

It's not embarrassing to be hacked. It's embarrassing to be hacked for lack of your own patches.

Re:Microsoft doesn't deserve this criticism

[Anonymous Coward]

And it holds what sensitive data? I'm just wondering.

Re:Microsoft doesn't deserve this criticism

[4of12]

If this is an embarassment to Microsoft, many Free, Open software packages of every sort, from Apache to Linux to OpenBSD to OpenSSH have been so embarassed.

Who could forget the profound of depth and breadth of the OpenBSD security exploit of late winter 2002 that affected millions of people worldwide, leaving them without power in the dark, the cold, and wondering if life would ever go on the same.

To this day I see teens at the mall with cowed looks because of the horrific imprint that the OpenBSD security event made on their childhoods.

Re:Microsoft doesn't deserve this criticism

[Jonny_eh]

Let me know when the apache.org website is cracked. That would be the FOSS equivalent to this incident IMO

Re:Microsoft doesn't deserve this criticism

[Anonymous Coward]

The fact they got hacked again falls in the hands of a lazy IT staff. Had they applied the patches none of this would've happened.

So technically the Trustworthy Computing is working fine. The unTrustworthy IT staff is the one to blame...which is typical in every exploited site.

Re:Microsoft doesn't deserve this criticism

[typical]

Let me know when the apache.org website is cracked. That would be the FOSS equivalent to this incident IMO

okay

Re:Microsoft doesn't deserve this criticism

[bedessen]

Oh please. Sites get hacked, it happens. alpha.gnu.org was hacked BADLY and was readonly for like 6 to 8 months while they verified all their code. The same happened with gnome.org. Yet you don't see anyone running around screaming that "if the FSF and GNOME hackers can't secure their own servers, how do [they] expect the rest of the world to do it?" These things happen.

Before the Micrsoft bashers ejaculate all over

[I'm Don Giovanni]

their monitors, read the article:

"The Korean site, unlike U.S. versions, was operated by another company, which Microsoft did not identify. Microsoft's own experts and Korean police were investigating, but Microsoft believes the computers were vulnerable because operators failed to apply necessary software patches, said Sohn, an MSN director."

Re:Before the Micrsoft bashers ejaculate all over

[dtfinch]

They don't do all of their development inhouse either. A bit of their minor product and web development is also outsourced. But Microsoft is still gets the blame when their software is found to be insecure, no matter who they contracted to maintain it. They won't even identify the other company. As far as users could tell, Microsoft was hosting the web site, because they were given no reason to believe otherwise. They trusted a Microsoft web site and their passwords got stolen.

Re:Before the Micrsoft bashers ejaculate all over

[.killedkenny]

They don't do all of their development inhouse either. A bit of their minor product and web development is also outsourced.

Why DON'T they do all their stuff in-house? Why let some two-bit company handle it? - aren't Microsoft supposed to be the world's experts on all things computing? Especially when it comes to Windows software?

But Microsoft is still gets the blame when their software is found to be insecure, no matter who they contracted to maintain it. They won't even identify the other company.

We don't know for sure if there even IS another company involved. It's a lot easier to pass the blame than to say, "Uh...Our best people and our best products let this happen."

SP2?

[3770]

Not that this is very important, but they wouldn't be running their servers with SP2.

They are likely running Windows Server 2003 and the latest service pack for WS2K3 is SP1. SP1 for WS2k3 came out after SP2 for XP so it should contain everything that SP2 contains.

Re:SP2?

[__aaclcg7560]

Not that this is very important, but they wouldn't be running their servers with SP2.

I was just repeating the obvious consumer line since you need SP2 for patches and IE7. Even with Windows Server 2003, it's the same thing except the service pack number is different.

Re:SP2?

[Anonymous Coward]

Actually, they marketed 2003 as being secure out-of-the-box, locked down from the beginning.

But, thats marketing :)

Stupid users keep pushing that big insecure button on the side of the computer, just so the lights come on...

In Korea...

[Luigi30]

Only old servers are unpatched.

Schadenfreude ... can't resist

[putko]

LOL ROFLMAO!

[sorry -- I really couldn't resist]

Microsoft eats own dogfood, suffers serious indigestion.

I'd love to see Gates have a tantrum over this one. Someone is going to get flying-ninja kicked in the nuts.

GNAA

[Anonymous Coward]

I, for one, welcome our new Korean overlords.

Re:GNAA

[commodoresloat]

I, for one, welcome our new Korean overlords.

Don't you mean our old Korean overlords?

An embarrasment?

[HillaryWBush]

Microsoft's software security push likes to be tied in a chair with a gag in its mouth, while its boyfriend makes love to another man in front of it. It is embarassed when it finds another blackened spoon in the bathroom after he promised to quit. But Koreans stealing its passwords is not embarassing.

Re:An embarrasment?

[TrancePhreak]

How about when the main Linux kernal CVS got hacked and an exploit injected but nobody noticed for a few weeks?

Next Step:

[Anonymous Coward]

"Korean Windows Update Site Hacked"

Outsourcing

[stox]

I am sorry, Microsoft, but I don't give a damn that you outsourced your servers. The customer is buying your name and reputation when they buy your product. So, you may have saved money on the bottom line, but you have squandered trust the consumer had for you. At some point in the future, you will realize what a valuable commodity this was and how expensive it is to re-acquire.

Re:Outsourcing

[NanoGator]

"So, you may have saved money on the bottom line, but you have squandered trust the consumer had for you. At some point in the future, you will realize what a valuable commodity this was and how expensive it is to re-acquire."

I like how it's completely Microsoft's fault even though a.) some dickhead maliciously broke into their server b.) it could have been prevented by the non-MS people in charge by staying up to date.

Can we at least make a couple of 'Insightful' speeches about the real bad guy?

Re:Outsourcing

[whoever57]

I like how it's completely Microsoft's fault even though a.) some dickhead maliciously broke into their server b.) it could have been prevented by the non-MS people in charge by staying up to date.

It is MS's fault because MS did not do enough to ensure their subcontractor ran a secure system: It is MS' responsiblity to ensure that their contractors have the appropriate skills and motivation to run the website securely. Clearly MS failed.

Re:Outsourcing

[grolschie]

Can we at least make a couple of 'Insightful' speeches about the real bad guy?

Meh! Bill Gates jokes are getting tiresome.

Re:Outsourcing

[NanoGator]

"It is MS's fault because MS did not do enough to ensure their subcontractor ran a secure system:"

If the contractors didn't live up to their end of the contract, the burden's on them.

Re:Outsourcing

[Anonymous Coward]

If the contractors didn't live up to their end of the contract, the burden's on them.

They were working on behalf of Microsoft.

If Microsoft failed to see the folly in their contract, the burden is on them to correct themselves. Not the contractor, atleast as far as PR and blame is concerned.

(irony)It's nice to see that msn.co.kr is an MSN site, Microsoft is providing these services. But when it gets cracked, the contractor is the only target you see, and the only one responsible.(/irony)

They can hire another contractor, if they wish. As for being Microsoft, if they are offering the said contractor's services in their name, I guess Microsoft is at fault for having screwed up by choosing the wrong contractor.

The technical fault may be the contractor's failing, but only Microsoft is answerable to it: because they knowingly asked for and chose the said contractor, and the contractors were working for and on behalf of Microsoft.

So please, put things where they are.

Re:Outsourcing

[mcrbids]

So, you may have saved money on the bottom line, but you have squandered trust the consumer had for you. At some point in the future, you will realize what a valuable commodity this was and how expensive it is to re-acquire.

Next "security" fix out - the automated oxytocin mister! Required for all corporate accounts!

Re:Outsourcing

[lee1026]

I was under the impression that no one had to pay for MSN. and therefore they never bought the product.

Re:Outsourcing

[whoever57]

If the contractors didn't live up to their end of the contract, the burden's on them.

That's what audits are for: to make sure contractors are living up to the contract.

My point was that MS needs to provide the neccessary motivation to ensure the security procedutes are properly followed.

What's the phrase: "Trust but verify"?

Please don't interpret my remarks as saying that the contractors did not screw up: if the reports are correct they did; but ultimately it is was a MS website and MS's customers trusted MS to provide a secure website. MS chose the contractors and must take responsiblity for their failings.

Re:Outsourcing

[UnknowingFool]

You do have a point. It's the Microsoft name that is plastered over the website. It part of their responsibility to ensure that their websites are secure, but part of the blame is on who hosted the servers. Given MS' history of security issuesm, you would think that securing their own servers would be a priority. Maybe MS did have security policy and mandates in place. Maybe the contractor ignored them. Maybe this is a problem of bureaucacy. MS just didn't check out every detail that they should. The fact is that we don't know.

Right...

[Anonymous Coward]

Aww how cute! Look at all the Anti-Corprate Gates haters. Maybe if there were as many Linux haters you would see the same happen to Linux systems.

Re:Right...

[Anonymous Coward]

Right on, you think.

The difference is, that the Windows world loves getting broken into, and they pay through their nose for that privilege, too.

Microsoft just has no valid reason to make, keep making and peddling such a cheap ripoff "OS", given that they have $Xbn in the bank, and the best brains of and in the world, that they're supposedly proud of.

Re:Right...

[ObscureKaffine]

You know why there are significantly less nix haters??? Because it is a superior product. Simple as that...

I'll believe Microsoft's statement when...

[kakashiryo]

someone proves that the person who submitted this news article isn't the hacker himself.

Koreans and their tunnelvision

[Anonymous Coward]

It's no surprise that this happened in Korea. I haven't ever met a Korean who didn't think that everything under the sun was invented in his country. I've even met quite a few who thought that Jesus Christ retired in Korea after the crucifixion. Even today, they are trying to lay claim to Japan's Tokushima islands with protestors setting themselves on fire (??!) and stabbing themselves with sharp objects.

It's no wonder that a "we can do no wrong" culture leads to this type of situation.

How's that old saw go? Pride goeth before destruction, a haughty spirit before a fall.

Re:Koreans and their tunnelvision

[Anonymous Coward]

And most importantly, frank before beans.

Re:Koreans and their tunnelvision

[Anonymous Coward]

Retired in Korea, maybe. But buried in Japan.

A couple points of comedy...

[syzme]

Security researchers noticed the suspicious programming added to the Korean site Tuesday and contacted the company.
Microsoft/its hosting company didn't even notice the problem. Sombody had to tell them their own site was hacked. Security Through Good Luck(TM).

Microsoft said it was trying to decide whether to issue a broad public warning to recent visitors of the Korean site...
Thats good; keep users ignorant. Way to go.

Re:A couple points of comedy...

[javaxman]

You missed the best part :
it's pretty clear from everything being said ( and what the attacked servers run ) that they hadn't applied SP2 and/or IIS patches, and the attack was done using one of many fairly well-known exploits. Ok, maybe not comedy, but certainly irony or something close too it. Just desserts?

Windows Server 2003?

[Anonymous Coward]

According to netcraft.

(I was expecting this to be an 'ironically linux', but no)

http://uptime.netcraft.com/up/graph?site=msn.co.kr

http://msn.co.kr/ was running Microsoft-IIS on Windows Server 2003 when last queried at 3-Jun-2005 04:32:08 GMT - refresh now Site Report
Try out the Netcraft Toolbar! FAQ
OS Server Last changed IP address Netblock Owner
Windows Server 2003 Microsoft-IIS/6.0 26-Dec-2004 207.46.78.16 Microsoft Corp
Windows 2000 Microsoft-IIS/5.0 1-Nov-2004 207.46.78.16 Microsoft Corp
Windows 2000 unknown 31-Oct-2004 207.46.78.16 Microsoft Corp
Windows 2000 Microsoft-IIS/5.0 12-Sep-2004 207.46.78.16 Microsoft Corp
Windows 2000 Microsoft-IIS/5.0 8-May-2004 207.46.68.21 Microsoft Corp
Windows 2000 Microsoft-IIS/5.0 13-Feb-2003 207.46.68.21 Microsoft Corp
Windows 2000 Microsoft-IIS/5.0 29-Jun-2002 207.46.89.101 Microsoft Corp
Windows 2000 Microsoft-IIS/5.0 8-Jan-2002 207.68.182.61 Microsoft Corp
Windows 2000 Microsoft-IIS/5.0 28-Nov-2001 207.68.182.53 Microsoft Corp
FreeBSD Microsoft-IIS/5.0 27-Nov-2001 207.68.182.53 Microsoft Corp

No uptime is currently available for msn.co.kr.

^_^

[Anonymous Coward]

kekekekekekekekeke ^_____________^

Re:^_^

[ignorant_coward]

^_____________^

I, for one, bow to our Master Control Program overlords!

Re:^_^

[Anonymous Coward]

Tron was on TV recently was it?

Nelson "HA HA"

[Anonymous Coward]

This is why Sun doesn't allow Windows clients to connect to their internal network. Windows is a liability.

In other news...

[Kagura]

In other Korean news, Jeon Ji Hyun is still a very Sassy Girl.

wipe and reload?

[Elminst]

"Microsoft said it cleaned the Web site, www.msn.co.kr, and removed the dangerous software code... "

I got $5 that says this translates to "formatted and reinstalled the OS..."

Re:wipe and reload?

[malfunct]

You don't wipe your OS if you have been rooted? How do you know that there isn't something in there waiting to bite you?

Re:wipe and reload?

[TCM]

I got $5 that says this translates to "formatted and reinstalled the OS..."

Well, what would you do?

Re:wipe and reload?

[Elminst]

precisely my point...
but they're putting it like they "cleaned it all up and it's good as new!" like washing your car or something.
BS.

Re:wipe and reload?

[Anonymous Coward]

No, everyone knows that you are trying to make a point about having to wipe MS operating systems clean on a regular basis.

DONT FUCKING LIE.

Re:wipe and reload?

[Anonymous Luddite]

>> "Microsoft said it cleaned the Web site, www.msn.co.kr, and removed the dangerous software code... "

So which distro did they load to replace windows?

Re:wipe and reload?

[StarManta.Mini]

Well, what would you do?


I'd buy an XServe. ;-)

Re:wipe and reload?

[Craig Ringer]

Yep, or reimaged it. So what?

<rant type="NOT directed in any way at parent poster">

This whole story is just dumb. A site run by MS got cracked. Yay. At least they admitted it - putting them well above companies with much more of a responsibility to do so.

I know how hard it is to keep a network secure, especially where multiple companies are involved (and before anybody starts, I'm a *nix and Linux user so don't tell me any crap about "just use Linux to make your network secure"). This isn't news. Yes it's annoying for their users and embarrasing for them, but it's hardly headline material.

I thought people got bored of this dumb BS five years ago?

</rant>

Re:wipe and reload?

[zulux]

Well, what would you do?

Formatted and installed a different OS.

Re:wipe and reload?

[TCM]

The point is, you don't run any code from a compromised system. You wipe the system, install (the same or another system) from fresh install media and restore your data (not programs, not scripts without review, nothing except non-executable files).

While the "format and reinstall" attitude in the perspective of just running a system over a long time is certainly wrong, it is crucial after a security breach.

Re:wipe and reload?

[rodac]

If you had an incident you reformat the drives, all of them, and reinstall from scratch. Every time. No exception.

Doesnt matter what OS you run, after an incident you will reformat everything and start from scratch.

Re:wipe and reload?

[Anonymous Coward]

I thought people got bored of this dumb BS five years ago?

Doubt it. You seem to have been reading Slashdot for a while now. If you were really bored, you would stop wasting your time here. You're at least interested enough to post.

Re:wipe and reload?

[Anonymous Coward]

Sure - I like to take the compromised drive and figgure out how they broke in. Just for curiosity's sake.

It make me evaluate my methods - and has forced me to come up with some automatic patching scripts and some automatic shutdown scripts: For example if I find that OpenSSH has a compromise - I just set a flag on a webserver and every hour, each of my OpenBSD firewalls check for the presence of that flag and shuts down sshd if it's found.

Re:wipe and reload?

[VeganBob]

Well, what would you do? Restart the computer, that fixes anything in Windows.

Re:wipe and reload?

[RoLi]

[..] and restore your data (not programs, not scripts without review, nothing except non-executable files).

Well, that's just not the Windows-way to do things. In Windows-land every backup-tool in existance will back up the whole hard drive.

Of course everybody with a clue knows that this is inefficient and insecure.

Everybody without a clue doesn't know any alternatives anyway...

Re:wipe and reload?

[Vitriol Angst]

If I were using Windows, I'd format and re-install. That's why when Microsoft said; "removed the offending code" it is pretty funny. Because they are removing Windows.

On another OS, like MacOS X, UNIX or even maybe NT 3.5 or Windows 2K (if you know a lot) you can actually fix the OS. Our IT people don't have any repair software at all--they always format and install. This works only because most of the people they service just work with documents in the usual applications. But, when I set up my computer, it is set up for video editing, design, programming, web development, multimedia, communications services, maybe a webserver, etc. On My Mac, I create cloned OSs and I can actually "FIX" things.

So when you say Well, what would you do? it tells me that you aren't even aware of another way of coexisting with a computer. OK. Maybe you are, but it points out that this is the "ONLY" way to fix a Windows XP install. The thing is to blinking convoluted to repair.

Re:wipe and reload?

[malfunct]

That isn't necessarily true in regards to content which is what I'm certain the article was speaking about being "cleaned up".

Re:wipe and reload?

[TCM]

On another OS, like MacOS X, UNIX or even maybe NT 3.5 or Windows 2K (if you know a lot) you can actually fix the OS.

Sorry, this attitude has no place when the system was compromised. Working with the system to fix it is dangerous when the tools you work with are not trustworthy anymore.

You could selectively "restore" system binaries using tools like tripwire. OTOH, "restoring" the system for example by compiling a fresh system from source on the compromised system itself would be stupid since the compiler could be compromised. Every output you get from ps(1) or top(1) or netstat(1) could be compromised and so on.

So when you say Well, what would you do? it tells me that you aren't even aware of another way of coexisting with a computer. OK. Maybe you are, but it points out that this is the "ONLY" way to fix a Windows XP install. The thing is to blinking convoluted to repair.

Remember, this is not about fixing your average XP install that has become rotten over time. It's about a system that was maliciously modified to cover the tracks of the intruder and to possibly provide hidden entry points to the intruder later.

Re:wipe and reload?

[Vitriol Angst]

You are right-- I was confusing a desktop with a server. A compromised server would have to be reformatted--unless of course you could compare it to an image. Thanks for the correction.

Why would /.'ers care?

[Anonymous Coward]

The same typical people will come on here and post about how they hate M$ and this is their fault because having an enemy gives them a sense of self and identity as part of the /. groupthink. Of course as usual /.'ers miss the point. This story has more to do with international relations than M$. But as usual /. bias comes through. /. cares more for rumor, gossip and bias especially if it's directed at its supposed enemies. Anyone who points this out of course will be modded down accordingly.

MS-Karma 1.0

[Tablizer]

Microsoft is initially blaming unpatched, outsourced servers.

Outsourced your MS jobs to Asia, and now outsourced servers are taking revenge.

MS: 0
Offshored U.S. Techies: 0
Globalization: 2

(Relax, itsa half joke)

Re:MS-Karma 1.0

[Anonymous Coward]

Surely being in Asia wouldn't count as 'outsourced' for this server, considering that that's also where it's market is. If it was in the US, that would be outsourcing.

Outsourcing...

[Anonymous Coward]

MS can't afford to run their own servers?

The MS Server 2003 licensing fees are too high, so they outsource it to a cheaper locale - uhmmm...

M$ bashing

[CHESTER COPPERPOT]

Yup sure sounds sounds like the appropriate people to bash. Who says there is no bias here?

Re:M$ bashing

[Anonymous Coward]

Thats all B$.

Re:M$ bashing

[Anonymous Coward]

oh well, wasn't it a news in slashdot weeks ago?
and this *professor* didn't present any proof or evidence to support his claim.
*red* complex is still powerful in South Korea, just like you can threaten and fool as you like in the States with security and all.

the way they can get away with false claims and dubious statements again and again.. I'm not sure which country is easier to do that.

From TFA

[killa62]

"The Korean site, unlike U.S. versions, was operated by another company, which Microsoft did not identify. Microsoft's own experts and Korean police were investigating, but Microsoft believes the computers were vulnerable because operators failed to apply necessary software patches, said Sohn, an MSN director."

RTFA
nuff said

Re:From TFA

[penix1]

"The Korean site, unlike U.S. versions, was operated by another company, which Microsoft did not identify."

First, that is marketing speak for "It wasn't us! Blame them!" Second, just how many "unidentified" companies run MSN's webpages? On its face, this is simply absurd. So yes you should "RTFA" but you should also question the logic of it.

B.

IIS updates don't come through Windows Update

[b00m3rang]

At least not that I've seen in my limited Windows admin experience. They always seem to be manual hotfixes and service packs.

Luke...

[Anonymous Coward]

Go back to journal trolling...

Whirred UP! And MOD up, too.

[Anonymous Coward]

n/t

Not directly their fault

[SamMichaels]

Just another embarrassment to Microsoft's security push.

No, this is a classic case of why outsourcing mission critical systems and/or data is wrong. It also goes to show that it's NECESSARY to patch mission critical hardware (hell, even non-mission critical Spider Solitaire machines).

We all have issues with MS, but this time it isn't directly their fault.

Re:Not directly their fault

[delicious]

um, how is it not directly their fault? they did choose to outsource the mission critical component of the system, did they not?

it seems you are releiving companies of any responsibility for outsourced operations.

Re:Not directly their fault

[varebel]

SamMichaels speak with forked tongue.

You start by saying that this is why outsourcing mission critical system is wrong, but then you say, *because* it was outsourced, that it wasn't really Microsoft's fault.

If you're excusing MS because they outsourced, then how can you criticize others for doing the same?

Re:Not directly their fault

[RoLi]

We all have issues with MS, but this time it isn't directly their fault.

Huh?

So Microsoft, the "wannabe" internet company is too incompetent to run their servers themselves. Yes, it's not "directly" their fault when something goes wrong.

Actually it doesn't matter wether something goes wrong or not, the pure fact that they outsource their servers is a sign of pure incompetence.

Re:Not directly their fault

[prshaw]

>> the pure fact that they outsource their servers is a sign of pure incompetence

And how do you come to this conclusion?

Is running their own servers in the US a sign of pure competence?

Do the two balance out?

Re:Not directly their fault

[Anonymous Coward]

So you mean that Bush isnt to blame if he outsource the torture?
Its exactly MS fault, they did not check what they bought. They put their name on the operation. Its as bizare as blaming Lyndie England.

In Korea...

[Anonymous Coward]

...old AND young people would hit that.

I'd take Ji Hyun over Baek Doo San any week.

zerg

[Lord Omlette]

This wouldn't have been that big of a deal if Microsoft's security push came w/ Trust in a Bottle...

Trolls are moderating and submitting the articles

[Anonymous Coward]

I actually don't think it has anything to do with journalistic integrity. I think the trolls on this site are on a disruptive campaign to start flame wars. This is the second article this week that has an overbearing bias towards M$. If you notice straight away the comments start coming about /. bias and people are modded down accordingly. Why? Because the trolls are coordinating not only the articles but coalescing to mod (a number of the mods are trolls) down people so as to incite more hatred of not only /. but M$ as well. This happens week in week out. It won't stop till there is an investigation of the massive highly organised trolling that goes on here on /.

Could it have affected US sites?

[Mancat]

I've been getting "SSL certificate couldn't be verified" messages when logging into Hotmail for the past few days. I'm in the US. The article says nothing about US sites, but it sure seems like a big coincidence that Hotmail has been acting up for me around the same time that this was going on.

Dupe...

[Elitist_Phoenix]

Dupe!! ... Oh, hold on, Korea this time. Well in this case I'd like to put in a pre-emptive dupe... its bound to happen again.

Mod Parent Up(TM) please.

[Anonymous Coward]

There could indeed be some good Korean hackers behind this.

Don't Throw Stones

[RzUpAnmsCwrds]

Remember, Debian's servers were hacked a while back. People who live in glass houses shouldn't throw stones.

Re:Don't Throw Stones

[Anonymous Coward]

palestinians throw stones

Re:Don't Throw Stones

[Alioth]

Hardly comparing like with like. Debian is a small, volunteer project with a few thousand dollars to hand. Microsoft is a giant global corporation with billions of dollars on hand. They have orders of magnitude more resources to devote to security than the Debian project.

Windows SHOULD be vastly better than Linux, given how much they charge for it and given the extreme wealth of the company behind it.

Re:Don't Throw Stones

[Anonymous Coward]

The servers were not hacked a developer got careless with his password/gpg key that is a big difference.

Re:But...But...But...

[Anonymous Coward]

Computers are only as safe as the person(s) looking after them, and that goes for any operating system.

MOD UP - BRILLIANT ANALOGY OF FOX TO /.

[Anonymous Coward]

I don't have an account nor do I care to create one at your site until you stop being the Fox Network equivalent for Tech News.

So true, so true. You know what'd louse up /.'s pitiful existence? Spreading this new meme around the Internets. Slashdot: Fair & Balanced (R)

Oh noes!

[Ridge]

The hackers used the Zerg rush.

MSN-orthKorea?

[Joe Jarvis]

Bill Gates: Chairman Il, I'm calling in regards to your proposal to develop MSN-orthKorea.

Kim Jong Il: Ahh, yes. I would like all searches to return two results--the party's web page and Western blondes. And the butterfly is too free. Can you change it to a moth made from gray wool and the sorrows of my people?

Bill Gates: I think we can do that. MothXP (formerly My Moth) enables you to go that place today.

Kim Jong Il: Excellent... Can you make the moths old?

No! It was a Koran flushed down the toilet!!

[Anonymous Coward]

Attention people of Afghanistan! We flushed a Koran down the toilet, not a Korean. Chill out will you?

Your friends,

The guards at Gitmo

Don't Throw Stones-Use something bigger.

[Anonymous Coward]

"Remember, Debian's servers were hacked a while back. People who live in glass houses shouldn't throw stones."

We of the Glass House Council highly recommend that people continue throwing stones.

Re:Don't Throw Stones-Use something bigger.

[Anonymous Coward]

people who live in glass houses should screw in the basement!

The world is a scary place

[Anonymous Coward]

Maybe you better stay inside under your mom's skirt. It's not safe for kids to be playing out here on the internet.

...leaves you stronger

[Vainglorious Coward]

So next time there won't be this problem. That there was a problem this time is unfortunate, but like the lessons of history, this experience will make the victims Better. Stronger. Faster than before.

Not always. Sometimes the experience leaves the victim Dead. Extinct. Irrelevant. (cf : Dinosaurs)

God bless Korea

[KingHippo2600]

Heh. I now, officially, think Korea is cool.

Statistics!

[flithm]

You're forgetting that you can't just compare raw numbers like that.

Apache runs a lot more web servers than IIS. Despite BSD being way more secure than Linux it is also used much less frequently.

Statistics like these are probably the most useless in determining security in terms of safety. I can't say for certain, but more than anything they probably say more about the commonality of the respective programs and operating systems.

Especially when looking at most of these "hacks" they are really just web site defacements, most of which don't count against specific operating systems or web servers.

A lot of attacks like those are done by taking advantage of holes in web software, ie SQL injections, or exploiting other flaws in script logic.

Oh well... I'm wasting my time.

Re:Statistics!

[jaseuk]

FreeBSD is used more frequently than any single Linux distribution.

FreeBSD was placed at 2.5 Million active sites in June 2004.

Redhat (the most use Linux distro) was placed at 1.6 million active sites in March 2005. We can even add Redhat and Debian together and still get a number lower than FreeBSDs active site count.

Linux may be more popular overall, but FreeBSD is the strong leader if compared to any single Linux distribution.

So yes you could safely compare FreeBSD against Debian & Redhat.

These figures are from Netcraft.

Jason.

Re:Statistics!

[tka]

So you are talking about a BSD distro when the previous poster talked about BSD/Linux. I don't consider it a fair comparison, it's like comparing FreeBSD to different Windows versions. But it's true that BSD is favoured among web hotels and has significant installation base, I'm not disputing that.

Re:Statistics!

[Santana]

1. FreeBSD is NOT a "BSD distro"
2. FreeBSD is NOT a Linux flavor as you imply with your analogy (FreeBSD vs. different Windows versions)
3. The grandgrandparent had the wrong numbers, the grand parent proved it. Nothing unfair on that.

Re:Statistics!

[fbjon]

So what ARE the different BSD's? I've been tying to figure out this, so I know whether to choose debian or *bsd to tinker with as a small server.

Re:Statistics!

[jaseuk]

FreeBSD.
OpenBSD.
NetBSD.

There is alot of cross pollination of ideas but each distribution is seperately maintained and has a slightly different feature set.

FreeBSD in general has better hardware support for common server hardware than the others and has the largest number of add-on packages available.

The volume of packages available to quickly install makes it well worth installing a FreeBSD system if only for evaluating open source software prior to installing on another Linux or BSD system.

NetBSD has the most ports to other architectures out of all the BSDs. Of course if you don't need to install on alternative architectures this will be of no interest.

OpenBSD is renowned for its tight security, however most of the software developed (ie. PF firewall & OpenSSH) usually finds its way back into the other BSDs and Linux systems.

Things are a bit different on BSDs to Linux, often slightly differing command line syntax for the basic file management commands, different device names, configuration and startup script locations.

However once you've learned a Linux distribution and a BSD distribution you can flip between the two styles without alot of difficulty, once you've had some exposure to a different way of doing things you can usually find your way around other operating systems such as Solaris or SCO.

Theres no right or wrong answer here, usually its best to standardise for production systems on one operating system to make patching and so on simpler. If you're learning then theres no harm and huge benefits from exposing yourself to as many operating systems as possible, as you never know what may land unexpectedly on your desk.

Jason.

Re:Statistics!

[jaseuk]

Well those were the best figures available from Netcraft.

Netcraft shows 3.9 million active sites for the top 7 Linux distributions. FreeBSD is showing 2.5 million. No stats are available for the other BSDs, so its hard to make a comparison.

The important point here is that the BSDs host far more sites than are commonly believed, so you could make like to like comparisons of Linux vs BSDs for web hosting, without feeling that there would be to much bias for or against linux based on the notion that Linux is far more popular. The truth is that there is not all that much in it.

Only One OS has NEVER been hacked or rooted ever!

[Anonymous Coward]

Only One OS has NEVER been hacked or rooted ever!

And that is MacOS.

(Not the FreeBSD derived OSX, the Classic Mac OS)

Running any version of MacOS is 100% safe and with ANY version of Webstar webserver that runs on MacOS, and has never once ever had a break in. In the entire history of BugTraq's huge database of exploits not one remote exploit has ever once been found in MacOS, and running as a server is 100% safe.

There are about 10 technical reasons for this, and it is not just luck. Unfortunately, about all 10 technical reasons are not part of the OSX universe.

This is why many universities and ever the US ARMY dropped linux, unix AND windows and swapped to MacOS years ago.

In the recent year the www.USARMY.mil web site swapped from MacOS to OSX to use it as a honeypot, despite using MacOS on other mil servers, but few people seem to want to try embarrasing the us army web site yet again, mainly because of draconion punishment and jackbooted retribution, though I feel OSX is a big mistake for a web server, as is any bug-ridden easily exploited OS.

The MacOS has not ever been exploited, once ever, though in 1996 or 1997 a third party web assisting tool for web site purchasing services was found to have an exploit but was rapidly patched and was a rare and little used product. It is the sole and ONLY entry in the entire BugTraq database or in any published defacements or rooting in any search engines.

Hell I even forgot the name of the little used applet tool for MacOS web servers.

But I will NEVER forget that the most secure web servers run WebStar on macOS.

I call BS

[kernelpanicked]

Umm for all the MS lovers saying it's not Microsoft's fault, I work for a large web hosting comapany (work on UNIX servers, not Windows but still see everything that happens on both sides) and 99% of compromised boxes come from shit code allowing exploits. So one Microsoft representative claims it was the fault of an unpatched system, well I'm not buying it. More likely it was an exploit in shit code from a company whos specialty is insecure code.

Re:I call BS

[ignorant_coward]

If Microsoft's specialty isn't insecure code, what is it?

Re:I call BS

[chrisxkelley]

oh, they happen to be excellent at "beginning hacker training". but now these beginners have moved on to more difficult *NIX servers to hack... :) only old people....

What's the difference?

[jvd]

Really, if the problem was that the servers were unpatched, why is that supposed to be something embarrassing to Microsoft?, I say that the ones who should be embarrassed are the systems administrators who are mediocre enough to not patch their systems knowing how much risk was and is at stake!

This type of problem would have been likely to happen in just about any other unpatched operating system... be it UNIX or not UNIX, it would' have not made any difference whatsoever.

Re:What's the difference?

[tomstdenis]

The problem is that they represent Microsoft. Even if they are "out sourced" they represent the type of security minded people that MSFT is hiring.

In other words, if they were more concerned about security and not "the bottom line" they would have hired a firm with a better track record to run the website.

As usual they probably cut corners to get "to the market" as soon as possible. Almost like [new rant] Nintendo and Sony did with their new handhelds [both of which I bought, both of which had scores of dead pixels].

Quality is just something no company seems to give a shit about even in light of people demanding it still.

Tom

Re:What's the difference?

[prshaw]

>> In other words, if they were more concerned about security and not "the bottom line" they would have hired a firm with a better track record to run the website.

And how many times had the sites been hacked in the past? What was the track record they hired? And who had a better track record there?

>>As usual they probably cut corners to get "to the market" as soon as possible.

'probably cut corners'? And where do you get this from?

Re:What's the difference?

[tomstdenis]

"'probably cut corners'? And where do you get this from?"

I get that from a live demonstration in which Gates essentially looked like the ass he is.

Had they tested [at least the fucking demonstration] sufficiently they wouldn't have that mishap.

Now think about this, if they can't test out a 15 minute presentation sufficiently before going live in front of the WHOLE FRIGGIN PLANET ... what type of thinking goes into the OS that they bundle with everything, and you have to pay for before you bring it home and realize how craptacular it is?

Tom

Re:What's the difference?

[cbiltcliffe]

Quality is just something no company seems to give a shit about even in light of people demanding it still.

That's because everybody says they want quality when they're participating in marketing surveys and the like. When it comes right down to buying something, though, price is the only thing that matters.

How many times have you heard "But I can get a Dell for $349. Why would I spend more than that?"
To which you reply "$349 Dell's are antiquated pieces of shit with 3 year old technology and a mishmash of garbage quality components. You'll be replacing it in a year because it's already years out of date, and you haven't even ordered it yet."
And the only thing they can say back is "But it's only $349!"

Re:Look at their ads!!!

[Tripman]

SP2?

Windows 2003 has only just received SP1. SP2 is for Windows XP.

Ever get the feeling that a lot of people on Slashdot that comment on servers have never had to run any?

mod parent up!

[Black Parrot]

> ...old AND young people would hit that [google.com].

That must qualify as informative - it's not often that slashdotters see pictures of an oriental girl with her clothes on.

Actaully, we do not know that for sure

[WindBourne]

MS has been cracked before. Just 2 years ago, they had russians crawling throughout their network.

In addition, when has MS ever taken responsibility for their actions?

At this point, if MS says that the other company did not stay up on patches, I am not inclined to believe them. I think that something else happened, and MS just wishes to blame them. And the korean company will take the blame just to keep the business.

But I do have to say that I am a bit surprised that MSN would use an outsourced company for this since they have a large operation in Korea.

Re:Actaully, we do not know that for sure

[Anonymous Coward]

you have to realize that microsoft is one very VERY large company with several sub-sections that dont cross-communicate (they are just too large for something like this). its like how the MSN web page was implementing pop-up ads at the same time IE6-SP2 was implementing a pop-up blocker. self-defeating for the same company, dont you think? and considering this is a completely seperate COUNTRY, i doubt there is much talks between the two other then the people at the top, and very little at the bottom (where grunts would be installing patches on servers)

The " One Microsoft Way"

[Anonymous Coward]

Have a look

http://toolbar.netcraft.com/site_report?url=http:/ /www.msn.co.kr/

Look for nameserver. At last proof positive !!!

Re:The " One Microsoft Way"

[Anonymous Coward]

Er, we've known this for decades.
Nice you are catching up with us.

zerg rush no longer works

[Anonymous Coward]

After they balanced the spawning pool from 150 to 200 minerals, zerg rush now never works unless the map is tiny or you're a newb. All you need is some well placed buildings, a bunker, a sunken colony, or cannon to easily fight off a zerg rush. Even 2 on 1 should be no problem if you use your miners to attack. 3 on 1, well, that's what allies are for, isn't it?

Better rephrasing

[Anonymous Coward]

If you can't take a little bloody nose, maybe you'd better just go home and crawl under your bed. It's not safe out here. It's wonderous, filled with wonders to satiate desires both suttle and gross, but it's not for the timid.

Re:Only One OS has NEVER been hacked or rooted eve

[Anonymous Coward]

Hell I even forgot the name of the little used applet tool for MacOS web servers.

Which means you might find yourself unwittingly running it one day, lulled into a false sense of security....

Security vulnerabilities are profitable.

[Futurepower(R)]

Microsoft's virtual monopoly for the desktop OS means that security vulnerabilities are profitable. People buy a new computer when they find the old one has become slow. The don't realize they are infected, and that their computer became imperceptibly slower each time it got infected.

Re:Koreans and their tunnelvision - error fixing

[Anonymous Coward]

Sorry, I wrote 'Korean' when I meant 'American'.

325 * 31 = 1,000,000?

[Joseph_Daniel_Zukige]

And why should I trust that list?

I do not misunderstand why people feel the need to defend Bill Gates and company, unfortunately.

Nobody important will ever know.

[pcmanjon]

"Just another embarrassment to Microsoft's security push."

Another embarassment for who "Nerds" who read the popular "News for Nerds. Stuff that matters. -- A popular technology news website"?

That's like having a Christian missionary meeting in a city that only allows Christians to live there.

Do you actually think wind of this news about Microsoft will reach real news sources such as MSNBC, FOX, and others? Yes, this article is on cnn's website, but I'm talking about newspaper and TV.

The amount of people who have power (e.g. corporate types who make decisions) are more likley to be reading the Wallstreet Journal than logging on at night to http://cnn.com/

So after all, this isn't an embarassment to Microsoft at all, as nobody important will ever see this article.

Re:Nobody important will ever know.

[br0ck]

That's like having a Christian missionary meeting in a city that only allows Christians to live there.

Do you really think that missionaries only proselyte amongst heathens?

nobody important will ever see this article

So no one amongst the powers that be reads Business Week, Washington Post, Chicago Tribune, NBC/CBS/ABC/FOX News, Forbes, or any of the other 208 news sources that this has already hit?

only $5 that they did the right thing?

[Joseph_Daniel_Zukige]

You wouldn't trust them beyond $5 to do the right thing?

I don't gamble, but I'd give close to half odds that the first thing they did was use symantec. I'd even give better than one in ten that they might not even yet have wiped the system. And I'd even give close to 1 in 2 that they have not yet pulled the raid, restored from last week's backup, and started scrubbing executables from the the off-line db raid so they can extract and update.

Man. panic time.

Check the info

[WindBourne]

According to cnn, the opening that was being talked about was an opening on MSIE, not on IIS. These frames could be used in malicious attacks that take advantage of a flaw in Microsoft's Internet Explorer Web browser that the company patched last December.
IOW, the opening that everybody is talking about is on the client, not on the server. At this time, I would not trust anything that is coming from MS (or the news). The news will probably go after MS, while MS will try to spin it in their favor. Personally, I suspect that MS actually tried to spin by implying that the missing patch was on the server, and the reporters did not pay attention. Anymore it seems like most reporters miss the real stories.

Re:Check the info

[fymidos]

>the opening that everybody is talking about is on
>the client, not on the server

The code that exploited that opening was on the server though. How did *that* happen?

Category?

[karearea]

Shouldn't this also be in "It's Funny, Laugh"?

Re:Imagine my surprise! - its not a Mac problem

[Anonymous Coward]

MacOS servers have never been rooted remotely or defaced according to entire BugTraq database.

No patches ever needeed. no exploits found EVER.

i am talking macOS not unix-freebsd-OSX

The blame usually does fall on Koreans.

[Aldric]

Anyone else find a Kornet IP responsible for 99% of attempted attacks?

IIS Hacked??

[jonathanduty]

IIS Hacked, No way. Now thats breaking news.

Same child like behavior I'd expect

[Twillerror]

People wonder why people have doubts about open source. One reason is accountability.

If linux.org got hacked, who'd care, or even if slashdot ( remember ). MS at least is standing up and admiting it has a problem. OS just hides behind it's structure. Because we are open we will get patched.

Somebody hacked into their computers in order to steal password, not to shame MS. Be mad at the hackers for once. Is this going to be any different if/when MS is not king of the hill? No, get over it.

On a side note. Has slashdot ever consider not allowing posts to a story? This is a classic example of a useless post section. About the only thing useful might be how they got in, but no is going to know that until this story isn't on the front page.

Can we IhateMS.slashdot.org and stick these stories there?

Re:Same child like behavior I'd expect

[CmdrGravy]

I agree this story is really fairly gratiuitous MS Bashing but your comments about accountability are way off track.

First of all if any particular website got hacked then who ever runs that website is going to be accountable for it, I'm sure they too would stand up and say they had a problem.

Amusingly in this instance MS isn't really standing up and admitting they have a problem they are saying "It's not our fault, blame the company we outsourced management of our servers to" which isn't really a great example of the-buck-stops-here-accountability.

Re:Same child like behavior I'd expect

[RoLi]

About the whole "accountability" thing, it's quite funny because Microsoft explicitly waives all accountability in their EULA.

Re:Same child like behavior I'd expect

[marcosdumay]

What a great exemple of acountability: "The server is outsourced, it is no our fault".

I really want to know this parallel universe that you describe, where MS stands up for their faults while FOSS people don't. Here at this universe, MS hides their products' bugs (and often don't even assume that they are bugs, calling them features), hides their marketing practices, lie to buyers about what their products do (and what they will do), sell an inexistent support and even lie to courts.

It is stupid people like this that make all those FUD campaigns usefull.

In Korea,

[bcmm]

In Korea, only old servers are used for email...

Big deal

[Lord Faust]

So, if this story makes MS look bad, then by that logic I can go and WinNuke -- with my 1337 skillz -- whatever remaining Windows95 boxes are out there, and call it a victory against MS as well?

The moral of this story seems to be fairly simple; outdated, unprotected software can -- and will be -- exploited. This isn't MS-specific, unless you're some special kind of ignorant.

The North Koreans are about to attack.

[Anonymous Coward]

Great inflammatory headline from SC Magazine. Those crazy North Koreans are ready to attack the US with an army of hackers. Apparently they have just bought a load of pc's running windows 3.11 and they're as mad as hell!!

Re:Trolls are moderating and submitting the articl

[wed128]

Don't like Slashdot? don't come here.

Hmmm..

[vmfedor]

I worked for a small IT company, maybe 20 employees, and our web servers were always under attack. The IT manager always showed me the logs of thousands of intruder attacks every day. We never got hacked, and we ran Windows servers. We wouldn't have gotten hacked if we ran Rehat servers, either, because our IT staff was well-trained and kept our servers patched and up-to-date.

Your server can only be as secure as the quality of the people you hire. It's totally possible to run a totally insecure Linux server and it's also totally possible to run a completely secure Windows server. The people that manage the servers just have to know what they're doing, on either OS. People that blame the OS for their hacks should really blame the person that manages it.

Re:Hmmm..

[Anonymous Coward]

haha that's awsome, that becuase some retards showed the logs of code-red and other automated scrpt kiddie crap hitting your machines (and everyone else's BTW). and not working that you assume they were 'smart' and on top of it

HAHAHAHAHAHAHAHAH wow your in for a suprise, if they showed you logs of thousanda attempts daily it mains your IT guys were CLUELESS FUCKWITS, or just trying to impress your non-computer know asshat self into assuming they were good.

Most good IT people don't worry abotu automated script and call them 'attempts' becuase they are not code red attacking your machine is NOT a hacking attempt

Open Source hides behinds it's structure?

[Henk Poley]

Could you name an example? Last year, several Open Source projects have reported that some of their servers were hacked into. I definitely remember Debian going though lists of MD5 hashes to find back older known-good versions of their files.

But maybe you can enlighten us? btw, I am not saying that Open Source is somehow 'better than Microsoft' in this case. It's just that you saying that people probably don't see something is rather hard to prove for the people you speak to ("Hey, I don't know any project that told me they were hacked, it must be true!").

I'm finding this discussion interesting

[mcc]

So the idea is that Microsoft may not be responsible for the security and user safety of online services with their name on it because they may not personally be the ones actually running it?

Well then I'll be sure to keep that in mind the next time I am considering paying for or signing up for a Microsoft-branded online service.

Re:Trolls are moderating and submitting the articl

[GeeWhiz]

I LOVE slashdot, are you kidding me? This is the funniest site I've ever been too.

Hmmm

[Jesus IS the Devil]

I can't connect to any of my Hotmail accounts using Outlook Express. Maybe this is serious enough that MS is temporarily disabling all accounts?

Re:Hmmm

[fbartho]

I wonder what you're referring to, because Hotmail disabled Outlook Express connections a little while ago (3,4 months)... pseudo-permanently, unless you pay to have their premium account... I was dissappointed, and on one of my computers, one of my hotmail accounts kept working for a month, but that ended when I chose to reformat that computer, and since then I'v ehad to check my hotmail accounts from the website...

Re:Hmmm

[Jesus IS the Devil]

Nope I've still been able to access it in OE up until yesterday. In fact right now a couple of my accounts still work with OE.

Unpatched servers are universal

[ClubStew]

I can't say I'm surprised by the "if it's M$ it's bad" sort of propaganda, but seriously people: all software needs patching. Windows and *nix alike, if they go unpatched obviously the holes are not mitigated.

Re:sans.org?

[wirehead78]

How many times has sans.org been hacked?

Re:Imagine my surprise! - its not a Mac problem

[Anonymous Coward]

No patches ever needeed.
No exploits found EVER.
No one can be arsed.

I'm not Bill!

[Anonymous Coward]

My name's Steve, you inconsiderate clod.

Agreed

[ShoobieRat]

So the idiots running the servers didn't bother to keep them up-to-date....and thus it's Microsoft's fault?

Sounds to me like another case of user stupidity. If yer not going to take care of things, either don't have them or shut up.

GNU/Linux distributions vs. BSD operating systems

[Santana]

A distribution is a collection of pieces of software, mixed together, to form an operating system. Each piece of software is maintained separately.

That's what GNU/Linux distros are: they all start with practically the same kernel (Linux) in the bowl, put some GNU and BSD utilities, add water, mix together and serve.

BSDs on the contrary, are entire operating systems where each component is developed ad-hoc for the OS. They doesn't share a kernel and add some random utilities. Each of them maintain a PUBLIC source tree of the whole operating system. Everything is in the same place developed from a single tree.

Take a look at the CVS tree if you are curious.

Thanks to the freedom of the license, all of them share code which redounds on benefit of the users.

Re:GNU/Linux distributions vs. BSD operating syste

[fbjon]

So, each *BSD is kind of a "distro" of the BSD source tree. Except they have different source trees.

only one?

[dance2die]

am i the only one who's not surprised to hear the news?

really?

[fbartho]

wait are these free accounts? and if so how long have you had them... I know they didn't specifically disable the interface for accounts, but they made it such that new clients couldn't connect meaning for awhile I could connect on one computer but not the other... I should check to see if they reenabled that stuff.

Re:really?

[Jesus IS the Devil]

All free accounts. Most were created years ago but one was created just a few months ago. Give it a try.

Re:GNU/Linux distributions vs. BSD operating syste

[tka]

Never the less, if you say that FreeBSD isn't a distro how can jaseuk's comparison on FreeBSD vs. RedHat and Debian be right. It should be compared to all Linux distrobutions. That's what I have been trying to say, jaseuk started comparing FreeBSD to specific Linux distrobutions when flithm talked about BSD vs. Linux.

Re:Look at their ads!!!

[cbiltcliffe]

Good point, but that doesn't negate the original point of the GP.
Microsoft claims you can manage thousands of servers and workstations worldwide from a single desktop computer. Not only that, they claim it's cheap and easy to do so.

If all their advertising is true, why the heck aren't they doing it?

Yay!

[fbartho]

Heya, thanks alot!! I checked it again and it works once again... :) I remember having outlook express post an error message "Account not accessible because free e-mail accounts have had remote checking disabled" (completely paraphrased), but apparently they changed their mind... and they must never have gotten around to even temporarily disabling your account :P

Lucky me!