Hackers Block Microsoft Site Access

Friday, January 26th 2001, 12:00 am

By: News On 6

REDMOND, Wash. (AP) â€” Hackers blocked access to several Web sites owned by Microsoft Corp. on Thursday, just one day after the software giant corrected an employee's error that shut consumers out of its sites.

The so-called ``denial-of-service attack'' occurred Thursday morning, intermittently preventing Web surfers from accessing Web sites including Microsoft.com and MSN.com, the company said in a statement.

The company said all sites were accessible by around noon Thursday.

The attack comes a day after what the Redmond-based software maker called an employee error kept millions of people from visiting its Web sites for 22 hours. Microsoft said the two outages were not related.

This attack targeted network equipment that directs Internet traffic, Microsoft said. Denial-of-service attacks occur when hackers, using automation software, overwhelm a site with so much fake traffic that legitimate Internet users cannot get through.

It's like hundreds of pranksters tying up phone lines by trying to call a single phone number at once.

Hackers do not have to break in to a site to launch such an attack, although in many cases they break into third-party computer systems and launch attacks from there to avoid tracing.

A Microsoft employee who spoke on condition of anonymity said Thursday's attack was first spotted by company technicians who were monitoring network activity.

``It's not the first time people have made attempts,'' the source said. ``This one was a little bit more effective.''

Denial-of-service attacks are common and techniques have been developed to mitigate most of them, said Amit Yoran, chief executive of security company Riptech Inc.

Not all experts agreed.

``A well-run DOS attack is really hard to defend against,'' said Ryan Russell, incident analyst with SecurityFocus.com, which hosts the popular security mailing list Bugtraq. ``In most cases it boils down to someone with bigger pipes than you filling your pipes. There's nothing you can do except you can try to track them down.''

He added companies would have to block all traffic to avoid such an attack.

Last February, Yahoo, Amazon.com, CNN, eBay and other major Internet sites were crippled for hours at a time by similar attacks.

Last week, a 16-year-old Montreal boy known as ``Mafiaboy'' pleaded guilty to 56 charges of mischief in connection with some of those attacks. Ten other charges were dropped.

Microsoft said it had notified the FBI of Thursday's attack.

Microsoft has said the problem with its Web sites earlier this week was caused by a foul-up with Microsoft's name servers â€” computers that direct Web surfers to particular addresses on the Internet.

The problem began after a Microsoft technician reconfigured the network equipment that directs Internet traffic Tuesday evening, the company said. That caused many of Microsoft's sites to be unreachable Tuesday night and Wednesday.

The incidents probably won't have long-term effects on the company, Russell said. He noted people have complained about security problems with Microsoft products for years.

``Someone was probably kicking them when they were down,'' he said. ``Microsoft is not having a good week.''

Thursday's hack comes a few months after unknown hackers broke into Microsoft's computers and peeked at its blueprints for software in the early stages of development. That attack is still being investigated by the FBI.

Yoran of Riptech said he didn't think it was likely those hackers could have adjusted Microsoft's networks back in October to prepare for Thursday's attack.

Microsoft's sites are listed third on Media Metrix's Top 50 Digital Media/Web Properties At Home & At Work in the United States. Media Matrix's Web site says Microsoft sites had 53.8 million visitors in December.

Shares of Microsoft fell $1.13 to $61.81 in trading Thursday on the Nasdaq Stock Market, then fell to $60 in after-hours trading.

â€”â€”â€”â€”â€”

On the Net:

http://www.microsoft.com