Microsoft suffers triple Web site fiasco

Last week was a tough one for Microsoft’s online business. After an
apparent employee error caused the company’s main Web sites to go down for
some 22 hours, the same sites subsequently came under attack on Thursday and
Friday from hackers who unleashed a series of denial-of-service attacks on the
company’s sites.

The disruptions started just hours after Microsoft began a $200 million
marketing campaign touting the reliability of its networking operating software.
"Microsoft accepts full responsibility for the inconvenience that our
customers have experienced over the past couple of days,'' said Rick Devenuti,
Microsoft vice president and chief information officer, who conceded that
Microsoft had not deployed "sufficient self-defense techniques" at the
front-end of its networks.

In the "denial-of service" attacks, hackers unleashes a massive
flood of e-mail requests on the targeted sites, effectively shutting them down.

Microsoft’s decision to maintain all of its domain servers on one computer
network compounded the problem. It was unknown whether the same group of hackers
was responsible for the second wave of attacks. That would seem likely
considering the amount of planning necessary to coordinate a denial-of-service
attack. In such instances, the information requests come from a large number of
"zombie" computers spread around the world which have previously been
infiltrated with a virus that allows the attacker to command the systems to
commence an attack at a certain date and time.

A year ago, a similar series of attacks was launched against a broad range of
popular Web sites, including Yahoo!, ESPN.com, Amazon.com and eBay.
Denial-of-service attacks have become very common. "Each site that we
monitor is attacked almost every single day," said Amit Yoran, chief
executive of network security firm, Riptech. "When I say the Internet is a
hostile environment, it's a hostile environment."

There are few defenses against attacks as most of the requests arrive as
seemingly legitimate information requests. But Microsoft said that in response
to the attacks, it has hired Akamai Technologies to operate a backup Internet
network. If a Web user cannot access a Microsoft site, the user will be directed
to Akamai's backup network. In September 1999, Microsoft bought a $15 million
stake in Akamai of Cambridge, Massachusetts.