Microsoft admits defence against attacks was inadequate

Microsoft Corp. confirmed on Jan. 26 that some of its Web sites had been struck by a second round of denial-of-service attacks and acknowledged that it “did not apply sufficient self-defence techniques” to key parts of its computer networks before the assaults began.

In a statement, Microsoft CIO Rick Devenuti said the software vendor “accepts full responsibility” for the inconveniences caused to users because of the denial-of-service attacks. He added that “the painful lessons we’ve learned” have already prompted the company to make changes to its network architecture, including a deal with an outside firm to deploy a backup set of Domain Name System (DNS) servers for Microsoft’s sites.

“In the past, Microsoft has focused on understanding and protecting against attacks on Microsoft products,” Devenuti said. “Unfortunately, as we have learned over the last few days, we did not apply sufficient self-defence techniques to our use of some third-party products at the front-end of parts of our core network infrastructure.”

Security analysts had said, before the second round of denial-of-service attacks came to light, that Microsoft should take a closer look at its security practices. In particular, the company faced questions about having all four of its DNS servers on a single network – a set-up that observers said was an inviting target for attackers.

Microsoft spokesman Adam Sohn said the company has now arranged backup DNS servers for its Web sites through a “short-term deal” with Akamai Technologies Inc. in Cambridge, Mass. One of the fastest lessons learned from last week’s problems “was to go ahead and distribute our DNS [systems]” over several locations, he added. The cost and length of the backup deal weren’t immediately available.

Most of Microsoft’s Web sites were inaccessible on three separate occasions that same week. The second denial-of-service attack followed a similar assault that disrupted the company’s sites for much of one day. That, in turn, was preceded by a 22-hour outage that began two days earlier and was blamed by Microsoft on a faulty configuration change made to the routers on its DNS network.

The Akamai-run backup servers were since added in response to the initial outage, not the later attacks, Sohn said. Other changes could follow as Microsoft reviews its defensive strategies, he added, but nothing has been finalized yet. “I think we’re a little too close [to when the attacks happened] to know what final architectural decisions to make,” Sohn said.

Devenuti said the Jan. 26 attack was less disruptive than the one the day before. Users trying to access Microsoft’s Web sites experienced “intermittent delays” during two 15-minute periods, he said, adding that all of the company’s sites were back up and running in normal fashion by 3:30 p.m. EST.

The Microsoft CIO pledged that the company will continue to examine its systems, network architecture and internal processes in an attempt to devise additional safeguards. Microsoft “regrets any inconvenience to our customers” as a result of the outages, Devenuti said. But, he added, no customer data was compromised as part of the attacks.

Denial-of-service attacks flood networks with huge numbers of bogus information requests, which eventually can overload the servers and cause them to stop responding to legitimate queries. Security analysts have said that there currently are no adequate mechanisms for stopping the attacks once they’re launched.

The recent outages followed an incident last fall in which Microsoft disclosed that its internal computer network was hacked by intruders who were able to view the source code for an unspecified future product. And two months ago, a Dutch hacker penetrated one of Microsoft’s Web servers on two separate occasions after the company failed to plug a known security hole in its Web server software.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Previous article
Next article

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now