Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Bots Effectively DDoSing Perl CPAN Testers

Posted by timothy on from the stuck-in-a-rut dept.

at_slashdot writes "The Perl CPAN Testers have been suffering issues accessing their sites, databases and mirrors. According to a posting on the CPAN Testers' blog, the CPAN Testers' server has been being aggressively scanned by '20-30 bots every few seconds' in what they call 'a dedicated denial of service attack'; these bots 'completely ignore the rules specified in robots.txt.'" From the Heise story linked above: "The bots were identified by their IP addresses, including 65.55.207.x, 65.55.107.x and 65.55.106.x, as coming from Microsoft."

40 of 332 comments (clear)

  1. So how do we DDoS Microsoft? by drinkypoo · · Score: 4, Funny

    Anyone know what sites on Microsoft's front-facing sites are most computationally intensive, and yet always dynamically generated? :D

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    1. Re:So how do we DDoS Microsoft? by jlp2097 · · Score: 5, Informative

      Not necessary. A Bing Product Manager has already commented on the CPAN Testers blog entry upon which the article is based:

      Hi,
      I am a Program Manager on the Bing team at Microsoft, thanks for bringing this issue to our attention. I have sent an email to barbie@cpan.org as we need additional information to be able to track down the problem. If you have not received the email please contact us through the Bing webmaster center at bwmc@microsoft.com.

      As said below, never ascribe to malice that which can be adequately explained by stupidity. (Insert lame joke about MSFT being full of stupidity here).

    2. Re:So how do we DDoS Microsoft? by Anonymous Coward · · Score: 5, Funny

      As much spam as I get from ir@infousa.com , I wish that someone would DDOS that damned company. If I knew of a way to get extra spam to ir@infousa.com I would probably do it so that company could get a taste of its own medicine. ir@infousa.com sent me unsolicited spam and it drives me nuts. Thanks for nothing, ir@infousa.com . It makes me want to call the company at (402)593-4500 and complain, but I don't have time. I guess I'll email them at ir@infousa.com instead. maybe.

    3. Re:So how do we DDoS Microsoft? by kulnor · · Score: 5, Funny

      Well, with Barbie(TM) on the case, this should be quickly resolved (unless she's too busy with G.I.Joe(TM))

    4. Re:So how do we DDoS Microsoft? by PetoskeyGuy · · Score: 4, Insightful

      Why make things worse? Block the ip address or range and notify the admins. This isn't a chan mob.

    5. Re:So how do we DDoS Microsoft? by Anonymous Coward · · Score: 5, Insightful

      "as we need additional information to be able to track down the problem."

      IP addresses aren't enough? You're MS--if you can't fix the problem and IP addresses are given, damn, that's just sad. You're freaking massive multi-billion dollar tech companies, and this is the best you can do?

      No wonder Chinese hackers own our asses.

      Then again, it took Comcast 9 months to fix a security hole in customer accounts (which would have required an s to http to make pages SSL'd), and the only reason it was "fixed" was because they did their annual website makeover and changed their entire system to something Flash based. Then again, I had contacted a VP, VP's security, referred to web security, and talked to web security 3x, talked to a manager. The last 3 groups verified the problem. It was referred to their web applications team by that point, who sat on it.

      Lovely world we live in.

    6. Re:So how do we DDoS Microsoft? by WinterSolstice · · Score: 4, Insightful

      Actually, your statement works better with 'INSERT LANG HERE'...

      I'm always surprised by how people seem to think that any language has a monopoly of some sort on sloppy and/or lazy coders. Been doing IT a long time, and the one thing that never changes is the sloppy/lazy code issue. It even predates programming, you know - look at infrastructure around the world for examples of "just toss something out there, hope it works".

      --
      An operating system should be like a light switch... simple, effective, easy to use, and designed for everyone.
    7. Re:So how do we DDoS Microsoft? by Short+Circuit · · Score: 4, Insightful

      A quick guess? Identifying unique sites by domain name, rather than by IP address, and either the bot or server not respecting HTTP 301 redirects.

      With Rosetta Code, I once had www.rosettacode.org serving up the same content as rosettacode.org. My server got pounded by two bots from Yahoo. I could set Crawl-Delay, but it was only partially effective; One bot had been assigned to www.rosttacode.org, while another to rosettacode.org, and they were each keeping track of their request delay independently. I've since corrected things such that www.rosettacode.org returns an HTTP 301 redirect to rosettacode.org, and have was eventually able to remove the Crawl-Delay entirely.

      I've since worked towards only serving up content for any particular part of the site on a single domain name, and have subdomains such as "wiki.rosettacode.org" redirect to "rosettacode.org/wiki", and "blog.rosettacode.org" to "rosettacode.org/blog". Works rather nice, though it does leave me a bit more open to cookie theft attacks.

      YMMV; As I said, that was a quick guess.

      --
      tasks(723) drafts(105) languages(484) examples(29106)
    8. Re:So how do we DDoS Microsoft? by Spatial · · Score: 5, Funny

      How horrible are your employees at their jobs when they require the assistance of their victims to fix the problem?

      [Every IT worker on Slashdot looks around nervously]

    9. Re:So how do we DDoS Microsoft? by jc42 · · Score: 4, Interesting

      As said below, never ascribe to malice that which can be adequately explained by stupidity. (Insert lame joke about MSFT being full of stupidity here).

      Yeah, though this particular sort of stupidity has been going on for a long time, and not just at Microsoft (though they seem to be the worst culprit).

      I run a couple of sites that, among other things, has links to return the "content" in a list of different formats (GIF, PNG, PS, PDF, ...). Periodically, the servers get bogged down by search sites hitting them many times per second, trying to get every file in every format. The worst cases seem to come from microsoft.com and msn.com, though it happens with other search sites, too. Actually, the first attempts I saw at "deep search" like this came from googlebots around 10 years ago, though they quickly backed off and haven't been a serious problem since then. MS-origin "attacks" of this sort have been happening every few months, for nearly a decade.

      I've generally handled them with a couple of techniques. One is to check the logs for successive requests from the same address, and insert sleep() calls with progressively longer sleeps as more messages arrive. The code prefixes the "content" with a comment explaining what's happening, in case a human investigates.

      Another technique is to look for series of "give me this in all your output formats" requests, verify that it's a search bot, and add the address to a "banned" list of sites that simply get a message explaining why they aren't getting what they asked for, plus an email address if they want to get in contact. So far nobody at any search site has ever used that address. I did once get a response from a guy who was studying sites with such multi-format data, for a school project, to see how the various output formats compared in size and information content. I took his address off the banned list, and suggested that he add a couple-second delay between requests, and he finished his project a few days later.

      I suspect that the googlebot folks may have read my explanation of the delays and added code to spread their requests out over time, since that's what their bots seem to do now. But I never heard from them. They must have gotten complaints (and bans) from lots of web sites when they started doing this, so they probably realized quickly that they should add code to prevent such flooding of sites.

      --
      Those who do study history are doomed to stand helplessly by while everyone else repeats it.
    10. Re:So how do we DDoS Microsoft? by Short+Circuit · · Score: 4, Insightful

      The REAL solution to your problem is for everyone to abandon the dumb-as-shite "www" prefix.

      Why bother with www.example.com and example.com? Get rid of it. Anyone who still puts "www." on their business cards is a dufus.

      REAL solutions to immediate problems don't depend on the rest of the world changing to suit my needs. Also, the fact remains that there are links out there that point to "http://www.rosettacode.org/w/index.php?something_or_other", not all of those links will (or can) change, and I would be an absolute fool to knowingly break them, if I want people to visit RCo via referral traffic.

      --
      tasks(723) drafts(105) languages(484) examples(29106)
    11. Re:So how do we DDoS Microsoft? by raju1kabir · · Score: 4, Insightful

      Different system's doesn't really apply but what if the site's robots.txt is slightly different (different newlines or something) which is causing an unforeseen error?

      There is a spec for robots.txt. If someone's not following it, then it's their fault. Given Microsoft's past history, I know where I'd point the finger absent any more concrete information.

      --
      "Patriotism is your conviction that this country is superior to all other countries because you were born in it." -- GBS
    12. Re:So how do we DDoS Microsoft? by mounthood · · Score: 4, Insightful

      As said below, never ascribe to malice that which can be adequately explained by stupidity.

      Must be really easy to just beat you in the face, and say “Ooops, I’m sorry, I’m so st00pid! *drool*” I call bullshit on that rule.

      My rule: Don’t make judgements at all (either way), about things that you just don’t know.

      How about: Don't mistake organizational stupidity for individual stupidity. This isn't the case of a single bad coder making a mistake, this is an organization that's chosen to how much effort to apply. How much testing and review? What failsafe's, logging and active monitoring? Will options for feedback be accessible and responsive? Stupidity and Malice aren't mutually exclusive for an individual, and certainly not for an organization.

      --
      tomorrow who's gonna fuss
    13. Re:So how do we DDoS Microsoft? by Chris+Burke · · Score: 5, Insightful

      I've never liked that saying because of the implication that malice and stupidity are exclusive.

      Dumb and mean are often found together.

      --

      The enemies of Democracy are
    14. Re:So how do we DDoS Microsoft? by dissy · · Score: 4, Interesting

      Every once in a while, I still see sites that don't serve up unless you include "www." in the address - but it's like I said - a dufus.

      Looks like someone hasn't read RFC 1178 and enjoys breaking interoperability.

      Your method also breaks email by redelegating MX records one sub domain above where the control should be and MX's point to, thus breaks delegation of sub domains.

  2. I've seen it before by LordAzuzu · · Score: 5, Interesting

    I manage some networks in my home city in Italy, and in the past year I've often seen strange traffic coming from some of their IP addresses. Guess they have been exploited by someone long time ago, and didn't even notice it.

  3. Check the blog... by strredwolf · · Score: 4, Funny

    Looks like Microsoft's Bing managers are on it. They'll make it worse in no-time flat. :)

    BTW, the difference between a DDOS and a Slashdotting? You know why your site went down -- you got linked!

    --

    --
    # Canmephians for a better Linux Kernel
    $Stalag99{"URL"}="http://stalag99.net";
    1. Re:Check the blog... by Anonymous Coward · · Score: 5, Funny

      BTW, the difference between a DDOS and a Slashdotting?

      The DDOS bots actually read TFA.

    2. Re:Check the blog... by jc42 · · Score: 4, Insightful

      They admitted they were powerless to solve their own problems without help from their victims.

      Heh. It's another "damned if you do; damned if you don't" scenario. Usually, people criticise Microsoft for developing software without bothering to consult or test with actual customers. Now we have a manager of a MS dev group that actually does communicate (though not exactly with "customers"), and acts on what they say, so he's criticised for needing help from his "victims".

      Ya can't win that game.

      But the fact is that if you're developing server-side web software, you need to test it against real-world sites, not just the toy sites you've set up in your lab. And we all know the "Sourcerer's Apprentice" sort of bug that produces a runaway test that tries to do something as many times as it can per second until it's killed. Good testers will be on the lookout for such events, but it's understandable that they might fail occasionally

      Among web developers, MS does have a bit of a reputation for hitting your new site with a flood of requests, trying to extract everything that you have (even the content of your "tmp" directory which your robots.txt file says to ignore). There are lots of small sites that block MS address ranges for just this reason.

      It should be considered good news that there's at least one MS manager who understands all this, and is willing to talk to the "victims" and fix the problems. Now if they could fix the next-level problem, that this sort of thing happens repeatedly and their corporate culture seems to have no way to prevent it from happening again.

      --
      Those who do study history are doomed to stand helplessly by while everyone else repeats it.
  4. Probably just a bug. by tjstork · · Score: 5, Insightful

    I know everyone likes to assume that Microsoft is being evil here, but wouldn't the more realistic assumption be that they were just being incompetent?

    --
    This is my sig.
    1. Re:Probably just a bug. by Lloyd_Bryant · · Score: 5, Insightful

      I know everyone likes to assume that Microsoft is being evil here, but wouldn't the more realistic assumption be that they were just being incompetent?

      Sufficiently advanced incompetence is indistinguishable from malice. For additional examples, see Government, US.

      The simple fact is that ignoring robots.txt is effectively evil, regardless of the intent. It's not like robots.txt is some new innovation...

      --
      Don't tell me to get a life. I had one once. It sucked.
    2. Re:Probably just a bug. by fish+waffle · · Score: 5, Insightful

      I know everyone likes to assume that Microsoft is being evil here, but wouldn't the more realistic assumption be that they were just being incompetent?

      Probably. But since incompetence is the plausible deniability of evil it's sometimes hard to tell.

    3. Re:Probably just a bug. by djupedal · · Score: 4, Insightful

      > "I know everyone likes to assume that Microsoft is being evil here, but wouldn't the more realistic assumption be that they were just being incompetent?"

      We assume MS is evil...

      We know they are incompetent.

      We feel this is typical.

      We pray they'd just go away.

      We think this will never end...

    4. Re:Probably just a bug. by Yvanhoe · · Score: 4, Interesting

      There is such thing as criminal incomptence. If a script kiddie can be arrested for having a virus "out of control" I don't see why Microsoft engineers DDOSing a website couldn't be charged.

      By the way a philosopher once told that "evil" did not exist. That it was most of the time just a kind of hidden stupidity.

      --
      The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
    5. Re:Probably just a bug. by MrMr · · Score: 5, Insightful

      The problem is, there is no evidence that:
      Never ascribe to stupidity that which can be adequately explained by malice.
      Is invoking more entities.
      In fact, claiming that the commercially most successfull software company got there through stupidity rather than malice sounds extremely implausible to me.

    6. Re:Probably just a bug. by Rogerborg · · Score: 5, Informative

      You're probably new here, but if you'd RTFA, you'd see that:

      It seems their bots completely ignore the rules specified in the robots.txt, despite me setting it up as per their own guidelines on their site

      Come to think of it though, isn't this what happens to most people who try to interoperate with Microsoft?

      Amusingly, if I Google for "bing robots.txt" I get a link to a bing page titled "Bing - Robots.txt Disallow vs No Follow - Neither Working!" which has already been elided from history by Microsoft. CLassy.

      --
      If you were blocking sigs, you wouldn't have to read this.
    7. Re:Probably just a bug. by Suki+I · · Score: 5, Funny

      Try saving a copy as robots.docx and see if that works ;)

      --
      Home of The Suki Series
    8. Re:Probably just a bug. by Opportunist · · Score: 4, Funny

      Like my grandpa said, it doesn't matter how dumb you are. As long as you find someone even dumber to sell to.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    9. Re:Probably just a bug. by afidel · · Score: 4, Funny

      I wonder if it's a CR/CRLF bug =)

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
    10. Re:Probably just a bug. by schon · · Score: 5, Insightful

      It has nothing to do with the RTFA.

      their own guidelines on their site

      As anyone who has ever read MS documentation can tell you, you need to read it, then implement a test, so you can see what it really expects, then adjust your test, then try it until it works.

      Their problem is that they expected MS documentation to actually describe the expected behaviour.

    11. Re:Probably just a bug. by PinkyDead · · Score: 5, Funny

      Microsoft don't have any tools that can effectively read that format.

      --
      Genesis 1:32 And God typed :wq!
  5. This is a normal occurence for Bing by Anonymous Coward · · Score: 5, Informative

    I had a registration page - static content basically. The only thing that was dynamic was that it was referred to by many pages on the site with a variable in the querystring. Bing decided that it needed check on this one page *thousands* of time per day.

    They ignored robots.txt.
    I sent a note to an address on the Bing site that requested feedback from people having issues with the Bing bots - nothing.

    The only thing they finally 'listened' to was placing "" in the header.

    This kind of sucked because it took the registration page out of the search engines' index, however it was much better than being DDOS'd. Plus, the page is easy to find on the site so not *that* big a deal.

    Bing has been open for months now and if you search around there are tons of stories just like this. Maybe now that a site with some visibility has been 'attacked', the engineers will take a look at wtf is wrong.

  6. Flooding... by Bert64 · · Score: 4, Informative

    I have noticed the microsoft crawlers (msnbot) being fairly inefficient on many of my sites...
    In contrast to googlebot and spiders from other search engines msnbot is far more aggressive, ignores robots.txt and will frequently re-request the same files repeatedly, even if those files haven't changed... Looking at my monthly stats (awstats) which groups traffic from bots, msnbot will frequently have consumed 10 times more bandwidth than googlebot, but is responsible for far less incoming traffic based on referrer headers (typically 1-2% of the traffic generated by google on my sites).

    Other small search engines don't bring much traffic either, but their bots don't hammer my site as hard as msnbot does.

    --
    http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  7. Are you sure? by Errol+backfiring · · Score: 4, Insightful

    Are we sure this traffic comes from Microsoft? Could it not consist of forged network packets? You don't need a reply if you are running a DDOS. On the other hand, why would anyone, including Microsoft, want to bring down CPAN?

    --
    Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
    1. Re:Are you sure? by TheRaven64 · · Score: 5, Informative

      Are we sure this traffic comes from Microsoft? Could it not consist of forged network packets?

      It's a TCP connection, so they need to have completed the three-way handshake for it to work. That means that they must have received the SYN-ACK packet or by SYN flooding. If they are SYN flooding, then that would show up in the firewall logs. If they've received the SYN-ACK packet then they are either from that IP, or they are on a router between you and that IP and can intercept and block the packets from thatIP.

      You don't need a reply if you are running a DDOS.

      You do if it's via TCP. If they're just ping flooding, then that's one thing, but they're issuing HTTP requests. This involves establishing a TCP connection (send SYN, receive SYN-ACK with random number, reply ACK with that number) and involves sending TCP window replies for each group of TCP packets that you receive.

      On the other hand, why would anyone, including Microsoft, want to bring down CPAN?

      Who says that they want to? It's more likely that their web crawler has been written to the same standard as the rest of their code.

      --
      I am TheRaven on Soylent News
  8. Re:So block those IP ranges? by Sarten-X · · Score: 5, Insightful

    For ignoring robots.txt, they don't deserve any more nor less.

    --
    You do not have a moral or legal right to do absolutely anything you want.
  9. Re:Oh! *Literally* Microsoft bots! by Ardaen · · Score: 4, Informative

    Probably not, if you look at other incidents: http://cmeerw.org/blog/594.html it appears they just like to push the limits.

  10. Send the lost bots home. by N1ckR · · Score: 5, Funny

    I redirect lost bots home, seems a polite thing to do. 301 www.microsoft.com

  11. No problem by rgviza · · Score: 4, Informative

    ipchains -A input -j REJECT -p all -s 65.55.207.0/24 -i eth0 -l
    ipchains -A input -j REJECT -p all -s 65.55.107.0/24 -i eth0 -l
    ipchains -A input -j REJECT -p all -s 65.55.106.0/24 -i eth0 -l

    problem solved

    --
    Don't kid yourself. It's the size of the regexp AND how you use it that counts.
    1. Re:No problem by j_sp_r · · Score: 4, Informative

      Linux IP Firewalling Chains, normally called ipchains, is free software to control the packet filter/firewall capabilities in the 2.2 series of Linux kernels. It superseded ipfwadm, but was replaced by iptables in the 2.4 series.

      You're a few kernels behind.