Slashdot Mirror
How Microsoft Fights Off 100,000 Attacks A Month
El Lobo writes to mention a ComputerWorld article about Microsoft's battles with the Hackers of the world. The software giant fights off more than 100,000 attacks every month, protecting their data-heavy internal network from the paws of your average script kiddie. The article discusses Microsoft's 'defense in depth' strategy, and discusses just some of the layers in that barrier. From the article: "The first layer of protection for the Microsoft VPN is two-factor authentication. After an infamous incident in the fall of 2000, Microsoft installed a certificate-based Public Key Infrastructure and rolled out smart cards to all employees and contractors with remote access to the network and individuals with elevated access accounts such as domain administrators. Two-factor authentication requires that you have something physical, in this case the smart card, and also know something, in this case a password."
So, who's doing the other 99,999 then...? :)
THE HONOUR OF THE KNIGHTS - CC Licensed Sci-Fi Novel
Thanks for passing all those protection and security measures you develop to your customers! Wait a tic...
Invexi - a Phoenix, AZ based web design and web development company.
Keeping your vital data physically disconnected from the outside Internet. I know it'll cut off people who work remotely, but if it's that important, it's worth it.
Your hair look like poop, Bob! - Wanker.
They probably just run linux...
I thought the first thing you were supposed to do to protect against attacks was to ensure you aren't using Microsoft products in any part of your infrastructure...
linux!
The software giant fights off more than 100,000 attacks every month, protecting their data-heavy internal network from the paws of your average script kiddie.
A network powered by Fedora Core 6...
Summation 2
... do they run Linux?
The article seems to say they only use Microsoft solutions to provide their security.
I'm surprised they don't even have a little something from RSA. Is their solution that good (jokes aside!), or are they just suffering from major Not Invented Here syndrome?
Global symbol "$deity" requires explicit package name at line 2. - If only $scripture started "use strict;"
this is a story about how MS is doing security... however, 2 factor authentication has been in use for decades, even before computers became the common day things they are today. In the military, I've seen where it takes 3 people and two keys just to open a door to a secured space. The tech is new, and hopefully now that MS is telling people that is how they do things, perhaps banks and other people with my personal information stored up will start doing the same??? sigh
Support NYCountryLawyer RIAA vs People
They whip out the OEM image CD and reinstall. The down side is they have to get rid of all those AOL icons and replace Norton AV each time.
The world is made by those who show up for the job.
I've noticed that the best way to find problems with your own product is to have your employees (forced to) use it on a daily basis. I'm no Microsoft fan nor a software engineer but it seems to me to be the quickest way to find holes that testing didn't uncover. Now that in itself presents an interesting question: does that make it harder to find SECURITY problems if you're testing your product behind all those corporate protections (assuming they work)? It's no real-world experience to do that.
Honestly, my own computers fight off thousands of "attacks" a month, if you lower the bar enough. Are there worms knocking on port 137? Or are these actual hackers with stolen passwords/passcards?
and burn!
Slashdot Burying Stories About Slashdot Media Owned
I can only pray that this is the 'quiet before the storm'!
But then again, it's not like M$ attacks anyone, ever... is it? Been annoying any crackers/hackers/consumers/people recently? Friendly with Linux users and developers etc., are we?
"You reap what you sow."
The article reads like an advertisement for Microsoft products. The article has a nice catchy subject line and the proceeds to explain how Microsoft leverages such neat toys as Exchange proxies, Microsoft Office Communicator, etc. The article is so heavy on naming each little piece of software that it reads like a big advertisement. How much do you want to bet it is a press release from Microsoft reprinted by Computerworld?
Tommorow we're going to hear from the ping department at Yahoo.
I always wondered what they do with all those echo requests.
The difficult part is finding a way to define 'employees' under 'detainees', that would allow them to do this.
Defining Statistics and Social Research
I wonder how they got to the 100,000 number. If you count port scans and IP spoofs then my home network sees thousands of attacks every month.
Jesus, this is mindblowing.
You have to realize, that though they do get a that many attacks per month, they have the money to dump into network security to sure up what the issue are. Not just the software side, but the actual people able to monitor all those incoming attacks. Plus the systems they (hackers)are trying to attack/hack are ones they MS programmed. Who other then MS should know their software. They programmed it, they should be able to protect it. If there are issues, throw more bodies, and money into it so that it gets fixed. Does that help all the other companies that use MS products, I would guess eventually, but most companies don't have the resources, or the money to spend that MS has. Something more impressive would be a solution they sold to someone, that has one IT person on staff, they receive 100k of attacks per month, and they run without issue.
Quid Pro Quo, nothing more, nothing less.
Those with the skills to steal it have no use for it.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
The software giant fights off more than 100,000 attacks every month, protecting their data-heavy internal network from the paws of your average script kiddie.
If MS is using the routine fuzzy-math they tend to throw out when attempting to make the company seem more powerful and dominating than is backed up by reality, the '100,000 attacks' could be 99,999 pieces of spam email and one ping-flood.
See, this is how MS routinely tries to brainwash Joe and Jane consumer. Toss out a statistic that is impossible to verify, along with just enough verbal imagery to impress non-tech savvy spenders and you're on your way to profitsville!
'data-heavy internal network...' That is some pretty shiny bull-shit, by the way...data-heavy! As opposed to what? I can see those steel grey towering industrial strength routers, embedded into solid concrete bunkers, laced with 50 cm MIL spec reinforcing bar that is tied deep in bedrock, far below the cavernous data centers the brave MS engineers toil without end to feed, with miles and miles of 1 meter thick ethernet cables, snaking like giant blood veins, throbbing quietly as the beast that is MS R&D works around the clock for the good of mankind.
Makes me proud to be an American, I 'tell ya!
100,000 is very low, on a typical home machine if you're getting hundreds or thousands of attempts by bots, then surely the biggest software maker is getting millions. However, if they mean 100,000 attacks by individuals per month, meaning someone directly trying to "hack into microsoft", that seems impressively high. Wouldn't at least several of those get in through social engineering alone (i.e. pretend to be hot girl, get password, etc.)?
stuff |
shhhhh.. Don't leak this one... Remember Hotmail anyone?
Will the War in Iraq get better or worse in 2007? Vote here
...someone might steal the Windows code and come out with a competing operating system. :P
God forbid someone from the open source community gets ahold of it. It might actually work.
if I were able to see further, it was because I stood on the shoulders of Giants -Newton
Do you think Microsoft has their own version of Linux now? That would be the only answer, I would think.
Either that, or my buddy Josh (and many others) is doing his job properly!
Zhrodague.net - I do projects and stuff too.
...that's a black hole it'll never come back from!
Custom, hands-free Linux installs. Instalinux
"...and also know something, in this case a password."
That's a novel idea.
/* No Comment */
Microsoft sends care packages of bees to hackers. Leaked internal memos suggest turmoil amongst executives who can't decide if they should send more bees or just pull out entirely. A study group has determined that Microsoft should begin talks with various hacker groups as a diplomatic means of ending the bloodshed, but few believe that it will stop the attacks or the need for more bees. Many mourn for the loss of the bees, who die upon losing their stingers, while others point out that these are volunteer bees and that it's to be expected.
"Sufferin' succotash."
Having worked with M$ for a few months, I called tech support a few times and they all asked me to set the "Automatically accept requests" for remote desktop support, and all support people were from outside vendors outside of the country. Each time I refused to check it, but imagine all the people that did leave it checked for others to easily remotely control their machines.
"Steve, send the phone spiders."
12:50 - press return.
100k attacks per month for Microsoft seems low to me. That is about 1 attack every 30 seconds. I'm not saying that this is a low number on an absolute scale, but it seems low for MS. I might have just assumed they were continuously under multiple attacks.
i\hbar\dot{\psi}=\hat{H}\psi
I, for one, welcome our new ping-responding overlords.
Of all major operating systems, UNIX is the only one originally meant for gaming.
They all use Macs.
And all this time, I thought they just used that laser from Tron attached to a satellite that they would aim at unsuspecting hackers to digitize them into the gaming grid where they must dodge flying chairs thrown by a virtual Steve Balmer (Donkey Kong Style).
DEAD DEAD DEAD DELETE ME
Oh man, if you've got any Shockwave skills, you *have* to write that game and post a link. I would play it!
Comment removed based on user account deletion
you know, i never really thought of it, but unix was originally meant for gaming. holy carp. it is too bad it didn't evolve well with it, but I suppose the thing to blame is the unix wars. the potential speed for gaming even on linux is pretty intense. some of the schedulers may need some tuning but even so the times used in system calls is pretty low, and the other stuff like transferring data to the video card is probably the only hurdle. there was a writeup by the nvidia folks about what freebsd would need to do to get up to linux's speed levels that is quite interesting. in some ways, the linux kernel's desire to only allow open drivers and the unix wars of old produce slightly similar results. (not that I am going to argue for closed drivers -- no elf'in way) oh how i pity the fate of beos.
"but money is the God of Algiers & Mahomet their prophet." - Rich. O'Bryen June 8th 1786
What I'd like is two-factor authentification using a USB stick. The best I've seen is pam_usb (http://www.linuxjournal.com/article/8338) , but haven't tried it yet. Anyone tried this or anything like it?
My company forces me to use a similar VPN system. While I don't have a smartcard, my computer is scanned every time I connect. (Actually, I can only connect company-controlled computers through the VPN.)
It's such a pain to use the VPN due to all of the security measures. I'd rather have typical remote access software restricted to a VNC-like program that I can run on any computer.
No, I will not work for your startup
You don't have to tell me, I'm omniscient.
- Jesus
I'll finally be able to store all of my p0rn on only eight CDs!
Write the password on the card!
The network servers remember what has been scanned at each log-in, and grant a grace period before requiring a rescan. Frequent users of the VPN can often log into the network in under a minute.
Wow. I can log into our VPN in about 15 seconds, and that includes the time it takes me to enter my password into the smart card. I'd keep the VPN open all the time too if it took that long to log in.
This is actually some details and things I'd like to know, and wouldn't have thought of.
TFA fails the non-obvious test. Great: They VPN in to a sandbox, which is something I thought about a long time ago, only for another reason than remote attestation. It's also nice that they've figured out how to use SSL instead of a VPN 100% of the time, and to let people set up LANs. Two-factor authentication -- wow, revolutionary. NOT.
But it's nice to hear about things like you actually eating your own dogfood -- something that I'm guessing is recent, considering what I remember of Windows 98 and 2k, as well as early XP.
I would be happy to argue with you all day about whether Microsoft should be using Linux, but of course they're not. I imagine any departments doing so would have to fear The Chair and his "Linux infringes on our IP" claims.
Don't thank God, thank a doctor!
Perhaps it's something to do with the search engine they usually use?
"Women are just like ninjas; They lie even when it is more convenient to tell the truth." ~ Unknown